Privacy Policy

​

1. Introduction

​

This is In Friendship Ltd’s Privacy Notice.

​

Who we are: In Friendship Ltd is a domiciliary care provider regulated by the Care Quality Commission (CQC). We are committed to protecting and respecting your privacy.

​

Data Controller: In Friendship Ltd is the data controller for the personal information we hold about you. This means we decide how your personal information is processed and for what purposes.

​

As part of the services we offer, we process personal data about:

​

• Service users who receive our domiciliary care services

• Website visitors and people who contact us

• Friends and relatives of our service users

• Job applicants and employees

​

"Processing" can mean collecting, recording, organising, storing, sharing or destroying data.

​

We are committed to being transparent about why we need your personal data and what we do with it. This information is set out in this privacy notice. It also explains your rights when it comes to your data.

​

Contact us:

 

If you have any concerns or questions please contact us:

​

Email: enquiries@infriendship.co.uk
Phone: 01993 650886
Address: The Old Butcher’s Arms, 104-106 Corn Street, Witney, OX28 6BU

​

2. Service Users (People who receive our care services)

​

What data do we have?

​

So that we can provide a safe and professional service, we need to keep certain records about you. We may process the following types of data:

​

Basic personal data:

​

• Your basic details and contact information e.g. your name, address, date of birth, telephone numbers and next of kin

• Your financial details e.g. details of how you pay us for your care or your funding arrangements

• Photographs for identification purposes (with your consent)

• Care plans and assessments

​

Special category (sensitive) personal data: We also record the following data which is classified as "special category" under data protection law:

​

• Health and social care data about you, which might include both your physical and mental health data, medication records, care needs assessments, and incident reports

• GP Connect data - We use a facility called GP Connect to support your direct care. GP Connect makes patient information from your GP practice available to our appropriate clinical staff when and where they need it, to support your direct care, leading to improvements in both care and outcomes

• Ethnicity, race, and religious beliefs - to ensure we can provide culturally appropriate care

• Dietary requirements - which may indicate religious beliefs or health conditions

​

Why do we have this data?

​

We need this data so that we can provide high-quality, safe and person-centred care and support. By law, we need to have a lawful basis for processing your personal data.

​

Lawful bases for processing personal data:

​

• Legal obligation - We have a legal obligation to process data under the Health and Social Care Act 2012, Mental Capacity Act 2005, and Care Act 2014

• Vital interests - To protect your life or someone else's life in emergency situations

• Legitimate interests - For safeguarding purposes and to ensure quality of care

​

Lawful bases for processing special category data:

​

• Social care provision - It is necessary for us to provide and manage social care services

• Legal obligation - We are required by law to process this data for safeguarding and regulatory purposes

• Vital interests - To protect your health and wellbeing

• Public interest - We are required to provide data to our regulator, the Care Quality Commission (CQC), as part of our public interest obligations

​

GP Connect specific legal basis: GP Connect operates under Article 6(1)(e) (public task) and Article 9(2)(h) (health and social care) of UK GDPR. Under the legal basis used for GP Connect, patients have the following rights: The right to be informed - patients have the right to be informed of how their data is being processed. This should be reflected in the patient's GP practice privacy notice. The right to object - patients have the right to object to this processing.

​

Consent: We may also process your data with your consent. If we need to ask for your permission, we will offer you a clear choice and ask that you confirm to us that you consent. We will also explain clearly to you what we need the data for and how you can withdraw your consent at any time.

​

GP Connect - Accessing Your GP Records

​

What is GP Connect? GP Connect is an NHS system that allows authorised health and social care staff to access relevant information from your GP medical record to support your direct care. This enables us to:

​

• View your current medications

• Check for allergies and adverse reactions

• Access relevant medical history

• Coordinate care more effectively

• Reduce medication errors

• Avoid unnecessary duplication of assessments

​

How we use GP Connect:

​

• Only authorised clinical staff can access GP Connect

• We only access information that is relevant to your care

• Access is logged and monitored

• GP Connect is not used for any purpose other than direct care

• Your GP practice retains control of your medical record

​

Your rights regarding GP Connect:

​

• You have the right to object to your GP information being shared through GP Connect

• You can discuss any concerns with your GP practice

• Opting out of GP Connect will not affect the care we provide through other means

​

Common law duty of confidentiality

​

In our use of health and care information, we satisfy the common law duty of confidentiality because:

​

• You have provided us with your consent (either implicitly to provide you with care, or explicitly for other uses)

• We have a legal requirement to collect, share and use the data

• The public interest to collect, share and use the data overrides the public interest served by protecting the duty of confidentiality (for example sharing information with the police to support the detection or prevention of serious crime)

​

Where do we get your data from and who do we share it with?

