Privacy Policy

Introduction

This is the Privacy Notice for iBC Healthcare Group Ltd and its subsidiary organisations (collectively referred to as “iBC Healthcare”). It explains how we collect, use and protect personal data, and sets out the rights you have in relation to that data.

As part of the services we provide, we are required to process personal data about our staff, the people we support, and in some instances the friends and relatives of those we support. “Processing” includes collecting, recording, organising, storing, sharing and destroying data.

We are committed to being transparent about why we need your personal data, what we do with it, and with whom we share it. This notice explains that and sets out your rights under data protection law.

If you have any concerns or questions about how we handle your personal data, please contact our Data Protection Officer:

Anna Goscombe, Director of Quality & Therapeutic Services

Email: info@ibchealthcare.co.uk

Post: iBC Healthcare Group Ltd, Willow Court, Thurmaston Lane, Leicester, LE5 0TE

People We Support

What data do we have?

So that we can provide a safe and professional service, we need to keep certain records about you. We may process the following types of data:

Basic details and contact information: your name, address, date of birth, and next of kin.
Financial details: funding arrangements and payment information.
Special category data: health and social care data about you, which may include both physical and mental health information.
We may also record data about your race, ethnic origin, sexual orientation or religion where this is relevant to your care.

Why do we have this data?

We need this data to provide high-quality care and support. By law, we must have a lawful basis for processing your personal data.

We process your personal data because:

We have a legal obligation to do so — generally under the Health and Social Care Act 2012 or the Mental Capacity Act 2005.
It is necessary for us to provide and manage social care services.
We are required to provide data to our regulator, the Care Quality Commission (CQC), as part of our public interest obligations.

We process your special category data because:

It is necessary due to social security and social protection law (for example, in safeguarding situations).
It is necessary for us to provide and manage social care services.
We are required to provide data to CQC as part of our public interest obligations.

We may also process your data with your consent. Where we need your permission, we will offer you a clear choice and explain what we need the data for and how you can withdraw your consent at any time.

Common law duty of confidentiality

In our use of health and care information, we satisfy the common law duty of confidentiality because:

You have provided us with your consent (either implicitly to provide you with care, or explicitly for other uses).
We have a legal requirement to collect, share and use the data.
The public interest to collect, share and use the data overrides the public interest served by protecting the duty of confidentiality (for example, sharing information with the police to support the detection or prevention of serious crime).

Where do we process your data?

To provide you with high-quality care and support we collect data from, and share data with, the following:

You or your legal representative(s).
Other parts of the health and care system: local hospitals, GPs, pharmacies, social workers, and other health and care professionals.
The Local Authority.
Your family or friends — with your permission.
Organisations we have a legal obligation to share information with, including for safeguarding and the CQC.
The police or other law enforcement agencies where required by law or court order.

We collect and share data face to face, via phone, via email, via secure digital platforms, and via post.

Third-party digital platforms

We use a number of digital platforms to support the delivery of care. These include, but not limited to, care planning software, medication administration records, compliance software, e-rostering etc. Each platform is subject to a data sharing agreement and is required to meet its legal obligations to protect your data rights. All platforms used by iBC Healthcare store data within the United Kingdom.

National Data Opt-Out

We review our data processing on an annual basis to assess whether the national data opt-out applies. At this time, we do not share any confidential patient or service user data for planning or research purposes beyond individual care, and the national data opt-out does not therefore apply to our processing activities. This is recorded in our Record of Processing Activities and reviewed annually.

You can find out more information at https://www.nhs.uk/your-nhs-data-matters/

Staff

What data do we have?

So that we can provide a safe and professional service and fulfil our obligations as your employer, we need to keep certain records about you. We may process the following types of data:

Basic details and contact information: your name, address, date of birth, National Insurance number, and next of kin.
Financial details: payment details, insurance, pension, and tax information.
Training and development records.
Recruitment and pre-employment information including references and right-to-work documentation.
Special category data: health records where necessary (for example, fit notes, occupational health referrals, or to process statutory pay entitlements).
We may also, with your permission, record data about your race, ethnic origin, sexual orientation or religion for equality monitoring purposes.

As part of your application, depending on your role, you will be required to undergo a Disclosure and Barring Service (DBS) check. We record that a DBS check has been completed but do not retain the certificate or its content once it has been reviewed.

Why do we have this data?

We require this data to contact you, pay you, and ensure you receive the training and support you need to perform your role. By law, we must have a lawful basis for processing your personal data.

