Following the sale of the care homes and other related assets previously operated by the Four Seasons Health Care Group (“the Group”), and in connection with the winding-up of the Group’s affairs, data processing activities and responsibilities have changed. In respect of each sold care home the providers who acquired the care homes are responsible for the personal data of residents who were at the home on sale and employees who transferred on sale, whether under TUPE (Transfer of Undertakings Protection of Employment) or otherwise.
This update explains how the Group continues to process a limited amount of personal data relating to certain individuals for ongoing activities and how it continues to retain data relating to individuals who have previously interacted with the business and how both sets of data are used for residual and lawful purposes, in line with the UK General Data Protection Regulation (UK GDPR), the Privacy and Electronic Communications Regulations (PECR), and any other applicable laws.
This update also explains how all personal data, including that related to former residents, employees and other historical activity including the independently operated hospitals and specialist services trading as The Huntercombe Group, will only be retained for a limited period in connection with the winding-up of the Group’s affairs. As set out in the UK GDPR, where data is no longer required for the purposes for which it was collected, it is responsible and appropriate for that data to be securely destroyed.
For the purposes of this update reference is made to the Group but individual legal entities, duly registered with the appropriate data protection authorities in the UK, Jersey, and the Isle of Man, will be the relevant data controller and/or data processor.
Data Controller
The Group no longer acts as the data controller for residents, patients or employees who transferred to alternative providers.
The Group remains the data controller only for the following categories of personal data:
- Former residents or patients, being those discharged prior to the relevant sale.
- Former employees, being those who resigned, retired, or were made redundant prior to the relevant sale.
- Job applicants or enquirers who submitted information before the sale.
- Employees or others including third party contractors who remain employed or engaged by the Group.
- Individuals residing in the Group’s remaining independent living development.
This retained data is processed solely for lawful, limited purposes, and only as long as necessary.
The Group holds data relating to former residents or patients who were deceased prior to the sale of the home or service they were a resident or patient at. This information is outside the scope of the UK GDPR, although we continue to process this information with respect and only where necessary. Such information will also be securely destroyed as set out in this update.
If you have a question about how your data is being handled, please contact:
Four Seasons Health Care Group
Lingfield House
Lingfield Point
McMullen Road
Darlington
DL1 1RW
The details set out in the Group’s previously published privacy notices (the most recent of which, in respect of the operation of the Group’s care homes trading under the ‘Four Seasons Health Care’ and ‘brighterkind’ brands, is appended to this update) remain unchanged save as varied in this update and noting that, following the sales as referred to above, the Group no longer processes data for marketing, research, social media usage purposes or in connection with any activity which would only be relevant in the case of continued care services and there is no longer any Contact Centre.
Data Processing
Personal data retained by the Group is processed for the following limited purposes:
- Fulfilling legal, regulatory, or contractual obligations.
- Responding to enquiries, claims or data rights requests relating to past care, employment, or relevant applications. This may include managing litigation related to such enquiries, claims or requests.
- Maintaining appropriate business and care records for accountability.
Personal data may also be collected or updated where necessary for the Group’s continuing activities, such as in relation to current employees or limited services, as explained in the previous privacy notices.
Legal Basis for Processing
The Group usually processes personal data under the following lawful bases:
- Legal Obligation (UK GDPR 6(1)c)) for compliance with laws relating to health and social care, safeguarding, tax, employment, pensions, recordkeeping and regulatory reporting.
- Legitimate Interests (UK GDPR Article 6(1)(f)) to ensure closure of historic care or employment matters, maintain records for accountability, securely manage data retention, manage litigation and deal with complaints and claims, in the interest of the Group and data subjects, as applicable.
- Contractual Necessity (UK GDPR 6(1)(b)) where needed to respond to residual obligations from past care, employment or business relationships.
If your data includes special category information (e.g. health, ethnicity, union membership), additional safeguards apply. Such data is usually processed under:
- Employment and Social Protection Law (Article 9(2)(b))
- Health and Social Care Provision (Article 9(2)(h))
- Public Interest in Public Health (Article 9(2)(i))
The above is, by way of reminder, a brief summary of some of the key details relating to the processing of personal data. Reference is made to previously published privacy notices (the most recent of which, in respect of the operation of the Group’s care homes trading under the ‘Four Seasons Health Care’ and ‘brighterkind’ brands, is appended to this update) for fuller details on how personal data is processed by the Group, having regard to the changes set out in this update.
Data Transfers
As part of the sale of care homes, hospitals, specialist services and other assets, personal data was transferred to providers who acquired them for continuity of care, operations, and employment. This included:
- Resident or patient data, care plans, contact details, medical and consent records.
- Employee data, employment history, HR records and payroll records.
- Applicant and enquirer data, contact details and application information.
These transfers were carried out lawfully under:
- Contractual Necessity (Article 6(1)(b)) to maintain continuity of care or employment.
- Legal Obligation (Article 6(1)(c)) for safeguarding and employment regulations.