​

So that we can provide you with high quality care and support we collect data from and share data with:

​

We collect data from:

​

• You or your legal representative(s)

• Your GP practice (through GP Connect and other means)

• Local authorities

• NHS services

• Other care providers

• Family members (with your permission)

 

We collect data through:

​

• Face to face conversations

• Telephone calls

• Email

• Our website

• Post

• Application forms

• Mobile applications and care management systems

 

We may lawfully share your data with:

​

• Other parts of the health and care system such as local hospitals, your GP, pharmacies, social workers, clinical commissioning groups, and other health and care professionals

• The Local Authority who commission or fund your care

• Your family or friends – with your permission or in your best interests

• Organisations we have a legal obligation to share information with including:

  • Care Quality Commission (CQC)

  • Local Authority safeguarding teams

  • NHS England for quality monitoring

• Emergency services including police, ambulance, and fire service when necessary

• Legal authorities including the police, courts, or other law enforcement agencies if required by law or court order

• Insurance companies (with your consent)

• Professional advisers including lawyers, accountants, and auditors

 

3. National Data Opt-Out

 

We respect the national data opt-out because we may use confidential patient information for purposes beyond individual care.

​

The information collected about you when you use health and care services can also be used and provided to other organisations for purposes beyond your individual care, for instance to help with:

​

• Improving the quality and standards of care provided

• Research into the development of new treatments

• Preventing illness and diseases

• Monitoring safety

• Planning services

​

This may only take place when there is a clear legal basis to use this information. All these uses help to provide better health and care for you, your family and future generations. Confidential patient information about your health and care is only used like this when allowed by law.

​

Most of the time, the data used for research and planning is anonymised, so that you cannot be identified and your confidential patient information is not accessed.

​

You have a choice about whether you want your confidential patient information to be used in this way. If you are happy with this use of information you do not need to do anything. If you do choose to opt out your confidential patient information will still be used to support your individual care.

​

To find out more or to register your choice to opt out, please visit www.nhs.uk/your-nhs-data-matters.

​

You can change your mind about your choice at any time.

​

4. Website Visitors and General Enquiries

 

Visitors to our website

​

When someone visits www.infriendship.co.uk, we use a third-party service, Google Analytics, to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors we receive to various parts of the site. This information is only processed in a way which does not identify anyone. We do not make, and do not allow Google to make, any attempt to find out the identities of those visiting our website.

​

If we do want to collect personally identifiable information through our website, we will do this in an honest, transparent way. We will make it clear when we collect personal information and will explain what we intend to do with it.

​

Use of cookies

​

A 'cookie' is a small text file which attaches to your hard drive and from which it can store and sometimes track information on how you make use of a particular website.

​

We may use cookies for administrative purposes such as cataloguing traffic patterns throughout the website and to assign a 'user ID' for this purpose. Cookies, by themselves, cannot be used to find out the identity of any user.

​

You may set your browser to automatically reject all cookies. However, please note that you may not be able to use the full service on our website without cookies.

​

Further detailed information on cookies can be found at: http://www.allaboutcookies.org

​

Website hosting - Wix

​

We use Wix to publish our website and content. We may collect anonymous information about users' activity on the site to monitor and report the effectiveness of the site. For more information about how Wix processes data, please see Wix's privacy notice.

​

Social media and social sharing

​

We have an active presence on several external social channels including Facebook, Twitter (X), LinkedIn and YouTube. We use social sharing buttons for these services which may place cookies on your device.

​

When you use any of our social media channels we may record and retain information about you. By using our social media channels and providing us with personal information, you are agreeing that you accept our terms.