We process your data because:

We have a legal obligation under UK employment law.
We are required to do so in the performance of a public task.
We have a legitimate interest in processing your data — for example, we provide data about your training to Skills for Care’s Adult Workforce Data Set to support national workforce planning.
We are required to provide data to our regulator, the CQC, as part of our public interest obligations.

We process your special category data because:

It is necessary for us to process requests for sick pay, maternity pay, or other statutory entitlements.
Where we request criminal records data, this is because we have a legal obligation to do so given the nature of your work, as set out in the Data Protection Act 2018 and the Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975.

Where do we process your data?

As your employer we collect data from, and share data with, the following:

You or your legal representative(s).
His Majesty’s Revenue and Customs (HMRC).
Our pension scheme provider (NEST).
Our payroll system (Sage).
The Disclosure and Barring Service (DBS).
Skills for Care.
Organisations we have a legal obligation to share information with, including for safeguarding and the CQC.
The police or other law enforcement agencies where required by law or court order.

We collect and share data face to face, via phone, via email, via secure HR and payroll systems, and via post.

Friends and Relatives

What data do we have?

As part of our work providing high-quality care and support, it may be necessary for us to hold the following information about you:

Basic details and contact information: your name, address, and phone number.
Your relationship to the person we support or to a member of our staff.
Lasting Power of Attorney documentation where applicable.

Why do we have this data?

We process your data because we have a legitimate interest in holding next of kin, emergency contact, and Lasting Power of Attorney information for the individuals we support and our staff members.

Where do we process your data?

We may share this data with:

Other parts of the health and care system: local hospitals, GPs, pharmacies, social workers, and other health and care professionals.
The Local Authority.
The police or other law enforcement agencies where required by law or court order.

We collect and share data face to face, via phone, via email, and via post.

How Do We Store Your Personal Information?

Your information is securely stored for the time periods specified in the NHS Records Management Code of Practice 2021, which applies to adult social care organisations. This is our primary reference for retention periods across all categories of personal data we hold.

Digital data is stored within secure, UK-based cloud platforms, each subject to a data sharing or processing agreement. Physical records are held securely on-site and access is restricted to authorised staff only.

When data is no longer required, we dispose of it securely. Paper records are shredded by a certified destruction service. Digital records are permanently deleted or wiped in line with recognised standards. We do not retain personal data beyond the periods required by law or the Records Management Code of Practice.

Our Website

In order to provide you with the best experience while using our website (www.ibchealthcare.co.uk), we process some data about you. This may include data collected through contact forms, enquiry submissions, or analytics tools used to monitor website performance.

For full details of how we use data on our website, including our use of cookies, please review our full website privacy policy at: https://ibchealthcare.co.uk/privacy-policy/

Artificial Intelligence and Automated Tools

iBC Healthcare uses artificial intelligence tools to support operational and administrative functions. These tools are used in accordance with our AI Acceptable Use Policy and do not make automated decisions about individuals without human oversight. Personal data is not used to train external AI models. Where AI tools process personal data, appropriate data processing agreements are in place.

Your Rights

The data we keep about you is your data. We are committed to keeping it confidential and using it appropriately. You have the following rights:

Right of access: You have the right to request a copy of all data we hold about you. We will generally not charge for this.
Right to rectification: You have the right to ask us to correct any data you believe to be inaccurate or incomplete. You can also request that we restrict processing while we consider your request.
Right to erasure: You have the right to ask us to erase personal data which is no longer necessary for the purpose for which it was collected, subject to our legal retention obligations.
Right to restriction: You may request that we restrict processing if we no longer require your data for the original purpose but you do not wish for it to be erased.
Right to withdraw consent: Where we process your data on the basis of consent, you may withdraw that consent at any time by contacting us.
Right to object: If we process your data on the basis of legitimate interests or public task, you have the right to object to that processing. We will restrict all processing while we consider your objection.
Right to data portability: Where processing is carried out by automated means and based on your consent or a contract, you have the right to receive your data in a structured, commonly used and machine-readable format.

To exercise any of these rights, please contact our Data Protection Officer using the details provided in the Introduction. You may be asked to provide identification to verify your identity before we action your request. We will respond within one calendar month.

If you are dissatisfied with how we have handled your request or any aspect of our data processing, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

Information Commissioner’s Office

Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Website: https://ico.org.uk/global/contact-us/

Helpline: 0303 123 1113