- Legitimate Interests (Article 6(1)(f)) to ensure safe and effective handover of services.
The new providers are now independent data controllers. Please refer to their individual privacy notices for information on how they handle your personal information.
Data Retention
The Group will retain relevant personal data for a limited period. This is because, following the winding-up of the Group, there will be no legal entity with responsibility for your data and so action is required before that date. At this time it is anticipated that winding-up activity will be substantially completed by 30 November 2025, whereupon all data held by the Group will be destroyed.
Data related to former residents, employees and other historical activity will be retained for a limited period and has been scheduled for secure destruction three months from 1 May 2025 (ie from 1 August 2025), unless it is being accessed to support a subject rights request ongoing at that time or litigation activity. Secure destruction will take place once such processes are completed.
Data relating to ongoing activities will continue to be retained until completion of winding-up activities.
To support transparency and data rights:
- Individuals may continue to submit data subject requests (e.g. access, rectification, erasure).
- As previously advised, the final date for submitting such requests was 2 June 2025 for historical data relating to former residents, patients, employees, previous enquirers or other individuals who have interacted with the Group in relation to other historical activity.
- For ongoing activities including current employees, you may exercise your rights in accordance with UK data protection law, having regard to the date the relevant Group entity is to be/was dissolved.
Data Sharing and Third-Party Processing
The Group may continue to share data with third-party agencies where required for services such as payroll administration, legal advice or regulatory reporting. All third parties are bound by strict data protection arrangements and further details will be shared where this applies.
Your Rights
If you believe we may hold your personal information, you have the right to:
- Request access to your data.
- Request correction of inaccurate or incomplete data.
- Request deletion, where legally appropriate.
- Object to or restrict certain types of processing.
- Request the transfer of your data.
- Withdraw consent to processing (where consent was originally required).
To exercise these rights, please contact us as set out below. Where you are a former resident, employee or interacted with the Group in relation to other historical activity, the final date for submitting your request was, as previously advised, 2 June 2025:
[email protected] or
Four Seasons Health Care Group
Lingfield House
Lingfield Point
McMullen Road
Darlington
DL1 1RW
The 2 June 2025 deadline for any request in respect of data related to former residents, employees and other historical activity was set to ensure that the Group had sufficient time to respond to requests, prior to the secure destruction of data as outlined above.
If you would like to understand more about your data protection rights, further information is available from the UK Information Commissioner’s Office, the Jersey Office of the Information Commissioner or the Isle of Man Information Commissioner.
Marketing and Automated Decisions
The Group does not use retained data for marketing, profiling, or automated decision making. Marketing permissions held prior to sale have not been transferred to any third party.
Further Updates
This privacy notice may be updated as needed, including to address any material changes to how your data is processed in connection with the winding-up of the Group’s affairs.
Appendix
Privacy Notice
The Four Seasons Health Care Group (the Group) operates services under the Four Seasons Health Care and brighterkind brands throughout the UK, Jersey, and the Isle of Man. In compliance with current UK regulations and laws (UK GDPR), we have updated our privacy policy to inform you about how we collect, use, and disclose personal data in relation to our services, including but not limited to marketing activities and enquiries.
Data Controller
The Four Seasons Health Care Group comprises of several entities, each acting as a data controller and duly registered with the appropriate data protection authorities in the UK, Jersey, and the Isle of Man. For detailed information on each entity and its registration number, please refer to the attached documentation.
Data Protection Officer (DPO)
We have appointed a Data Protection Officer responsible for overseeing our data protection strategy and ensuring compliance. Should you have any queries or concerns about how we handle your data, please contact our DPO at: [email protected] or
Group Data Protection Officer
Norcliffe House
Station Road
Wilmslow
Cheshire
SK9 1BU
Your Rights
Under the UK GDPR, you have various rights regarding your personal data, including access, rectification, erasure, and more. For a comprehensive understanding of your rights and how to exercise them, please visit:
UK: https://ico.org.uk/your-data-matters/
Jersey: https://jerseyoic.org/resource-room/information-rights/
Isle of Man: https://www.inforights.im/individuals/data-protection/your-data-protection-rights/
Automated Processing: Decisions about your data are made by compassionate individuals, not through automated processing. We value the personal touch in all we do.
Third Parties and International Transfers: We work with select third-party organisations to enhance our services and to help us provide the best outcomes possible. Where this is the case, we take great care to select third parties who can demonstrate to us that they have very good data protection and security practices. Where possible, most information relating to a person’s outcomes will be stored within the UK. However, your data may occasionally be processed outside the UK, under strict safeguards to ensure its protection. Information may be held in hardcopy format, or in electronic systems.
Research
As a Group, we are keen to participate in research studies when we believe there is a potential benefit to you personally or to our resident population, or where there is a wider public interest. Most of the time, we will only use anonymised data that does not identify you, however, there may be some cases where identifiable data needs to be shared.
You can choose whether to allow your information to be used for these purposes. If you have objections to being contacted about research, you can opt out under the national data opt out. For more information about this, please visit www.nhs.uk/your-nhs-data-matters. If you have no objections, you do not need to do anything and either we, or the researchers, will contact you if there is a study that we think you might be suitable to participate in.
