Privacy Policy
The Four Seasons Health Care Group (the Group) operates care homes throughout the UK and Jersey under the Four Seasons Health Care and Brighterkind brands. To provide our care and services, we need to process (gather, use and store) personal data about the people we care for and their loved ones, people who work for and with us, and people who enquire about our care homes. This privacy notice aims to provide information about the ways in which we use this data and is applicable to the collection, use, and disclosure of personal data in relation to marketing activities (including enquiries). It begins with some general information that applies to all of our data processing and there are then sections specific to the type of data being processed.
General Information
The Group is made up of a number of companies, which work together to provide various aspects of our care and services. Each company is a data controller in its own right and is registered separately with the Information Commissioner’s Office (ICO – for our companies in the UK), the Jersey Office of the Information Commissioner (JOIC – for our companies on Jersey) and the Isle of Man Information Commissioner (IOMIC – for our companies on the Isle of Man). The document attached below shows each of our companies and its ICO/JOIC/IOMIC registration number.
The Group has appointed a Data Protection Officer (DPO), who has responsibility for advising on and monitoring data protection compliance. You can contact the DPO at:
Group Data Protection Officer
Four Seasons Health Care Group
Lingfield House
Lingfield Point
McMullen Road
Darlington
DL1 1RW
Under data protection law, you have rights in relation to the way in which your personal data is processed. These include:
- the right of access
- the right to rectification
- right to complete data
- the right to erasure
- the right to restrict processing
- the right to object to processing
- the right to data portability
You can find out more about your rights and the circumstances in which they may apply at:
UK – https://ico.org.uk/your-data-matters/
Jersey – https://jerseyoic.org/resource-room/information-rights/?audience=everything
IOM – https://www.inforights.im/individuals/data-protection/your-data-protection-rights/
If you wish to make a request to exercise your rights, you can speak to the Home Manager of the relevant care home, or contact the DPO at . You can expect to receive an initial acknowledgement of your request, and then a substantive response within a month. If you are making a request on behalf of a loved one residing in one of our homes, please be prepared to provide proof of your identity and a copy of your authority to make the request.
If you are unhappy with the way in which we have used your personal data, you have the right to make a complaint. We would ask that you give us the opportunity to look into and respond to your concerns before you refer the matter to the regulator (and the regulator will often expect you to do this before they will agree to look into the matter). If you wish to raise concerns, you can speak to the Home Manager of the relevant care home, or contact the DPO at . We operate a complaints process with two stages.
The external regulator for data protection issues is the ICO in the UK, the JOIC on Jersey and the IOMIC on the Isle of Man. Contact details are as follows:
ICO
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Tel: +44 (0) 303 123 1113
Website: https://ico.org.uk/make-a-complaint/your-personal-information-concerns/
JOIC
2nd Floor, 5 Castle Street
St. Helier
Jersey
JE2 3BT
Tel: +44 (0) 1534 716530
Website: https://jerseyoic.org/make-a-complaint
IOMIC
PO Box 69
Douglas
Isle of Man
Tel: +44 1642 693260
Website: https://www.inforights.im/complaint-handling/how-to-make-a-complaint-to-the-information-commissioner/
When computers make decisions instead of people, it is known as automated processing. Whilst we use computers to help us manage aspects of our services, we do not undertake automated processing; decisions will always be made by real people.
To help us provide the best care possible we use a number of suppliers to act on our behalf and help us with certain aspects of our business and, to do so, we and they may need to process a limited amount of your personal data. Where this is the case, we take great care to select suppliers who can demonstrate to us that they have very good data protection and security practices, and we put in place arrangements between us that very clearly set out what they can and cannot do with the personal data. We do not allow personal data to be processed outside of the European Economic Area (EEA) unless the supplier is able to demonstrate to us that appropriate safeguards are in place to protect data.
As a Group, we are keen to participate in research studies when we believe there is a potential benefit to you personally or to our resident population, or where there is a wider public interest. Most of the time, we will only use anonymised data that does not identify you, however, there may be some cases where identifiable data needs to be shared.
You can choose whether to allow your information to be used for these purposes. If you have objections to being contacted about research, you can opt out under the National Data Opt Out. For more information about this, please visit www.nhs.uk/your-nhs-data-matters. If you have no objections, you do not need to do anything and either we, or the researchers, will contact you if there is a study that we think you might be suitable to participate in.
