Privacy Policy
Winsome Care Ltd is committed to protecting your privacy. This policy explains how we collect, use, and safeguard your personal information when you use our website or services.
Who We Are
Data Controller: Winsome Care Limited
Company Number: 15713079
Registered Address: Anfield Business Centre, 58 Breckfield Road South, Liverpool, L6 5DR
Email: info@winsomecare.co.uk
Telephone: 0151 453 5560
What Personal Data We Collect
We may collect and process the following categories of personal data:
People We Support
- Full name, date of birth, address, and contact details
- Next of kin and emergency contact information
- Health and medical information, including diagnoses, medications, and treatment plans
- Care and support needs assessments
- Support plans, risk assessments, and daily care records
- Mental capacity assessments and Best Interests decisions
- Safeguarding records
- Financial information relating to care funding
- Communication preferences and accessibility needs
- Photographs (with consent)
Staff and Job Applicants
- Employment history, qualifications, and references
- DBS check results
- Right to work documentation
- Training records and professional registrations
- Supervision and appraisal records
- Health information relevant to their role
- Bank details for payroll
Website Visitors
- Information submitted through contact forms or referral forms
- Cookies and website usage data (see our Cookie Policy section below)
How We Use Personal Data
We process personal data for the following purposes:
- To deliver safe, effective, and person-centred supported living services
- To comply with our legal and regulatory obligations, including CQC registration requirements
- To safeguard the people we support from abuse and neglect
- To manage our staff, including recruitment, payroll, training, and supervision
- To respond to enquiries, referrals, and complaints
- To manage our finances and billing
- To improve the quality of our services through auditing and monitoring
- To communicate with families, professionals, and commissioners as necessary
Our Lawful Bases for Processing
We process personal data under the following lawful bases as defined in Article 6 of the UK GDPR:
Consent: Where the person has given clear consent for us to process their personal data for a specific purpose.
Contract: Where processing is necessary for the performance of a contract (for example, a care agreement or employment contract).
Legal Obligation: Where processing is necessary to comply with a legal obligation (for example, CQC regulations, safeguarding duties, or employment law).
Vital Interests: Where processing is necessary to protect the vital interests of the person (for example, in a medical emergency).
Legitimate Interests: Where processing is necessary for our legitimate interests, provided those interests do not override the person's rights and freedoms.
For special category data (including health data), we rely on the additional conditions set out in Article 9 of the UK GDPR, including the provision of health or social care and safeguarding of vulnerable individuals.
Data Sharing
We may share personal data with the following parties where necessary and lawful:
- Healthcare professionals (GPs, district nurses, hospitals, mental health teams)
- Local authority social care teams and commissioners
- The Care Quality Commission (CQC)
- Emergency services
- Housing providers (limited to information necessary for tenancy management)
- Our IT and software providers (who process data on our behalf under data processing agreements)
- Our accountants and legal advisors (where necessary)
We will never sell personal data to third parties. We will never share personal data with anyone who does not need it for the purposes described above.
Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Care records are retained for a minimum of eight years after the last date of care provision, in line with NHS and CQC guidance. Staff records are retained for six years after the end of employment. Website enquiry data is retained for 12 months unless a longer period is required.
Data Security
We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, or damage. These measures include encrypted electronic systems, password protection, access controls, secure storage of physical records, regular data protection training for all staff, and Data Protection Impact Assessments for new processing activities.
Your Rights
Under the UK GDPR, you have the following rights in relation to your personal data:
Right to Access: The right to request a copy of the personal data we hold about you.
Right to Rectification: The right to have inaccurate personal data corrected.
Right to Erasure: The right to request deletion of your personal data (subject to legal obligations).
Right to Restrict Processing: The right to request that we limit how we use your data.
Right to Data Portability: The right to receive your data in a structured, commonly used format.
Right to Object: The right to object to certain types of processing.
Rights Related to Automated Decision-Making: The right not to be subject to decisions based solely on automated processing.
To exercise any of these rights, please contact us at info@winsomecare.co.uk or write to us at the address above. We will respond to all rights requests within one calendar month.
Complaints About Data Protection
If you have any concerns about how we handle your personal data, please contact us in the first instance. If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113
Website: www.ico.org.uk
Changes to This Policy
We may update this privacy policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically to stay informed about how we protect your personal data.