Complaints
If you believe we have not handled your data correctly, you can contact us to address your concerns or reach out to the appropriate data protection authority. Our goal is to ensure your concerns are resolved satisfactorily. If you wish to raise concerns, you can speak to the Home Manager of the relevant care home or contact the DPO at [email protected].
Privacy Notice for Residents
Data Processing: Ensuring Your Care and Safety
To deliver the highest quality of care, we collect and process personal data about our residents. This data includes general information, financial details, health records, and more, contributing to your personalised outcomes.
Where do we get the information from?
Much of the personal data we process comes directly from you, or from your loved ones. In certain circumstances, we may also receive personal data from:
- Other health and social care organisations, e.g., your social worker/care manager, GP, or an NHS organisation that is funding your care or treating you.
- Government departments.
- National regulators.
- The emergency services.
- Our suppliers and local services.
Using Your Data to Enhance Your Care
We are committed to using your data responsibly to offer you the highest level of personalised care, also known as “resident outcomes.” Our approach to utilising your data includes:
Direct Care: Tailoring our care services to meet your specific health and wellbeing needs, ensuring that every aspect of your care plan is aligned with your unique outcomes.
Indirect Care: Utilising your feedback and data from service audits to continually enhance the quality of our services. This might involve implementing new care protocols, staff training, and improving our facilities to better serve you and other residents.
Professional Collaboration: Sharing relevant information with healthcare professionals, regulatory bodies, and other necessary organisations to support your comprehensive care. This ensures a coordinated approach to your health and wellbeing.
Personalised Communication: Keeping you and your loved ones informed about general details, lifestyle events, and other personal aspects of life within our care homes. This may include sending photographs of you (with consent), updates about activities you participate in, and information on visits from your family and friends.
Direct Marketing: With your explicit consent, we may also use your personal data to inform you about additional services, events, and offers that might be of interest to you or benefit your care experience. We ensure that all direct marketing communications adhere to the Privacy and Electronic Communications Regulations (PECR) and the UK GDPR, providing you with clear options to opt-out at any stage. We will not use your personal data to advertise, promote, or market third-party goods or services to you. We do not sell any personal data received for the purpose of marketing activities to third parties for their own commercial use.
Control Over Your Data
We recognise the significance of your privacy and provide you with complete control over your participation in our marketing efforts. You have the unequivocal right to opt out or withdraw your consent for direct marketing communications at any time, a process simplified through an easy unsubscribe option available in every communication or by contacting us directly at [email protected]. Please note that if you opt-out of receiving marketing-related messages from us, we may still send you important administrative messages as part of your ongoing use of our services.
Data Access and Privacy: Access to your personal information is strictly limited to individuals who are directly involved in your care outcomes or those responsible for managing or supporting care services within the Group including our central teams such as finance and marketing. This ensures that your data is only accessed by those with a legitimate need, maintaining the confidentiality and integrity of your information.
In accordance with applicable regulations, it is necessary for us to retain specific personal information to ensure that Inspectors and third-party organisations can verify our commitment to delivering compassionate, individualised care to you. Standard data security arrangements also apply and information will be retained as part of routine IT arrangements.
Our Legal Basis for Processing
In delivering care and managing operations within our services, the Group adheres to a comprehensive legal framework to ensure the respectful and lawful processing and sharing of residents’ personal data, including special category data. Our processing activities are grounded in the following legal bases:
- Consent (UK GDPR Article 6(1)(a) & Article 9(2)(a)): We obtain explicit consent from residents or their legal representatives for processing specific types of personal data, particularly for direct marketing purposes and when sharing sensitive details not already covered by other legal bases. Consent is freely given, specific, informed, and unambiguous, and it can be withdrawn at any time without affecting the lawfulness of processing based on consent before its withdrawal.
- Contract Performance (UK GDPR Article 6(1)(b)): Processing personal data is essential for fulfilling our contractual obligations to provide care, including activities directly related to care provision and necessary administrative tasks.
- Legal Obligation (UK GDPR Article 6(1)(c)): Certain data must be processed to comply with our legal obligations, such as adhering to regulatory requirements, health and safety laws, and financial regulations.
- Vital Interests (UK GDPR Article 6(1)(d) & Article 9(2)(c)): In emergency situations, where residents’ vital interests are at stake, we may process data without prior consent to protect the life or health of the individual concerned.
- Legitimate Interests (UK GDPR Article 6(1)(f)): We process data under legitimate interests pursued by the Group, the care home or a third party, ensuring these interests do not override the rights and freedoms of the residents. This includes processing for ensuring high standards of care, administrative efficiency, and security measures.
- Public Interest (UK GDPR Article 6(1)(e) & Article 9(2)(g)): Certain processing activities are necessary for performing tasks carried out in the public interest or in the exercise of official authority, such as public health initiatives and compliance with social protection laws.
