Privacy

Section 1: Data Protection Law and your rights

What is this notice all about?

Welcome to our Privacy Notice!

It’s great that you’d like to know more about how we keep your information safe. This notice will give you information about how we look after your personal data when you visit, use, or interact with our services.

The Privacy Notice also tells you about your privacy rights and how the law protects you. Finally, this Privacy Notice covers both our online and offline data collection activities, including personal data that we may collect through our various channels such as websites, third party social networks, our care and support services, and communications with you.

In other words, if you’re looking for more information on how we collect, store, use and share your personal data, this is probably the place for you!

Although if you’re applying for one of our vacancies then you should go here. Colleagues can find their privacy notice on Connect.

Who is responsible for your personal data?

The ivolve Group is made up by several different legal entities all registered in the UK. You can read more about the ivolve Group here on ivolve.care.

This Privacy Notice is issued on behalf of all the companies in the ivolve Group, including Fieldbay in Wales. For the purposes of this Privacy Notice when we use “we”, “us”, or “our” in this Privacy Notice, we are talking about the Ivolve Group and our family of subsidiary companies.

We have appointed a data protection officer (“DPO”) who is responsible for overseeing questions in relation to this Privacy Notice. If you have any questions about this Notice, please contact us. You can also send a letter to the DPO at:

FAO: Data Protection Officer

Heathcotes Group

37 Station Road

Chesterfield

Derbyshire

S41 7BF

Your Privacy Rights

As an individual you have the following rights in respect of the personal data, we hold about you:

Request access to your personal data.

You have a right to access the personal data we are keeping about you. Your right to access may, however, be restricted by legislation, protection of other people’s privacy and consideration for the Ivolve Group’s business practices, know-how, business secrets and internal assessments.

Request correction of incorrect or incomplete data.

If the data we have pertaining to you are incorrect or incomplete, you are entitled to have the data corrected. You can also ask us to complete information you think is incomplete.

Request erasure.

You have the right to request deletion of your data when:

the personal data is no longer necessary in relation to the purposes for which they were collected or otherwise processed;
you withdraw your consent to the processing and there is no other lawful reason for processing;
you object to the processing and there is no justified reason for continuing the processing;
or the processing is unlawful

Please note that, in certain circumstances, we may be required to retain some of your personal data after you have requested deletion to satisfy our legal or contractual obligations. We may also be permitted by applicable laws to retain some of your personal data to satisfy our business needs.

Limitation of processing of personal data.

If you contest the correctness of the data which we have registered about you or lawfulness of processing, or if you have objected to the processing of the data in accordance with your right to object, you may request us to restrict the processing of this data. The processing will be restricted to storage only, until the correctness of the data can be established, or it can be checked whether our legitimate interests override your interests. Even when processing of your data has been restricted as described above, the ivolve Group may process your data in other ways if this is necessary to enforce a legal claim or to process previously collected data if you have earlier given your consent.

Object to processing based on our legitimate interest.

You can always object to the processing of personal data about you which is based on our legitimate interest. If we are processing your data for direct marketing and profiling in connection to such marketing, your objection will always be sustained. For objections to processing for other purposes, we will conduct a legitimate interest balancing test and consider whether to support your objection.

Data portability.

You have a right to receive personal data that you have provided to us in a machine-readable format. This right applies to personal data processed only by automated means and based on consent, or of fulfilling a contract.

Other rights.

We work to a high standard when it comes to processing your personal information. If you have queries or concerns, please contact our Data Protection Officer and he will respond.

If you remain dissatisfied, you can make a complaint about the way we process your personal information to ICO the UK supervisory authority.

If you do not have access to the internet, then please let us know and we will provide you alternate contact details for the ICO.

You are not normally required to pay any charge for exercising your rights and we have one month to respond to you.

Please contact our DPO if you wish to make a request or discuss a concern. feedback@ivolvecare.com

Further information: updates

If we change the way we handle your personal data, we will update this Privacy Notice. We reserve the right to make changes to our practices and this Privacy Notice at any time, so please check back frequently to see any updates or changes to our Privacy Notice. This page was last updated 14^th December 2023.

Section 2: Personal Data

What personal data does the Ivolve Group collect?

Personal data is any information about a person from which that person can be identified. We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

Identity Data includes first name, last name, username or similar identifier, marital status, title, date of birth and gender.
Contact Data includes billing address, residential address, email address and telephone numbers
Financial Data includes bank account and payment card details.
Transaction Data includes details about payments to and from you and other details of services you have purchased from us.
Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on devices you use to access this website.
Usage Data includes information about how you use our website and services.
Marketing and Communications Data includes your preferences in receiving marketing from us, and your communication preferences.

We also collect, use, and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data could be derived from your personal data but is not considered personal data because this data will not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this Privacy Notice.

We use Pseudonymised Data to minimise the privacy impact to you.

Pseudonymisations is a method that replaces or removes information in the dataset that identifies an individual but permits a data controller or third party to reidentify the personal data with reasonable effort. It is important to be aware that unlike anonymisation, pseudonymisations does not remove all identifying information from the data but reduces the linkability of a dataset with the identity of an individual.

