Next Chapter Healthcare Ltd - Privacy Notice

1. Who we are

Next Chapter Healthcare Limited provides supported living, rehabilitation and care services for adults with mental health needs, learning disabilities, autism and neurodivergent conditions. We are committed to protecting personal information and respecting the confidentiality, privacy, dignity and rights of everyone who uses or engages with our services.

For the purposes of data protection law, Next Chapter Healthcare Limited is the data controller for the personal information it decides to collect and use, unless another organisation is clearly responsible for that processing.

2. Scope of this Privacy Notice

This notice applies to personal information relating to people we support, their families and representatives, employees, volunteers, agency workers, job applicants, professionals, commissioners, contractors, visitors and people who contact us through our website or by other means.

We may provide additional privacy information in specific circumstances, for example during recruitment, employment, referral, assessment, care planning, safeguarding, complaints or incident management processes.

3. Personal information we collect

People we support

• Name, address, contact details, date of birth, NHS number and emergency contact details.
• Referral information, care and support plans, risk assessments, outcomes, reviews and daily records.
• Health, mental health, medication, disability, communication, capacity, safeguarding and wellbeing information.
• Information about goals, preferences, routines, relationships, culture, beliefs, identity and support needs.
• Financial, appointeeship or benefits information where this is relevant to care, support or contractual arrangements.

Staff, applicants and workers

• Contact details, employment history, qualifications, references and recruitment records.
• Right to work, DBS, professional registration, training, supervision, appraisal and competency records.
• Payroll, pension, absence, occupational health and workplace wellbeing information where relevant.
• Information needed to manage employment, workforce planning, safeguarding, disciplinary, grievance or capability matters.

Professionals, visitors and website users

• Contact details, role, organisation and correspondence records.
• Information submitted to us through forms, email, telephone, visits or meetings.
• Basic website usage information where cookies or analytics are used.

4. Why we use personal information

We only use personal information where there is a lawful reason to do so. The table below summarises common processing activities relevant to our services.

5. Special category information

Some information we process is classed as special category data. This includes health information, mental health information, disability-related information, racial or ethnic origin, religious or philosophical beliefs, trade union membership, sexual orientation and information about a person’s sex life where relevant to care, safeguarding or employment matters.

Where we process special category information, we do so only where UK GDPR and the Data Protection Act 2018 allow this. This may include processing for health and social care purposes, employment obligations, safeguarding, substantial public interest, legal claims or vital interests.

6. Criminal offence and safeguarding information

We may process criminal offence, allegation, DBS, safeguarding or risk-related information where this is necessary and lawful, for example to protect people from harm, meet safer recruitment requirements, manage risks, comply with regulatory duties or support statutory safeguarding processes.

7. Who we may share information with

We only share personal information where there is a lawful basis and a clear reason to do so. Information may be shared with relevant organisations and professionals where needed for care, support, safeguarding, contractual, employment, legal, regulatory or public protection purposes.

• NHS organisations, including Greater Manchester Integrated Care Board where relevant to commissioned services.
• Local Authorities, social workers, care managers and commissioning teams.
• GPs, community mental health teams, nurses, hospitals, therapists and other health or social care professionals.
• CQC, safeguarding teams, emergency services and other statutory or regulatory bodies.
• Families, representatives, advocates or appointees where appropriate and lawful.
• Payroll, pension, training, occupational health, IT, legal, insurance, audit and professional advisory providers.
• Courts, law enforcement agencies or public authorities where required by law or necessary to protect people.

8. How we protect personal information

We take appropriate steps to protect personal information from unauthorised access, loss, misuse, alteration or disclosure. These measures include secure electronic systems, controlled access to records, password protection, confidentiality training, data protection guidance, secure disposal processes and policies for information governance and cyber security.

Staff are expected to maintain confidentiality and only access personal information where they need it to carry out their role.

9. How long we keep information

We keep personal information only for as long as necessary for the purpose it was collected, including to meet legal, contractual, regulatory, employment and safeguarding obligations.

Retention periods may vary depending on the type of record. Records will be reviewed and securely deleted, archived or destroyed when they are no longer required, in line with our retention schedule and applicable guidance.

10. When we use consent

In many care, employment and safeguarding situations we do not rely on consent as the main lawful basis because we may have legal, contractual, vital interest or public interest reasons to process information.

Where we do rely on consent, we will explain what consent is being requested for. You may withdraw consent at any time, but this will not affect any processing that has already taken place.

11. Your data protection rights

Depending on the circumstances, you may have the following rights under data protection law:

• The right to be informed about how your information is used.
• The right of access to your personal information.
• The right to ask for inaccurate information to be corrected.
• The right to ask for information to be erased in certain circumstances.
• The right to ask us to restrict processing in certain circumstances.
• The right to object to processing in certain circumstances.
• The right to data portability where this applies.
• The right not to be subject to solely automated decisions that have legal or similarly significant effects, where this applies.

Some rights are not absolute and may be limited where legal, regulatory, safeguarding, employment or care-related obligations apply.

12. Requests about your information

If you wish to request access to your information, ask for a correction, raise a concern or exercise a data protection right, please contact us using the details below. We may need to confirm your identity before responding to a request.

13. Complaints

If you are unhappy with how we handle personal information, please contact us first so that we can review and respond to your concern.

You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection matters. The ICO can be contacted through its website at ico.org.uk or by telephone on 0303 123 1113.

14. Changes to this Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in our services, legal requirements, contractual arrangements, systems or information governance practices. The latest version should be made available on our website or by request.

15. Contact details