- Health or Social Care Provision (UK GDPR Article 9(2)(h)): We specifically process special category data necessary for the provision of health or social care services, underpinned by stringent safeguards to protect residents’ data, in line with health and social care law. This ensures the confidentiality, integrity, and safety of our residents’ most sensitive information.
Compliance with PECR for Direct Marketing
In line with the Privacy and Electronic Communications Regulations (PECR), we ensure that:
- Explicit consent is obtained before sending residents or their representatives direct marketing communications via electronic means.
- Clear, straightforward options are provided to opt-out of receiving such communications at any stage.
In the Event of Transfers/Sales of Services
- Data Sharing: We may find it necessary to share personal data about individuals associated with our services — including residents, their loved ones, those living in our independent living services, and our employees — with a prospective operator as part of a sale, merger, or transfer of services within the Group or to an external party.
- Due Diligence: Such actions are carried out with the utmost care and diligence. Arrangements are made to ensure that any prospective operator adheres to appropriate standards of privacy and data protection.
- Protection Through Agreements: Robust non-disclosure agreements are implemented to protect personal data during any transitional period This measure prevents unauthorised use or retention of the data beyond the initial intent.
- Open Communication: We are committed to protecting the privacy of your personal information, irrespective of changes in service provision or ownership. We are dedicated to keeping all parties informed of developments that may impact the management of their information.
Communications with our Contact Centre
We value open and transparent communication with our residents, their loved ones, and all visitors. To facilitate this, we provide access to our external Contact Centre, which serves as a vital point of contact for enquiries, support, and service information.
- Call Recording: For the purpose of enhancing service quality, training our staff, and ensuring that we consistently deliver high standards of service, calls made to our external Contact Centre may be recorded. This practice is in line with our commitment to continuous improvement and excellence in customer service. An announcement is made on each call regarding recording.
- Implied Consent for Call Recording: By continuing with your call to our Contact Centre, it is implied that you consent to the recording of the conversation. We use these recordings solely for the purposes mentioned and handle them with the same level of confidentiality and security as all other personal data we process.
- Access and Control: You have rights regarding your personal data, including data captured in call recordings. These rights include accessing the data, requesting corrections to any inaccuracies, and, where applicable, requesting deletion of the recordings. If you have concerns about a call recording, please feel free to discuss these with the Contact Centre staff or contact our Data Protection Officer.
We are committed to implementing robust data protection and security measures, emphasising data minimisation and purpose limitation. Our approach ensures that only necessary and relevant personal data is collected for specified purposes, adhering to the highest standards of data protection and privacy. This includes ensuring the secure and confidential handling of call recordings made to our external Contact Centre.
Your data, including any call recordings made to our Contact Centre, may be stored and processed on secure computer systems to facilitate efficient care management and customer service. We ensure that all data is processed in compliance with applicable data protection laws, including the UK GDPR and the Privacy and Electronic Communications Regulations (PECR).
Data Processing and Third Parties
Your data may be stored and processed on computers to facilitate efficient care management. This may include, but not limited to, electronic medicines administration records and care plans.
Your information could be processed by third-party organisations acting on our behalf. These processors are carefully selected and compliant with UK GDPR, ensuring your data is handled securely and confidentially. Your data may occasionally be processed outside the UK, under strict safeguards to ensure its protection.
Retention of Your Data
Your information will be retained generally for six years after you leave our care, after which it will be securely disposed of. This period may be extended if required by law or for legitimate business purposes, i.e., for the effective and lawful operation of our business.
Keeping in Touch
We may communicate with you or your relatives to share important updates about our care services. These communications are essential for maintaining the quality of care and cannot be opted out of.
Data Sharing and Disclosures
We may need to share your personal data to support with your outcomes and care, such as internal support teams, other health care services e.g., your GP, with the organisations that may help to fund your care, regulatory bodies, the emergency services and our suppliers and local services.
We will always ensure that your personal data is only shared on a ‘need to know’ basis, i.e., that we only share what is necessary when there is a legitimate and lawful requirement to do so.
Social Media and External Sites
We sometimes use social media to keep residents’ loved ones, who may not be able to visit the home, up to date with activities and outcomes. We will never use photographs or videos of our residents, their loved ones, or our staff without seeking their explicit consent to do so.
Please be aware that third-party websites and social media platforms have their own privacy practices, and we encourage you to review them. We are not responsible for their policies or practices.
Your Rights
Under UK GDPR, you have rights regarding your personal data, including access, rectification, erasure, and objection to processing. Please contact our DPO for any requests or concerns at [email protected] or
Group Data Protection Officer
Norcliffe House
Station Road
Wilmslow
Cheshire
SK9 1BU
Information for people working for the Group
Data Processing: Safeguarding Your Wellbeing and Professional Integrity
This privacy notice outlines how the Four Seasons Health Care Group (the Group) collects, uses, and protects the personal data of our employees, workers including agency, contractors and volunteers in compliance with the UK General Data Protection Regulation (UK GDPR) and relevant data protection legislation. It applies to all employees, including healthcare workers, administrative staff, and support roles.