We also collect Special Categories of Personal Data about you when we provide care and support services to you or to a lesser extent a family member. This includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, or genetic information, biometric data and information about criminal convictions and offences.

We do not routinely collect Special Categories of Personal Data about people unconnected to our provision of care and support services, in those situations where we need to, collect Special Categories of Personal Data not connected to our provision of care and support services we will make individuals aware of this at the earliest appropriate time.

If you fail to provide necessary personal data to us (we will let you know when this is the case), we may not be able to provide you with our services.

How does the ivolve Group collect personal data from you?

We collect personal data from the following sources:

Websites includes any website operated by or for the Ivolve Group, including sites that we operate under our own domains/URLs and mini sites that we run on third part social networks such as Facebook.
E-mail, text, and other electronic messages includes electronic communications between you and the Ivolve Group
Customer Service includes calls and face to face chats with our colleagues.
Offline registration forms includes printed registration, onboarding, and similar forms that we collect, for example postal mail or in person.
Surveys in which you may participate both in person and online.

Personal data the Ivolve Group may collect from third parties

We may receive personal data about you from various third parties and public sources as set out below:

Contact, Financial and Transaction Data from providers of technical and payment services.

Identity and Contact Data from publicly available sources.

Identity and Contact Data from commissioning authorities such as local authorities and the NHS.

Identity and Contact Data from family members and next of kin

Special Categories of Personal Data from commissioning authorities such as local authorities and the NHS (as a commissioning body for social care services)

Special Categories of Personal Data from health care providers and professionals (when we provide care and support services to you, and you have consented to them sharing such information with us)

Special Categories of Personal Data from Family and next of kin where we are providing care and support services to you.

How does the ivolve Group use your personal data?

Purposes and legal bases for processing

People we support

What you do	What we collect	Why we collect it	Legal Basis
Benefit from or access to, our health and care services	Personal Contact DetailsIdentity DataFinancial DataSpecial Category DataCriminal ConvictionsOther personal information you provide us with	To provide health and social care services.For the administration and management of health & social care services (such as maintaining care records, receiving professional advice.)Service improvement, evaluation, and auditSafeguarding purposes (for example, to ensure the health and safety of an individual)Communicating with you (or another person you ask us to), to provide information about your care and support. Responding to and resolving any queries or complaints	Legal obligation, Art. 6(1)(c), UK GDPR, in connection to our compliance with legislation e.g., Health & Social Act 2012Performance of a contract, Art. 6(1)(b), UK GDPR, in relation to our mutual agreement(s)Legitimate interest, Art. 6(1)(f), UK GDPR, our legitimate interest is to manage our relationship with youConsent, Art. 6(1)(a), UK GDPR, in limited circumstances related to the processing of special category data or in relation the sharing of confidential personal data under the common law duty of confidence.

Family, friends of people we support and members of the public

What you do	What we collect	Why we collect it	Legal Basis
Visit a home	Identity Data	For the administration and management of health & social care servicesFor security and safety reasons	Legal obligation, Art. 6(1)(c), UK GDPR, in connection to our compliance with legislation e.g., Health & Social Act 2012Legitimate interest, Art. 6(1)(f), UK GDPR, our legitimate interest in safeguarding and protecting health & safety of our colleagues, people we support and other visitors.
Communicate with us about a family member or friend who we support	Personal Contact DetailsIdentity DataMarketing and Communications DataUsage DataTechnical DataInformation about your interactions with people we support or our dealings with our colleaguesIn limited circumstances, we may process sensitive personal information (for example equalities monitoring data when you make a complaint about our services)	For the administration and management of health & social care servicesService improvement, evaluation, and audit	Legal obligation, Art. 6(1)(c), UK GDPR, in connection to our compliance with legislation e.g., Health & Social Act 2012Performance of a contract, Art. 6(1)(b), UK GDPR, in relation to our mutual agreement(s)Legitimate interest, Art. 6(1)(f), UK GDPR, our legitimate interest is to manage our relationship with you
Form part of the family or social network of a person we support	Personal Contact DetailsIdentity DataInformation about your interactions with people we support or our dealings with our colleaguesIn limited circumstances, we may process sensitive personal information (for example equalities monitoring data when you make a complaint about our services)Information about your experience of our services.	For the administration and management of health & social care servicesTo provide health and social care services.Responding to and resolving any queries or complaintsTo provide updates or information about a person we support, where that person has agreed to such confidential information being shared with you. Or there is another lawful reason for sharing a person we support’s confidential information with you.	Legal obligation, Art. 6(1)(c), UK GDPR, in connection to our compliance with legislation e.g., Health & Social Act 2012Performance of a contract, Art. 6(1)(b), UK GDPR, in relation to our mutual agreement(s)Legitimate interest, Art. 6(1)(f), UK GDPR, our legitimate interest is to manage our relationship with youConsent, Art. 6(1)(a), UK GDPR, in limited circumstances related to the processing of special category data or in relation the sharing of confidential personal data under the common law duty of confidence.

