Your privacy

Statement of Commitment

Focus Independent Adult Work CIC is committed to protecting and respecting your privacy. As a social work organisation providing statutory services, we adhere to the highest standards of data protection and confidentiality. This includes compliance with the General Data Protection Regulation (GDPR), the Data Protection Act 2018, and the Caldicott Principles, which guide the handling of personal information in health and social care.

This is Focus Independent Adult Social Work’s Privacy Notice.

As part of the services we offer, we are required to process personal data about our staff, our service users and, in some instances, the friends or relatives of our service users and staff. “Processing” can mean collecting, recording, organising, storing, sharing or destroying data.

We are both the Data Controller and the Data Processor of your data. This means we are responsible for deciding how and why we use your data, and for keeping it safe and secure.

We are committed to being transparent about why we need your personal data and what we do with it. This information is set out in this privacy notice. It also explains your rights when it comes to your data.

We will take all reasonable steps to prevent any unauthorised access, disclosure, loss, or damage of your data. If there is a breach or incident that may affect your rights or interests, we will notify you and the ICO as soon as possible.

What data do we have?

Focus is a social work Community Interest Company (CIC) providing statutory social care services. So that we can provide those services, we need to keep certain records about you.

We may process the following types of data:

• Your basic details and contact information e.g. your name, address, date of birth and next of kin;
• Details of any contact we have had with you such as appointments and home visits
• Your financial details e.g. details of how you pay for your care (where applicable) or your funding arrangements.

We also record the following data which is classified as “special category”:

• Health and social care data about you, which might include both your physical and mental health data.
• We may also record data about your race, ethnic origin, sexual orientation or religion.

Please note this is not an exhaustive list and we may need to record other types of data where necessary

Why do we have this data?

We collect your data to provide high-quality care and support. Additionally, we have a legal obligation to do so.

We process your data to

• Assess your needs and plan your care
• Deliver and coordinate your care with other professionals
• Monitor and improve the quality of our services
• Comply with legal and regulatory obligations
• Carry out financial assessments (where required)

We process your special category data because

• It is necessary for us to provide and manage social care services
• It is necessary due to social security and social protection law (generally this would be in safeguarding instances);
• We are required to provide data to our regulator, the Care Quality Commission (CQC), as part of our public interest obligations.

We may also process your data with your consent. If we need to ask for your permission, we will offer you a clear choice and ask that you confirm to us that you consent. We will also explain clearly to you what we need the data for and how you can withdraw your consent at any time.

Lawful Basis for Processing

As a social work organisation that processes social care data, including special category data, our primary lawful bases for processing data are as follows:

Article 6(1)(a): The data subject has given consent to the processing of his or her personal data for one or more specific purposes.

Article 6(1)(c): Processing is necessary for compliance with a legal obligation to which the controller is subject.

Article 6(1)(e): Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority.

Article 9(2)(h): Processing is necessary for the purposes of preventive or occupational medicine, the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services.

We also recognise your rights established under UK case law, collectively known as the “Common Law Duty of Confidentiality.”

Where do we process your data?

So that we can provide you with high quality care and support we need specific data. This is collected from or shared with:

1. You or your legal representative(s);
2. Third parties.

We do this face to face, via phone, via email, via our website, via post, via application forms and more.

Third parties are organisations we might lawfully share your data with. These include:

• Other parts of the health and care system such as local hospitals, social work professionals (including from other local authorities), care providers, integrated care boards, and other health and care professionals;
• North East Lincolnshire (and other local authorities across the country where appropriate);
• Your family or friends – with your permission;
• Organisations we have a legal obligation to share information with i.e. for safeguarding, the CQC;
• The police or other law enforcement agencies if we have to by law or court order.
• Other carefully selected third parties. (See National Data Opt-Out below)

The information collected about you when you use health and care services can also be used and provided to other organisations for purposes beyond your individual care, for instance to help with:

• Improving the quality and standards of care provided
• Research purposes
• Preventing illness and diseases
• Monitoring safety
• Planning services

This may only take place when there is a clear legal basis to use this information. All these uses help to provide a better service for you, the wider public and future generations. Confidential information about your care is only used like this when allowed by law and where it meets our strict standards.