When we process personal data for research purposes, our lawful basis for processing under the UK GDPR is article 6(1)(a) ‘The data subject has given consent to the processing’ and article 9(2)(a) ‘The data subject has given explicit consent to the processing’.
To support continuity of care, it may be necessary from time to time for us to share necessary information about the people who live and work in our service(s) with a prospective operator of the service(s). If a sale/transfer does not proceed, at our request the parties will be required to destroy or to hand back to us any and all information that they may have received. This sharing of personal data will be subject to robust non-disclosure agreements to ensure that it is protected during any transitional period. Our lawful basis under the UK GDPR for processing in these circumstances is ‘processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party’ and article 9(2)(b) ‘processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law‘ or article 9(2)(h) ‘processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services’.
Information for People Living in Our Care Homes
Depending on your circumstances and the nature of the care and services you receive, we may collect the following categories of information about you:
- your general details (name, address, date of birth, contact details)
- details of your GP and any other professionals who are supporting you
- your medical history (physical and mental) and any medications you are taking
- information about your legal representatives (e.g. attorney/deputy), family and friends
- your ethnicity and religious beliefs
- your lifestyle, social circumstances, likes and dislikes
- photographs of you (clinical and non-clinical)
- CCTV images (if the home has CCTV in communal areas)
Much of the personal data we process comes directly from you, or from your loved ones. In certain circumstances, we may also receive personal data from:
- Other health and social care organisations, e.g. your social worker/care manager, GP, or a NHS trust that is funding your care or treating you
- People who provide services on our behalf, e.g. chemists, chiropodists
Direct care – we process your information in order to provide you with the care and services that we agreed to provide when you chose to come and live with us.
Indirect care – we also process your information to manage the care and services we provide more generally. This includes:
- Processing fees and personal allowances
- Auditing our services (e.g. clinical quality audits)
- Demonstrating to regulators and commissioners the quality of the care we provide
- Looking into and responding to feedback, complaints and incidents
- Developing existing services and planning new ones
- Preparing statistics for local authorities, the Department of Health and Social Care and other regulatory bodies
- Complying with our legal obligations, e.g. for safeguarding
Other purposes – we also process a limited amount of personal data for other purposes, for example, promoting our homes. Where this is the case, we will ask you whether you would like to be involved. We will never sell your information to third parties for marketing purposes.
Data protection law says that we must have a lawful basis for processing your personal data. Our lawful bases can be summarised as:
- Consent – where we ask you if you would like us to do something and you agree, for example, taking your photograph at an event
- Contract – where we need to process the data to fulfil our contractual obligations to you, for example, providing you with person-centred care and services, and administering payments
- Legal obligation – where we need to process your data to fulfil an obligation set out in law, for example, allowing a regulator to inspect our services
- Vital interests – where we need to process your personal data to protect you or someone else from serious harm and we aren’t able to get your consent, for example, if we need to share information with emergency services
We also rely on the following additional lawful basis for processing your special category data (e.g. data about your health):
- Vital interests – where we need to process your personal data to protect you or someone else from serious harm and we aren’t able to get your consent, for example, if we need to share information with emergency services
- Provision of health or social care – where we need to process your personal data to provide you with care and support, or to manage our services
- Public health – where we need to process your personal data for public health reasons, for example, to track or prevent the spread of a pandemic
In providing care and services, we may need to share your personal data in the following ways:
- with internal support teams, for example, the Finance Team or Audit Team to support internal processes, e.g. billing or auditing;
- with other health and care services to support the care you receive, e.g. your GP, the District Nursing Team;
- with the organisations that fund your care (if relevant), e.g. the local authority or health trust/board;
- with regulatory bodies, e.g. the relevant care regulator;
- with bodies responsible for safeguarding, e.g. the local authority, police, Nursing and Midwifery Council.
We will always ensure that your personal data is only shared on a ‘need to know’ basis, i.e. that we only share what is necessary when there is a legitimate and lawful requirement to do so.
We will usually keep your information for six years after you leave the care home, after which it will be disposed of using our confidential waste supplier.
