Privacy Policy

At Walton Heath Care, we are committed to processing personal data in accordance with the General Data Protection Regulation (GDPR). GDPR mandates that we handle personal data transparently and with a clear lawful basis. As part of our commitment to transparency, we provide information on why we collect and process data on our website, ensuring individuals understand how their information will be used.

When necessary, we seek informed consent, particularly in cases where we collect and process sensitive data. This transparency not only builds trust with our website visitors but also empowers them to exercise their data rights, such as the right to access, correct, or delete their information. We align our data processing practices with GDPR’s principles to ensure the lawful and ethical handling of personal data on the Walton Heath Care website.

1. Introduction

As part of the services we offer, we are required to process personal data about our staff, our service users and, in some instances, the friends or relatives of our service users and staff. “Processing” can mean collecting, recording, organising, storing, sharing, or destroying data.

We are committed to providing transparent information on why we need your personal data and what we do with it. This information is set out in this privacy notice. It will also explain your rights when it comes to your data.

2. Service Users

What data do we have?

To provide a safe and professional service, we need to keep certain records about you. We may record the following types of data:

• Basic details and contact information: e.g., your name, address, date of birth, and next of kin.

• Financial details: e.g., how you pay us for your care or your funding arrangements.

• Images: photographs taken on admission, of medical conditions, or during activities.

• We also record the following data classified as “special category”:

• Health and social care data: physical and mental health details.

• Demographic details: race, ethnic origin, sexual orientation, or religion.

Why do we have this data?

We require this data to provide high-quality care and support. By law, we must have a lawful basis for processing your personal data.

We process your data because:

• We are required to do so in our performance of a public task.

• We are required to do so in order to fulfil a contract that we have with you.

• We have a legal obligation to do so—generally under the Health and Social Care Act 2012 or Mental Capacity Act 2005.

• Activity images are used to communicate with relatives and for marketing and/or social media purposes.

We process your special category data because:

• It is necessary due to social security and social protection law (e.g., safeguarding instances).

• It is necessary for us to provide and manage social care services.

• We are required to provide data to our regulator, the Care Quality Commission (CQC), as part of our public interest obligations.

• We may also process your data with your consent. If we need to ask for your permission, we will offer you a clear choice and ask that you confirm your consent. We will also explain clearly why we need the data and how you can withdraw your consent at any time.

Where and with whom do we process your data?

To provide high-quality care and support, data is collected from or shared with:

• You or your legal representative(s).

• Third parties.

• We collect and share this information face-to-face, via telephone, email, our website, post, application forms, and mobile apps.

• Third parties with whom we have a legal reason to share your data include:

• Other parts of the health and care system (e.g., local hospitals, GPs, pharmacies, social workers, clinical commissioning groups, and other care professionals).

• The Local Authority.

• Regulatory bodies where legally required (e.g., safeguarding authorities, CQC).

• The police or other law enforcement agencies under legal obligation or court order.

3. Staff

What data do we have?

To maintain safe and compliant employment practices, we keep the following records:

• Basic details and contact information: e.g., your name, address, date of birth, National Insurance number, and next of kin.

• Financial details: e.g., bank details for payroll, insurance, pension, and tax information.

• Employment records: your training records and qualifications.

• Images: photographs taken during resident activities.

We also record the following “special category” and sensitive data:

• Health and social care data: physical and mental health information necessary for employment administration (e.g., fit notes or statutory maternity pay claims).

• Demographic details: race, ethnic origin, sexual orientation, or religion.

• Criminal record data.

Why do we have this data?

We require this data to contact you, pay you, and ensure you receive the appropriate training and support.

We process your data because:

• We have a legal obligation under UK employment laws.

• We are required to do so in our performance of a public task.

• We have a legitimate interest in processing your data (e.g., submitting training data to Skills for Care’s National Minimum Data Set for workforce planning).

• Activity images are used to communicate with relatives and for marketing and/or social media purposes.

We process your special category data because:

• It is necessary under social security and social protection law (e.g., mandatory Disclosure and Barring Service [DBS] checks).

• It is necessary to process requests for statutory sick pay or maternity pay.

• We are required to provide data to our regulator, the Care Quality Commission (CQC), as part of our public interest obligations.