Categories of Personal Data Collected
We collect and process various categories of personal information depending on your role, including but not limited to:
- General details such as name, address, date of birth, and contact details.
- Application and recruitment information, including qualifications and employment history.
- Right to work and suitability for the role.
- Bank details for payroll purposes.
- Next of kin information.
- Physical and mental health details.
- Time and attendance records, leave and absences.
- Supervision and performance data.
- Equality monitoring information (e.g., ethnicity, religious beliefs).
- Photographs and CCTV images (in communal areas).
Where do we get the information from?
Most of the personal data we process is provided directly by you. In some instances, we may also collect data from:
- Occupational health services and medical professionals, with your consent.
- Professional and regulatory bodies (e.g., Nursing and Midwifery Council).
- Government bodies (e.g., Department for Work and Pensions).
- The Police National computer and equivalent sources of information in other jurisdictions in respect of the disclosure of criminal information.
Your personal data is processed for various purposes, including:
- Assessing suitability and eligibility for employment.
- Ensuring role requirements are met and support is provided.
- Payroll and employment benefits administration.
- Compliance with legal, contractual, and regulatory obligations.
- Health and safety, including public health measures.
- Internal communications and promotional activities (with the option to opt-out).
Our Lawful Bases for Processing Your Personal Data
In our commitment to uphold the highest standards of data protection and privacy, we, the Group, process your personal data based on the following lawful bases under UK GDPR, the Privacy and Electronic Communications Regulations (PECR), and other pertinent legislation:
- Consent (UK GDPR Article 6(1)(a) & Article 9(2)(a)): We seek your explicit consent for processing certain types of your personal data, especially for specific actions beyond the scope of employment obligations. This includes, but is not limited to, using your data for marketing purposes, sharing your success stories internally and externally, or for participating in research studies. You have the right to withdraw your consent at any time, with the assurance that it will not affect the lawfulness of processing based on consent before its withdrawal.
- Contract (UK GDPR Article 6(1)(b)): Processing your data is necessary for the performance of our employment contract with you. This includes administrative tasks related to your employment, such as payroll, benefits administration, managing work schedules, and fulfilling other contractually agreed-upon responsibilities.
- Legal Obligation (UK GDPR Article 6(1)(c)): We are required to process certain information to comply with our legal obligations as an employer. This encompasses data processing activities for tax purposes, adherence to employment laws, health and safety regulations, and any other statutory requirements.
- Vital Interests (UK GDPR Article 6(1)(d) & Article 9(2)(c)): On rare occasions, we may process your personal data to protect your vital interests or those of another person, particularly in emergency situations where your health or safety is at risk. This ensures that we can act swiftly and effectively to safeguard you and your colleagues.
- Legitimate Interests (UK GDPR Article 6(1)(f)): Some processing activities are carried out under our legitimate interests or those of a third party, provided these interests are not overridden by your interests, rights, or freedoms. Such interests include internal administrative purposes, ensuring network and information security, and conducting regular business operations that do not require consent under UK GDPR.
Special Category Data:
For processing special category data, which includes information about your health, racial or ethnic origin, trade union membership, and other sensitive details, we rely on additional lawful bases under UK GDPR:
- Employment, Social Security, and Social Protection (UK GDPR Article 9(2)(b)): Processing is necessary for carrying out obligations and exercising specific rights in the field of employment and social protection law.
- Health or Social Care Provision (UK GDPR Article 9(2)(h)): Processing is necessary for preventive or occupational medicine, assessing your working capacity, medical diagnosis, or the provision of health or social care services.
- Public Health (UK GDPR Article 9(2)(i)): Processing is essential for reasons of public health, such as protecting against serious cross-border threats to health or ensuring high standards of healthcare.
Compliance with PECR:
When engaging in direct marketing to our employees, we ensure compliance with the Privacy and Electronic Communications Regulations (PECR). This means that for any marketing communications sent via email, text, or phone, we obtain your prior consent unless the communication falls within the scope of the ‘soft opt-in’ exception. You are provided with a clear and straightforward way to opt out of marketing communications at any time.
We will not use your personal data to advertise, promote, or market third-party goods or services to you. We do not sell any personal data received for the purpose of marketing activities to third parties for their own commercial use.
In the Event of Transfers/Sales of Service
In the event of a sale, merger, or transfer of services within the Group, or to an external party, we are committed to the transparent and lawful handling of personal and special category data of our employees. This commitment is integral to our approach, which is rooted in compliance with legal obligations and a deep respect for the privacy of our staff:
- Employee Data Sharing: Should it become necessary to share personal data of our employees with prospective operators as part of organisational changes, such as sales, mergers, or service transfers, we approach this with the highest level of care and responsibility. Our aim is to ensure continuity of employment and minimal disruption to our staff.
- Due Diligence: Such actions are carried out with the utmost care and diligence. Arrangements are made to ensure that any prospective operator adheres to appropriate standards of privacy and data protection.