Information For People Working For The Group
Depending on your role, we may collect the following categories of information about you:
- your general details (name, address, date of birth, contact details)
- any information you provided to us when you applied for your role, including your qualifications and employment history
- information about your right to work/suitability to work
- your bank details
- information about your next of kin
- details about your physical and mental health
- time and attendance records, and details of any leave or absences
- supervision and performance information
- equality monitoring information, such as your ethnicity and religious beliefs
- photographs of you
- CCTV images (if the site has CCTV in communal areas)
A lot of the personal data we process comes directly from you. In certain circumstances, we may also receive personal data from:
- Occupational health services and other medical professionals – this will always be with your knowledge and consent
- Professional and regulatory bodies, e.g. the Nursing and Midwifery Council
- Government bodies, for example, the Department for Work and Pensions (DWP)
Depending on the nature of your role and your personal circumstances, we may process your personal data in order to:
- assess your suitability and right to work for us
- to ensure that you are fulfilling the requirements of your role
- to ensure you are receiving any support you may need to be successful in your role
- to ensure that you are paid appropriately and that you receive any employment benefits that you may be entitled to
- to meet our legal and contractual obligations, e.g. for taxation, COVID-19 vaccination status, making referrals to the Nursing and Midwifery Council
- to demonstrate the care and support we prove to our residents
- to promote our homes – you have the right to ask not be involved in promotional activity if you would prefer
- communicate with you while you are working for the Group on company information and news – you have the right to opt out of these communications if you would prefer
Data protection law says that we must have a lawful basis for processing your personal data. Our lawful bases can be summarised as:
- Consent – where we ask you if you would like us to do something and you agree, for example, taking your photograph at an event
- Contract – where we need to process the data to fulfil our contractual obligations to you, for example, paying you
- Legal obligation – where we need to process your data to fulfil an obligation set out in law, for example, administering taxation
- Vital interests – where we need to process your personal data to protect you or someone else from serious harm and we aren’t able to get your consent, for example, if we need to share information with emergency services
We also rely on the following additional lawful basis for processing your special category data (e.g. data about your health):
- Employment, social security and social protection law – where we need to process your personal data to meet our legal obligations in relation to employment
- Provision of health or social care – where we need to process your personal data to manage our services or for occupational health purposes
- Public health – where we need to process your personal data for public health reasons, for example, to track or prevent the spread of a pandemic
We may need to share your personal data in the following ways:
- with internal support teams, for example, the Finance Team or Audit Team to support internal processes, e.g. payroll or auditing
- with our occupational health provider – this will always be with your knowledge and consent
- with other health and care services to support the care our residents receive, e.g. GPs, the District Nursing Team;
- with the organisations that fund care, e.g. the local authority or health trust/board
- with regulatory bodies, e.g. the relevant care regulator
- with bodies responsible for safeguarding and registration, e.g. the local authority, police, Nursing and Midwifery Council
- with Government bodies, e.g. the DWP
We will always ensure that your personal data is only shared on a ‘need to know’ basis, i.e. that we only share what is necessary when there is a legitimate and lawful requirement to do so.
We will keep your information for six years after termination of employment, after which it will be disposed of using our confidential waste supplier.
Information for residents loved ones, prospective residents, and other visitors
Depending on your interactions with us, including our appointed representatives, we may collect the following categories of information about you:
- Your general details (name, address, date of birth, contact details).
- Your bank details – only if you are responsible for the payment of fees/personal allowances.
- The nature of your relationship with the resident (including whether you are the resident’s legal representative, e.g., attorney or deputy).
- Details of your interactions with our business, including letters, emails and any requests you make or concerns you may raise.
- CCTV images (if the home uses surveillance to keep people and/or property safe).
- Contact details of stakeholders, commissioners, and other professionals, obtained with their consent for the purpose of keeping up to date with activities in the home. For example, providing weekly bed vacancy data.
- Details about your employment, including your employer’s name and your job position.
For marketing purposes, we collect and process the following contact information about you, with your explicit consent:
- Your name, address, telephone numbers, and email address.
We also process your marketing preferences, which you can adjust at any time.
Much of the personal data we process comes directly from you. In addition, we may also receive information from various sources, including but not limited to:
- Your employer
- Government departments
- The care regulator
- Other health and care services such as your GP or the emergency services
- Suppliers and local services
- The bodies responsible for funding care (if relevant), e.g., the local authority or local health trust/board.
Depending on the nature of your role or your interactions with us and your personal circumstances, we may process your personal data in order to:
- Keep you informed and include you in decision-making.
- Maintain accurate records of a resident’s stay with us.
- Conduct direct marketing to keep in touch via email or telephone with news, offers, and invitations to upcoming events.
- Share weekly bed vacancy data with stakeholders and commissioners as per the consent obtained, which can be withdrawn.