Most of the time, the data used for research and planning is anonymised, so that you cannot be identified and your confidential patient information is not accessed.

You have a choice about whether you want your confidential patient information to be used in this way. If you are happy with this use of information you do not need to do anything. If you do choose to opt out, your confidential patient information will still be used to support your individual care.

To find out more or to register your choice to opt out, please visit www.nhs.uk/your-nhs-data-matters or call 0300 303 5678 (Monday to Friday, 9am to 5pm).

What data do we have?

As part of our work providing high-quality care and support, it might be necessary that we hold the following information on you:

• Your basic details and contact information e.g. your name and address;
• Records of any contact you may have had with us, including phone calls, home visits or any meetings attended.

Why do we have this data?

By law, we need to have a lawful basis for processing your personal data.

We process your data because we have a legitimate business interest in holding next of kin and lasting power of attorney information about the individuals who use our service and keeping emergency contact details for our staff.

We keep records of contact with family and friends to ensure continuity of care, safeguarding, effective communication, and legal compliance. These records help us provide consistent and comprehensive support, identify and respond to potential risks, keep loved ones informed, and meet our legal obligations.

We may also process your data with your consent. If we need to ask for your permission, we will offer you a clear choice and ask that you confirm to us that you consent. We will also explain clearly to you what we need the data for and how you can withdraw your consent.

Where do we process your data?

So that we can provide high quality care and support we need specific data. This is collected from or shared with:

1. You or your legal representative(s);
2. Third parties

Third parties are organisations we have a legal reason to share your data with. These may include:

• Other parts of the health and care system such as local hospitals, social workers, and other health and care professionals;
• The Local Authority;
• The police or other law enforcement agencies if we have to by law or court order.

What data do we have?

So that we can provide a safe and professional service, we need to keep certain records about you. We may record the following types of data:

• Your basic details and contact information e.g. your name, address, date of birth, National Insurance number and next of kin;
• Your financial details e.g. details so that we can pay you, insurance, pension and tax details;
• Your training records.

We also record the following data which is classified as “special category”:

• Health and social care data about you, which might include both your physical and mental health data – we will only collect this if it is necessary for us to know as your employer, e.g. fit notes or in order for you to claim statutory maternity/paternity pay;
• We may also, with your permission, record data about your race, ethnic origin, sexual orientation or religion.

As part of your application you may – depending on your job role – be required to undergo a Disclosure and Barring Service (DBS) check (Criminal Record Check). DBS check information is stored securely and only retained for the duration necessary to meet legal and operational requirements

Why do we have this data?

We require this data so that we can contact you, pay you and make sure you receive the training and support you need to perform your job. By law, we need to have a lawful basis for processing your personal data.

We process your data because:

• We have a legal obligation under UK employment law;
• We are required to do so in our performance of a public task;
• We have a legitimate interest in processing your data
• We are required to provide data to our regulator, the Care Quality Commission (CQC), as part of our public interest obligations.

We process your special category data because

• It is necessary for us to process requests for sick pay or maternity pay.

If we request your criminal records data it is because we have a legal obligation to do this due to the type of work you do. This is set out in the Data Protection Act 2018 and the Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975.

We may also process your data with your consent. If we need to ask for your permission, we will offer you a clear choice and ask that you confirm to us that you consent. We will also explain clearly to you what we need the data for and how you can withdraw your consent.

Where do we process your data?

As your employer we need specific data. This is collected from or shared with:

1. You or your legal representative(s);
2. Third parties.

Third parties are organisations we have a legal reason to share your data with. These include:

• Her Majesty’s Revenue and Customs (HMRC);
• Our pension providers;
• Our payroll provider;
• Our staff benefits provider;
• Organisations we have a legal obligation to share information with i.e. for safeguarding, the CQC;
• The police or other law enforcement agencies if we have to by law or court order.
• The DBS Service (via Care Plus Group – https://careplusgroup.org/)

We are committed to ensuring the security and confidentiality of the personal data we handle. Our data storage practices adhere to the NHS Code of Practice guidelines, ensuring that all information is managed in accordance with the highest standards of data protection and privacy.