- Protection Through Agreements: Robust non-disclosure agreements are implemented to protect personal data during any transitional period This measure prevents unauthorised use or retention of the data beyond the initial intent.
- Open Communication: We are committed to protecting the privacy of your personal information, irrespective of changes in service provision or ownership. We are dedicated to keeping all parties informed of developments that may impact the management of their information.
Data Sharing and Disclosures
Your personal data may be shared with:
- Internal teams (e.g., Finance, Audit) for operational purposes.
- Occupational health providers, with your consent.
- Healthcare and social services, funding bodies, and regulatory agencies.
- Government bodies and safeguarding authorities.
Data is shared on a strict “need to know” basis, ensuring confidentiality and legal compliance.
Data Processing and Third Parties
Your information may be stored on secure computer systems and could be processed by third-party organisations acting on our behalf. These processors are carefully selected and compliant with UK GDPR, ensuring your data is handled securely and confidentially. Your data may occasionally be processed outside the UK, under strict safeguards to ensure its protection.
Retention of Your Data
Your information will be retained generally for six years post-employment termination, after which it will be securely disposed of. This period may be extended if required by law or for legitimate business purposes, i.e., for the effective and lawful operation of our business.
Social Media and External Sites
We sometimes use social media to keep residents’ loved ones, who may not be able to visit the home, up to date with activities and outcomes. We will never use photographs or videos of our residents, their loved ones, or our staff without seeking their explicit consent to do so.
Please be aware that third-party websites and social media platforms have their own privacy practices, and we encourage you to review them. We are not responsible for their policies or practices.
Your Rights
Under UK GDPR, you have rights regarding your personal data, including access, rectification, erasure, and objection to processing. Please contact our Data Protection Officer (DPO) for any requests or concerns at [email protected] or
Group Data Protection Officer
Norcliffe House
Station Road
Wilmslow
Cheshire
SK9 1BU
Information for resident’s loved ones, prospective residents, and other contacts or visitors
At the Four Seasons Health Care Group, we are deeply committed to creating a nurturing and safe environment for our residents and their families and other loved ones. Part of this commitment involves respecting and protecting your personal data, ensuring a foundation of trust and transparency between us. This privacy notice outlines how we handle your data in accordance with the UK General Data Protection Regulation (UK GDPR).
Data Processing: Guaranteeing Your Wellbeing and Security
As we value the relationship with residents’ loved ones, prospective residents, and other visitors, we understand the importance of maintaining and enhancing these connections. To achieve this, we may need to collect various types of information from you:
- General Personal Details: Including your name, address, and contact information for communication purposes.
- Bank Details: For those responsible for payments related to the care services we provide.
- Relationship Information: Understanding your relationship with our residents helps us tailor our communication and ensure the right level of engagement, whether you are a legal representative or a close family member.
- Interaction Records: Documenting visits, communications, and even CCTV footage (for safety reasons) helps us maintain a secure and welcoming environment for everyone and support our resident outcomes.
- Professional Details: For stakeholders, commissioners, and other professionals, we collect contact details, with consent, to keep you updated on home activities and developments.
Direct Marketing and Engagement
With your explicit consent, we may also use your personal data to inform you about additional services, news, event invitations, and offers that might be of interest to you or the resident on whose behalf you are acting. We ensure that all direct marketing communications adhere to the Privacy and Electronic Communications Regulations (PECR) and UK GDPR, providing you with clear options to opt-out at any stage. We will not use your personal data to advertise, promote, or market third-party goods or services to you. We do not sell any personal data received for the purpose of marketing activities to third parties for their own commercial use [consider including this, and elsewhere as needed].
In every marketing communication sent, we include a simple and straightforward mechanism for the recipient to opt-out of receiving future marketing materials. This ensures ongoing compliance with PECR and respects the individual’s preferences regarding marketing communications.
Tailored Communication Approach:
In certain situations, we may engage in communication that is closely related to your initial interaction with us. This approach is especially relevant if you, as a contact of a resident, a prospective resident, or a visitor, have previously provided us with your contact details while making enquiries about our services or during your interactions with the care home.
When we send you information that is directly relevant to your initial enquiry or our ongoing relationship, such as updates on services similar to those you have shown interest in, we do so with careful consideration of your expectations and privacy. At each point of contact where your details are collected, and with every communication sent, we ensure you are fully informed and have the clear option to opt-out of receiving further updates from us.
This method allows us to keep you informed about aspects of our care services that might be of direct interest to you, based on your previous interactions, while upholding our commitment to respect your choices and privacy.
Control Over Your Data
We recognise the significance of your privacy and provide you with complete control over your participation in our marketing efforts. You have the unequivocal right to opt out or withdraw your consent for direct marketing communications at any time, a process simplified through an easy unsubscribe option available in every communication or by contacting us directly at [email protected]. Please note that if you opt-out of receiving marketing-related messages from us, we may still send you important administrative messages as part of your ongoing use of our services.
Where do we get the information from?