We will not use your personal data to advertise, promote, or market third-party goods or services to you. We do not sell any personal data received for the purpose of marketing activities to third parties for their own commercial use.
You can withdraw consent at any time. You can easily withdraw consent or opt-out from any marketing messages by unsubscribing from marketing news and updates by emailing .
Data protection law says that we must have a lawful basis for processing your personal data. Our lawful bases can be summarized as:
- Consent – where we ask you if you would like us to do something, and you agree (e.g., taking your photograph at an event or sending direct marketing communications).
- Contract – where we process your personal data to administer fees or personal allowances as part of our contract with you and/or your loved one.
- Legal obligation – where we need to process your data to fulfil an obligation set out in law, for example, for safeguarding.
- Legitimate interests – for the effective and lawful operation of our business, including maintaining complete and accurate records of your or your loved one’s stay in our home.
We may need to share your personal data in the following ways:
- With internal support teams, for example, the Finance Team or Audit Team, to support internal processes, e.g., collection of fees or auditing.
- With other health and care services to support the care our residents receive, e.g., GPs.
- With the organizations that fund care, e.g., the local authority or health trust/board.
- With regulatory bodies, e.g., the relevant care regulator.
- With bodies responsible for safeguarding, e.g., the local authority, police.
We will always ensure that your personal data is only shared on a ‘need to know’ basis, i.e., that we only share what is necessary when there is a legitimate and lawful requirement to do so.
We only use your personal information for the purposes for which we collect it. However, there are instances where it is possible that we will use your information for other purposes as long as those other purposes are consistent with those set out in this policy. This may be, for example, disclosures with entities within our Group, to facilitate corporate transactions with third parties, and to comply with the law. If we intend to do so, we will provide you with information relating to that other purpose before using it for the new purpose.
We will keep your information for six years after your loved one leaves the care home, after which it will be disposed of using our confidential waste supplier.
If you decide to opt-out of or withdraw your consent to our marketing, we will no longer use your personal data for this purpose.
Please note that websites or social media sites hosted by a third party other than the Four Seasons Health Care Group may also collect information about you. You should review those third parties’ privacy statements to understand how and when they will collect and use your data. We are not responsible for the privacy practices of any third parties.
Information for enquirers
When you submit an enquiry form, phone one of the numbers on our website or contact one of our homes directly, we will begin processing the personal data that you provide to us. We will also process any personal data that you provide to us during follow-up contact.
If you, or your loved one, decide to come and live in one of our care homes, your personal data will be processed in accordance with our Resident Privacy Notice.
If you enter the recruitment process, your personal data will be processed in accordance with our Team Member Privacy Notice.
If you, or your loved one, are thinking about coming to live in one of our care homes, we will use the information you provide to put you in contact with a care home in the right area and will send you appropriate information to help you make a choice.
If you are enquiring about working for the Group, we will use the information to direct you to appropriate information about recruitment and, in some cases, to send you information vacancies.
If you have given us permission to contact you by email, we may follow up the initial contact with further emails about living in our care homes or working for the Group. This is known as direct marketing. You can ask us to stop sending direct marketing materials at any time.
We will also use the information you supply to generate statistics. These statistics are used internally for management forecasting. Your identity will not be included when statistics are reported.
Data protection law says that we must have a lawful basis for processing your personal data. For enquiries, our lawful bases are:
Consent – where we ask you if you would like us to do something and you agree, for example, sending you a brochure about a care home. You can withdraw your consent at any time by unsubscribing directly on direct marketing emails or by contacting the Administrator at the care home involved. If you withdraw your consent, your information will be removed from our marketing lists and you will receive no further communications from us.
Contract – to take steps at your request prior to entering into a contract
Legitimate interests – where we use enquiry data to generate trends and statistics
We will share your personal information with other companies within our group, and agencies with statutory powers, such as regulators and the police if required.
Your information will also be shared with suppliers that process information on our behalf, such as our Customer Care Team. We only share information with suppliers that have satisfied us that they will manage information properly.
We use one supplier, MailChimp (The Rocket Science Group LLC), a company based in the United States which helps us manage our email communications with you. MailChimp is EU-US Privacy Shield Framework certified, which means that it has been assessed as being compliant with data protection legislation.
Your enquiry will stay live on our system until it is resolved because you have told us that you no longer wish to hear from us, you (or your relative) has moved into one of our homes or you have entered the recruitment process.
We will keep statistical information that does not identify you indefinitely.
Live Chat
Find a home
Enquire now