​

People who contact us via online forms, email, or telephone

​

Your personal data will enable us to respond to your enquiry and keep you updated with relevant information about our services. We will not pass on your details to third-parties for marketing.

​

When a contact form is submitted, the enquiry is saved to our database for six months before it is deleted. Email enquiries are managed by Google Workspace, processed for their intended purpose, and then deleted according to our retention policy.

You can opt-out of receiving communications at any time by contacting enquiries@infriendship.co.uk

​

5. Friends/Relatives of Service Users

 

What data do we have?

​

As part of our work providing high-quality care and support, it might be necessary that we hold the following information about you:

​

• Your basic details and contact information e.g. your name, address, telephone numbers

• Your relationship to our service user

• Emergency contact details

• Any relevant information about your ability to support the service user

​

Why do we have this data?

​

We process your data because we have a legitimate business interest in:

​

• Holding next of kin and lasting power of attorney information

• Keeping emergency contact details

• Facilitating family involvement in care (where appropriate and consented to)

• Ensuring safeguarding requirements are met

​

We may also process your data with your consent.

​

Where do we get your data from and who do we share it with?

​

We may lawfully share your data with:

​

• Other parts of the health and care system

• The Local Authority

• Emergency services when necessary for the service user's welfare

• Legal authorities if required by law

​

6. Third-Party Systems and Providers

 

We use a number of third-party cloud-based services for the purposes of effectively running our business and providing our services to you. We also use a number of third-party organisations, e.g. accountants, HR support, CRM system etc.

 

In all cases where we are using a third-party service or company, We will only provide the minimal amount of information required.

​

We always carry out due diligence against all our third-party suppliers for the purposes of ensuring their compliance with Data Protection Legislation and specifically that they have suitable security measures in place to protect your data.  We also make sure a legally binding contract (sometimes called a Data Processing Agreement or DPA) is also in place to protect your data.

​

7. How we store and protect your personal information

 

Data security

​

We take the security of your personal information seriously. We have appropriate technical and organisational measures in place to prevent your personal information from being accidentally lost, used, altered, disclosed, or accessed without authorisation.

​

Data retention

​

Your information is securely stored for appropriate time periods:

​

• Care records: Minimum 8 years after last contact, or until age 25 (whichever is longer)

• Website enquiries: 6 months

• Email enquiries: Processed and deleted according to retention policy

• Employment records: As per legal requirements

• Complaint records: 2 years from closure

​

We will then securely dispose of information by shredding paper records, permanently deleting digital records, or wiping hard drives to legal standards.

​

International transfers

​

We do not transfer your personal data outside the UK.

​

8. Your Rights

 

Under data protection law, you have the following rights:

 

Right to be informed

You have the right to be told how your personal data is being used – which is what this privacy notice is for.

 

Right of access (Subject Access Request)

You can request a copy of all data we hold about you. We will respond within one month and generally will not charge for this service.

 

Right to rectification

You can ask us to correct any inaccurate or incomplete data.

 

Right to erasure

You can ask us to delete data that is no longer necessary for its original purpose.

 

Right to restrict processing

You can ask us to restrict processing in certain circumstances.

 

Right to withdraw consent

Where we process data based on your consent, you can withdraw that consent at any time.

 

Right to object

You can object to processing based on legitimate interests or public tasks. Specific to GP Connect: You have the right to object to your GP information being accessed through GP Connect.

 

Right to data portability

You can ask for your data to be transferred to another organisation in certain circumstances.

 

Making a request

To exercise any rights, contact us using the details above. You may need to provide identification. We will respond within one month.

 

9. Complaints

 

You can complain about our data processing to:

​

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Website: https://ico.org.uk/global/contact-us/
Phone: 0303 123 1113

​

You can also complain about our services to:

​

Care Quality Commission
Website: www.cqc.org.uk
Phone: 03000 616161

​

10. Links to Other Websites

 

This privacy notice does not cover links to other websites. Please read the privacy statements on other websites you visit.

 

11. Changes to this Privacy Notice

 

We keep our privacy notice under regular review. Any significant changes will be communicated to you directly where possible. The current version will always be available on our website.

​