The information we process is primarily provided directly by you. Occasionally, we may also receive data from external sources such as employers, healthcare providers, government departments, and other relevant organisations, always ensuring the respect of your privacy and data protection rights.
Using Your Information to Enhance Engagement
Our use of your data is focused on enhancing our care services and your experience with us:
- Engagement and Information: Keeping you informed about the care and well-being of your loved one, including significant updates and developments within our care homes.
- Operational Efficiency: Ensuring the smooth running of our care home operations, with accurate records and effective communication systems.
- Direct Marketing Communications: With your explicit consent, we engage in direct marketing to offer you relevant news, updates, and invitations to upcoming events that might interest you or benefit your loved one’s experience in our care homes.
- Stakeholder Collaboration: Sharing information with stakeholders (with your consent) to support the care and services we provide.
Our Legal Basis for Data Processing
In our commitment to transparency and adherence to (UK GDPR, the PECR, and other relevant legislation, we detail the legal grounds upon which we process the personal data of residents’ loved ones, prospective residents, and other visitors:
- Consent (UK GDPR Article 6(1)(a) & Article 9(2)(a)): We seek your explicit consent for specific activities, such as sending you marketing communications about news, offers, and events that may interest you. This consent is voluntary and can be withdrawn at any time, ensuring your complete control over the use of your data for these purposes.
- Contract Performance (UK GDPR Article 6(1)(b)): We process your data as necessary to fulfil contractual obligations, particularly when managing payments for our services and any other agreements directly related to the care and support of our residents. This includes actions required to enter into a contract with you or to provide the services you have requested.
- Legal Obligation (UK GDPR Article 6(1)(c)): Certain data processing activities are carried out to ensure compliance with legal requirements. This includes adhering to health and safety laws, safeguarding regulations, and any other statutory obligations that protect the well-being of our residents and staff.
- Legitimate Interests (UK GDPR Article 6(1)(f)): We process some data under the legitimate interests pursued by us or a third party, provided those interests do not override your fundamental rights and freedoms. These interests include enhancing the care and services we provide, improving our operational processes, ensuring the security of our IT systems, and conducting business management and planning.
- Vital Interests (UK GDPR Article 6(1)(d)): In rare cases, we may need to process your data to protect someone’s life. This is most relevant in emergency situations where rapid action is necessary for the health or safety of individuals.
- Public Interest (UK GDPR Article 6(1)(e)): Some data processing is necessary for performing tasks carried out in the public interest or in the exercise of official authority vested in us. This includes health monitoring and managing public health issues.
Special Category Data Processing
Special category data includes personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for uniquely identifying a person, health data, or data concerning a person’s sex life or sexual orientation. For processing this type of data, our legal basis is extended to include:
- Explicit Consent (UK GDPR Article 9(2)(a)): For processing special category data, we rely on the explicit consent of the individuals involved. This means we will ask for your clear and affirmative consent to process sensitive personal data, ensuring you are fully informed of the specific type of data being processed and the reasons for processing.
Vital Interests (UK GDPR Article 9(2)(c)): In situations where obtaining explicit consent is not possible, and it’s necessary to protect an individual’s vital interests (especially in life-threatening scenarios), we may process special category data without consent.
Public Interest in the Area of Public Health (UK GDPR Article 9(2)(i)): For public health reasons, such as protecting against serious cross-border threats to health or ensuring high standards of healthcare and of medicinal products or medical devices, processing special category data may be necessary and carried out without obtaining explicit consent.
Transfers / Sales of Service
The Four Seasons Health Care Group acknowledges the importance of privacy and data protection for the loved ones of our residents, prospective residents, and other contacts or visitors. In the face of organisational changes such as sales, mergers, or transfers of services, our approach remains steadfastly focused on the respectful and secure handling of your personal information:
- Data Sharing: In circumstances necessitating the sharing of personal data with potential new operators or external parties—due to sales, mergers, or service transfers—we prioritise the protection of the information of residents’ loved ones, prospective residents, and other contacts or visitors. This process is integral to our commitment to maintaining the continuity and quality of care and communication.
- Due Diligence: Such actions are carried out with the utmost care and diligence. Arrangements are made to ensure that any prospective operator adheres to appropriate standards of privacy and data protection.
- Protection Through Agreements: Robust non-disclosure agreements are implemented to protect personal data during any transitional period This measure prevents unauthorised use or retention of the data beyond the initial intent.
- Open Communication: Recognising the value of trust and openness, we pledge to keep residents’ loved ones, prospective residents, and other contacts or visitors fully informed about any developments that might influence the handling of their personal data. Our goal is to ensure that you remain confident in our data protection practices, even as we navigate changes in service provision or ownership.
Our dedication to the privacy and security of personal data extends across all interactions within the Four Seasons Health Care Group. Whether you are closely connected to one of our current residents, considering our care homes for the future, or engaging with us in any other capacity, we are committed to upholding the highest standards of data protection and privacy, particularly during times of organisational change.
