2What Data We Collect

We collect and process personal data about our clients, staff and associated individuals as described below.

Client data

• ✦Full name, date of birth, address and contact details
• ✦NHS number and GP / healthcare professional details
• ✦Care and support needs assessments, care plans and risk assessments
• ✦Health and medical information (including diagnoses, medications, allergies and mental capacity assessments) — special category data under Article 9 UK GDPR
• ✦Daily care records, visit logs and outcomes
• ✦Financial information relevant to funding of care (e.g. local authority or NHS continuing healthcare status)
• ✦Next of kin / emergency contact names, relationships and contact details
• ✦Lasting power of attorney or deputyship details where applicable

Staff data

• ✦Full name, address, date of birth, national insurance number
• ✦Right-to-work documentation and DBS disclosure information
• ✦Employment history, references and training records
• ✦Bank details and payroll information
• ✦Absence, disciplinary and performance records
• ✦Health information relevant to occupational fitness (special category data)
• ✦Location and mileage data collected via electronic call monitoring (ECM) or care management software during working hours
• ✦CCTV footage where operated at our premises

Website visitors

• ✦Enquiry form submissions (name, email, telephone, message)
• ✦Technical data such as IP address, browser type and pages visited (collected via session cookies — see Section 8)

7Your Rights Under UK GDPR

Subject to certain conditions and exemptions, you have the following rights regarding your personal data:

To exercise any of these rights, please contact us using the details in Section 10. We may need to verify your identity before processing your request. There is generally no fee; however, we may charge a reasonable fee or refuse manifestly unfounded or excessive requests.

9Data Breach Notification

Tender Loving Care Ltd maintains a written Data Breach Response Procedure. In the event of a personal data breach we will:

1. 1Contain the breach and assess the risk to individuals as quickly as possible.
2. 2Document all breaches in our internal breach register, regardless of whether notification is required.
3. 3Notify the ICO within 72 hours of becoming aware of the breach where it is likely to result in a risk to the rights and freedoms of individuals, in accordance with Article 33 UK GDPR.
4. 4Notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms, in accordance with Article 34 UK GDPR.

Our breach response procedure is reviewed annually and following any significant incident. All staff receive training on recognising and reporting suspected data breaches as part of their mandatory induction and annual refresher training.