Professional and business relations

What you do	What we collect	Why we collect it	Legal Basis
Enter a professional or commercial relationship with us as an organisation or private person	Identity DataContact DataFinancial DataOther personal information you provide us with	To be able to manage the professional or commercial relationship with you or your organisationTo fulfil our obligations in the professional or commercial relationship	Performance of a contract, Art. 6(1)(b), UK GDPR, in relation to our mutual contractual relationshipLegitimate interest, Art. 6(1)(f), UK GDPR, our legitimate interest is to manage our relationship with you or your organisation.

Third party social networks

What you do	What we collect	Why we collect it	Legal Basis
Interact with third-party social networking features (e.g., Facebook or LinkedIn), such as “Like” functions* *The social media platforms may use personal information from the Ivolve Group’s social network account on their platform for their own purposes as described in their own privacy notices	Technical Data Usage DataMarketing and Communications Data	To answer your questions or respond to feedbackTo report on and analyse user engagement on the platform(s)	Legitimate interest Art. 6(1)(f), UK GDPR, in connection with answering your questions and reporting and analysing on user engagement.

Video monitoring (in relevant homes and other Ivolve Group locations)

What you do	What we collect	Why we collect it	Legal Basis
Visit one of our homes or locations where video monitoring is in use (this will be clearly signed at each location)	Video footage of our premises, which may include Identity Data	To prevent and document criminal violations, including forced entry, robbery, theft, assault, abuse, or fraud and to provide security and safety for our employees, residents, and other visitors	Legitimate interests, Art.6(1)(f), UK GDPR, in connection with the preventing and detection of crime being committed on Ivolve Group locations.

Customer service

What you do	What we collect	Why we collect it	Legal Basis
Interact with our customer support functions	Identity DataContact DataUsage DataTechnical Data Feedback (e.g., relayed via our communication channels or social media)General questionsOther information or content regarding the reason for your inquiryCompletion of a survey	To provide you with supportTo gain insights on how we can improve our servicesTo act according to applicable law in responding to consumer complaints	Legitimate interest, Art. 6(1)(f), UK GDPR. Our legitimate interest is to optimise our customer servicesLegal obligation, Art. 6(1)(c), UK GDPR, in connection to our compliance with legislationPerformance of a contract, Art. 6(1)(b), UK GDPR, in relation to our mutual agreement(s)

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting, or other requirements.

Who will the ivolve Group share personal data with?

Sharing information with ivolve Group family of companies

Our subsidiaries (the other companies in the ivolve Group) may sometimes need to access your information to provide services to you on our or their own behalf. They need your personal data so we or they can perform the activities listed in the tables above, including as an example:

Send you information about out sites and policies
Send you direct marketing messages
Process information that the subsidiary processes on our behalf, e.g., providing some of our care and support services.
Identify, review, and stop any activities that could breach our policies or break the law

Sharing information with other companies

Please see our category list of trusted third parties that we may share your information with here. We process personal data with vendors in the following categories.:

IT Service providers. We use a series of trusted partners to provide us with IT services and system administration services – about both our customer and partner facing activities as well as out internal IT and administration systems.
Global payment provider and processing partners. These help us to secure a safe and efficient payment process both online, and through invoicing or money transfer.
Cloud storage partners. We store our and your data at secure data centres.
Survey and questionnaires product suppliers. These help us get your all-important feedback of your Ivolve experience.
Tax and customs authorities, regulators, and other authorities. These require reporting of processing activities in certain circumstances.
Professional advisers. Including solicitors, auditors, and insurers. These provide consultancy, banking, legal, insurance and accounting services to the Ivolve Group.

Other uses and disclosures

We will also use and disclose personal data as we believe to be necessary or appropriate: (a) to comply with applicable laws; (b) to respond to requests from public and government authorities; (c) to cooperate with law enforcement; (d) to protect our rights, privacy, safety, or property, and that of our affiliates, you, or others.

In addition, we will use, disclose, or transfer personal data to a third party in the event of any reorganisation, merger, sale, joint venture, assignment.

National Data Opt-Out

At this time, we do not share any data for planning or research purposes for which the national data opt-out would apply. We review all of the confidential patient information we process on an annual basis to see if this is used for research and planning purposes. If it is, then individuals can decide to stop their information being shared for this purpose. You can find out more information at https://www.nhs.uk/your-nhs-data-matters/.

Transfers to third countries

The Ivolve Group may make “restricted transfers” of personal data to organisations outside of the UK. Such transfers can be made only if one of the following conditions apply:

The UK government has decided that there is an adequate level of protection in the country in question and it is covered by ‘adequacy regulations’
Standard data protection clauses in the form of;
- The UK’s International Data Transfer Agreement (IDTA); or
- The UK’s International Data Transfer Addendum (Addendum), to the new standard contractual clauses issued by the European Commission on 4^th June 2021.
Exceptions in special situations apply and are detailed in relevant legislation.

Data Protection Officer contact details

Our Data Protection Officer is James Quilter. You can contact him at dataprotection@ivolvecare.com or via our postal address. Please mark the envelope ‘FOA: Data Protection Officer’