1. Purpose and scope
ExcelCare Agency holds some of the most sensitive information there is: health conditions, medication, personal care needs, family circumstances, and sometimes safeguarding and financial details. This policy explains how we collect, use, store, share and delete that information lawfully and respectfully.
It applies to all staff, bank workers, volunteers, students, contractors and directors, and to every format — paper, electronic, email, text message, photograph and verbal conversation.
2. Lawful basis
We process personal data as a data controller under the UK GDPR and the Data Protection Act 2018.
- Personal data is processed on the basis of contract and legal obligation, and where necessary our legitimate interests in delivering safe care.
- Special category data (health, ethnicity, religion, sexual orientation) is processed under Article 9(2)(h) — the provision of health and social care — and Article 9(2)(g) where safeguarding duties apply.
- Criminal offence data is processed only where the law permits, for example in safeguarding.
We do not rely on consent for the delivery of care itself, because care must not be conditional on it. Consent is used for optional things such as photographs, newsletters and marketing.
3. The principles we apply
- Lawfulness, fairness and transparency — people are told what we hold and why, in a privacy notice given at the start of care.
- Purpose limitation — information is used for care, safety, safeguarding and legal duties, not for anything else.
- Data minimisation — we record what is needed to deliver safe care and nothing more.
- Accuracy — records are factual, dated, signed and corrected properly; opinion is labelled as opinion.
- Storage limitation — records are kept only for the periods set out below.
- Integrity and confidentiality — access is controlled, devices are encrypted and paper is locked away.
- Accountability — the Data Protection Lead maintains the record of processing and handles requests and breaches.
4. Confidentiality in practice
- Conversations about a person take place out of earshot of others, including in shared corridors, lifts and waiting rooms.
- Care records are never left in view in a person's home, in a car or on a printer.
- Staff never discuss people we support on social media, in group chats, or with their own family and friends.
- Photographs are taken only with explicit consent, on agency devices, and are never stored on personal phones.
- Staff use only their own named accounts and never share passwords or log-ins.
5. Sharing information
Information is shared with other professionals — GPs, district nurses, hospitals, the local authority, ambulance crews — on a need-to-know basis, applying the Caldicott principles.
Where there is a safeguarding concern, we share information without consent where necessary to protect an adult at risk, relying on the safeguarding exemption in the Data Protection Act 2018. We record what was shared, with whom, and why.
Where a person lacks capacity to decide about sharing, we act in their best interests under the Mental Capacity Act 2005.
6. Subject access and other rights
People we support, or their authorised representatives, can ask to see their records or ask for information to be corrected or erased.
- Requests may be made verbally or in writing to any member of staff and must reach the Data Protection Lead the same working day.
- We respond within one calendar month, free of charge, and may extend by two months for complex requests, telling the requester why.
- Where a request involves another person's information, or would cause serious harm, limited information may be withheld and the reason explained.
- Records are not altered or deleted to avoid a request.
7. Retention
| Record | Retention |
|---|---|
| Care records for adults | 6 years after care ends, or 3 years after death |
| Medicines records | 6 years after care ends |
| Safeguarding records | 7 years after the concern closes |
| Incident and complaint records | 6 years |
| Staff personnel files | 6 years after employment ends |
| Recruitment records for unsuccessful applicants | 6 months |
| Financial records | 6 years |
Records are securely destroyed at the end of the retention period, and destruction is logged.
8. Data breaches
A breach is any loss, theft, unauthorised access, disclosure or accidental destruction of personal data — including a lost phone, a misdirected email or a lost paper visit sheet.
- Contain the breach immediately and inform the Data Protection Lead without delay.
- Record it on the breach log with what happened, what data was involved and who was affected.
- Assess the risk to those affected, and inform them where the risk is high.
- Report to the Information Commissioner's Office within 72 hours where the breach is likely to result in a risk to people's rights and freedoms.
- Notify CQC where the breach affects the safe delivery of care.
- Review the cause and change practice, training or systems accordingly.
9. Information security
- Mobile devices used for rostering and records are provided by the agency, encrypted and PIN or biometric protected.
- Systems use multi-factor authentication where available.
- Access rights are role-based and removed within 24 hours of a person leaving.
- Paper records in the office are stored in locked cabinets; the office is alarmed.
- Data is backed up daily and the restore process is tested quarterly.
10. Roles, training and review
The Registered Manager is the Data Protection Lead and the point of contact for the Information Commissioner's Office. All staff complete data protection training at induction and annually, and receive a briefing after any breach. This policy is reviewed annually and when the law or our systems change.