• If we process your data based on consent, you will be given a clear choice, a clear explanation of its purpose, and instructions on how to withdraw that consent.

Where and with whom do we process your data?

As your employer, data is collected from or shared with:

• You or your legal representative(s).

• Third parties.

• We handle this data face-to-face, via telephone, email, our website, post, application forms, and mobile apps.

Third parties include:

• HM Revenue and Customs (HMRC).

• Our workplace pension scheme (NEST).

• Our external payroll provider.

• Regulatory and safeguarding organisations (e.g., CQC).

• Law enforcement agencies when required by law or court order.

4. Friends and Relatives

What data do we have?

To coordinate care and emergency support, we may hold:

• Basic details and contact information: e.g., your name, address, telephone number, and email address.

• Images: photographs taken during resident activities.

Why do we have this data?

• Legitimate Interests: We hold next-of-kin and Lasting Power of Attorney details for service users, emergency contact details for staff, and contact information when you join an enquiry or waiting list.

• Activity Images: Used for communicating with family and for marketing/social media where appropriate.

• Consent: Where consent is required, you are provided an explicit opt-in and the right to withdraw at any time.

Where and with whom do we process your data?

Data is collected directly from you or your representative and shared with relevant third parties via phone, email, web forms, post, apps, or in person.

Relevant third parties may include:

• Health and care providers (e.g., hospitals, GPs, social workers).

• The Local Authority.

• Law enforcement agencies where legally mandated.

5. Your Data Rights

You have defined legal rights regarding the personal information we hold about you:

Right of Access: You may request a copy of the personal data we hold about you.

Right to Rectification: You can ask us to correct inaccurate or incomplete data, and request temporary restriction while the change is reviewed.

Right to Erasure: You may request deletion of data that is no longer required for its original purpose (subject to the Records Management Code of Practice for Health and Social Care).

Right to Restrict Processing: You may ask us to pause data processing if you contest its accuracy or do not wish for it to be erased.

Right to Withdraw Consent: Where processing is based on consent, you can revoke it at any time by contacting us.

Right to Object: Where processing relies on legitimate interests or a public task, you may formally object.

Identity Verification & Timelines:

To protect your confidentiality, we may request proof of identity (such as a passport or driving licence) before fulfilling a request. We respond to all requests within one calendar month.

Supervisory Authority

If you are dissatisfied with our response, you have the right to lodge a complaint with the UK supervisory authority:

Information Commissioner’s Office (ICO)

Wycliffe House, Water Lane

Wilmslow, Cheshire, SK9 5AF

Website: ico.org.uk

6. Website Terms & Online Data

This website (the “Walton Heath Care website”) is operated by Walton Heath Care. We handle online information responsibly and in compliance with UK data protection legislation.

Information Collected Online

User-Submitted Data: We collect information submitted through online enquiry forms and direct email communications solely to answer questions and fulfill service requests.

Log Files: We automatically collect technical usage data (IP address, visit date/time, HTTP status, bytes transferred). This data is anonymised and used exclusively to monitor website performance and improve user experience.

Information Sharing

When providing details on the Walton Heath Care site, your information is handled by Walton Heath Care alone unless explicitly stated. Disclosures are strictly limited to group companies, trusted business partners, regulatory or law enforcement bodies, and vetted data processors acting on our behalf.

External Links

Our site may link to external websites. Walton Heath Care does not control and is not responsible for the privacy practices or content of third-party websites.

International Data Transfers

Operating online may involve the transmission of data across digital networks internationally. By browsing our website and communicating with us electronically, you acknowledge this processing. Internet service providers are required by law to retain web connection logs for 12 months.

7. Cookies

Cookies are small text files placed on your device to ensure our website operates effectively.

How We Use Cookies

Identifying returning users, registrants, and subscribers.

Improving navigation across our sites and digital tools.

Monitoring aggregate traffic trends to enhance digital services.

Developing anonymous user profiles to deliver relevant information and content.

Managing Cookies

You can remove or disable cookies at any time via your browser settings. Most features of our site will remain accessible with cookies disabled, though certain preferences or login sessions may need to be reset on each visit. Continued use of our website without altering your settings confirms your acceptance of our cookie usage.