Communications with Our Contact Centre
The Four Seasons Health Care Group values open communication with the loved ones of our residents, prospective residents, and other contacts or visitors. Our external Contact Centre plays a crucial role in facilitating this communication, offering an accessible point of contact for queries, support, and information regarding our services.
- Call Recording for Quality and Training: To uphold our commitment to delivering exceptional service, calls to our external Contact Centre may be recorded. These recordings are instrumental in our efforts to continually improve the quality of our communications and to provide effective training for our staff. An announcement is made on each call regarding recording.
- Implied Consent: By continuing with your call to our Contact Centre, it is implied that you consent to the recording of the conversation. We use these recordings solely for the purposes mentioned and handle them with the same level of confidentiality and security as all other personal data we process.
- Rights Regarding Call Recordings: We respect your rights in relation to your personal data, which encompasses call recordings. You are entitled to access your recorded data, request corrections to any inaccuracies, and, where appropriate, seek the deletion of these recordings. If you have any concerns or queries regarding a recorded call, we encourage you to discuss these with the Contact Centre staff or reach out directly to our Data Protection Officer for assistance.
Ensuring Data Protection and Security
- In line with our commitment to robust data protection and security practices, we ensure that data minimisation and purpose limitation principles are applied to the handling of call recordings. This means that we only retain recordings that are necessary for the purposes stated and protect them with stringent security measures.
Storage and Processing
- Call recordings, along with other personal data provided through interactions with our Contact Centre, are stored and processed on secure systems. This is part of our commitment to efficient and confidential management of inquiries and communications. All processing is conducted in strict compliance with UK GDPR, PECR, and other applicable data protection laws.
Data Sharing and Disclosures
Your data is shared only, when necessary, with:
- Internal teams for operational support.
- Healthcare providers for resident care.
- Funding organisations and regulatory bodies.
- Safeguarding authorities.
- To facilitate corporate transactions with third parties.
We only use your personal information for the purposes for which we collect it. However, there are instances where it is possible that we will use your information for other purposes as long as those other purposes are consistent with those set out in this policy. This may be, for example, disclosures with entities within our Group, and to comply with the law. If we intend to do so, we will provide you with information relating to that other purpose before using it for the new purpose.
Retention of Your Data
Your information will be retained generally for six years after your or your loved one’s association with us ends, after which it will be securely disposed of. This period may be extended if required by law or for legitimate business purposes, i.e., for the effective and lawful operation of our business.
Social Media and External Sites
We sometimes use social media to keep residents’ loved ones, who may not be able to visit the home, up to date with activities and outcomes. We will never use photographs or videos of our residents, their loved ones, or our staff without seeking their explicit consent to do so.
Your Rights
Under UK GDPR, you have rights regarding your personal data, including access, rectification, erasure, and objection to processing. Please contact our Data Protection Officer (DPO) for any requests or concerns at [email protected] or
Group Data Protection Officer
Norcliffe House
Station Road
Wilmslow
Cheshire
SK9 1BU
Information for Enquirers
Gathering Your Details
When you reach out to us via enquiry forms, phone calls, or direct contact with our homes, we begin processing the personal data you share. This includes any further personal data you provide during follow-up communications.
Should you or your loved one choose to reside in one of our care homes, we’ll process your personal data in line with our Resident Privacy Notice. If you’re considering employment with us, your data will be handled according to our Team Member Privacy Notice.
How We Use Your Details
Your information aids us in connecting you with the appropriate care home and supplying you with necessary details to make informed decisions regarding care services or employment opportunities. With your permission, we might also send follow-up emails related to your initial enquiry — these fall under direct marketing. You’re entitled to opt-out of direct marketing messages at any time.
Additionally, we utilise your information for internal statistical analysis to aid in management forecasting, ensuring your identity remains anonymous in any reports.
Control Over Your Data
We recognise the significance of your privacy and provide you with complete control over your participation in our marketing efforts. You have the unequivocal right to opt out or withdraw your consent for direct marketing communications at any time, a process simplified through an easy unsubscribe option available in every communication or by contacting us directly at [email protected]. Please note that if you opt-out of receiving marketing-related messages from us, we may still send you important administrative messages as part of your ongoing use of our services.
Legal Basis for Processing
Our processing of your personal data rests on:
- Consent: We process your data based on explicit consent for specific actions, such as receiving information about our homes and services. You can withdraw this consent at any time, ceasing further communication from us.
- Contract: We process data necessary for steps prior to entering into a contract with you or your loved one for our services.
- Legitimate Interests: We use enquiry data for generating insights and statistics to improve our services.
Data Sharing and Disclosures
We may share your information within our group or with external authorities as required by law. Selected third-party organisations might also process your data, under stringent data protection measures, to ensure your privacy. This includes potential data processing outside the UK, with appropriate safeguards.
Data Retention
We retain your enquiry data until you indicate you no longer wishing to be contacted, upon resolution of your enquiry, or following your or your relative’s admission into one of our homes or your entrance into our recruitment process. Anonymised statistical data will be retained for internal use without identifying individuals.