To further enhance our data security, we partner with a local third-party IT provider that holds Cyber Essentials Plus certification and ISO 27001 accreditation, an internationally recognised information security framework. This partnership ensures that our data storage systems are robust, secure, and compliant with industry best practices.

Much of the data we collect and process will be securely recorded and retained on the NHS Spine. The NHS Spine is a critical component of the IT infrastructure for health and social care in England, Wales, and the Isle of Man. The Spine enables health and social care professionals to securely access and exchange vital patient information in real-time, facilitating better care coordination and decision-making.

All personal data is stored securely, with access restricted to authorised personnel only. We employ a range of technical and organisational measures to protect data from unauthorised access, loss, or misuse. These measures include encryption, regular security audits, annual completion of the NHS Data Security and Protection Toolkit (DSPT) and continuous monitoring of our systems for potential threats.

By following these stringent guidelines and leveraging the expertise of our accredited IT partners, we ensure that the personal data we hold is protected to the highest possible standards.

Our website address is: https://www.focusadultsocialwork.co.uk. In order to provide you with the best experience while using our website, we may process some data about you. We collect minimal personal information necessary to provide you with a seamless browsing experience. This may include your name, email address, and any other details you voluntarily provide through our contact forms. We use this information to respond to your enquiries, improve our services and comply with legal and regulatory requirements. We do not share your personal information with third parties without your explicit consent, except as required by law. We store your data securely and only for as long as necessary to fulfil the purposes outlined above. By using our website, you agree to the collection and use of your information in accordance with this privacy notice.

Cookies

Our website uses the following cookies:

Google’s privacy policy can be found here: https://policies.google.com/privacy

The data that we keep about you is your data and we ensure that we keep it confidential and that it is used appropriately. You have the following rights when it comes to your data:

1. Right to be Informed: You have the right to know how your data is being collected, used and stored.
2. Right of Access: You can request access to your personal data. (See below)
3. Right to Rectification: You can have incorrect data corrected.
4. Right to Erasure: You can request the deletion of your data. We retain data in line with the NHS Records Management Code of Practice.
5. Right to Restrict Processing: You can ask us to limit how your data is used. This may affect your services. We may not be able to comply if the data is essential for ongoing services or legal obligations.
6. Right to Data Portability: You can obtain and reuse your data across different services.
7. Right to Object: You can object to the processing of your data in certain circumstances. Please note, we may not be able to comply if processing is essential for service provision or required by law.
8. Rights in relation to Automated Decision Making and Profiling: You have protections against decisions made solely based on automated processes.

When making any requests in relation to your data, you may need to provide adequate information for our staff to be able to identify you, for example, a passport or driver’s licence. This is to make sure that data is not shared with the wrong person inappropriately. We will always respond to your request as soon as possible and at the latest within one month.

How you can raise a concern

If you have any concerns or questions, please contact our Information Governance Team on 0300 330 2940, via email at focus.data@nhs.net or write to us at:

Focus Independent Adult Social Work C.I.C
Heritage House
Fisherman’s Wharf
Grimsby,
DN31 1SY

If you are not satisfied with how we have handled your personal data request, you can contact our Data Protection Officer (DPO) to request an internal review on 01472 256 256 or via email at focus.dpo@nhs.net.

Alternatively, or if you are dissatisfied with the outcome of the internal review, you have the right to appeal directly to the Information Commissioner’s Office:

Information Commissioners office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Online: https://ico.org.uk/concerns/

Phone: 0303 123 1113

Changes to our Privacy Notice

We will notify you of any changes to this privacy notice by updating the notice on our website. Where necessary, we will also contact you directly to inform you of these changes.

In the UK by law you have a right to access your information under what is called a Subject Access Request. Complete the simple online form below, ensuring you attach any relevant documents such as your ID. We may phone you to request further information where necessary. Your request will usually be processed within one calendar month, however, this can take up to three months in some cases.

• Online Data Request Form

If the individual is deceased, your information request would fall under the Access to Health Records Act 1990 and more information can be found on the NHS website here.

As part of Focus’ transparency, please see the latest policies below for our Information Governance Management Framework (IGMF) Strategy:

• Data Protection Policy
• Information Governance Policy
• Information Security Policy
• Confidentiality Policy
• Records Management and Data Quality Policy
• Social Media Policy