Your information. Handled with care.

Who we are

Earlston & Doune Care Services Ltd is a Scottish company providing care and support services.

For relevant processing activities, Earlston & Doune Care Services Ltd is responsible for deciding why and how personal information is processed.

Our company number is SC831757 and our Care Inspectorate registration is CS2025000424.

Personal information we may collect

The information we collect depends on why a person is interacting with us and what information is reasonably required for that purpose.

Depending on the circumstances, this may include:

• Name, title, date of birth and contact information.
• Address and other identifying information.
• Emergency-contact and representative details.
• Information supplied during a care or support enquiry.
• Assessment, support-planning and personal-outcome information.
• Communication preferences and accessibility requirements.
• Records relating to the delivery, review and coordination of care or support.
• Professional referral and commissioning information.
• Correspondence and records of communications with us.
• Complaints, feedback, incidents and quality-related information.
• Employment and recruitment information.
• Supplier, contractor and professional-contact information.
• Appropriate financial, invoicing or payment-related information.
• Technical information generated through use of our website, where applicable.

We aim to collect only information that is relevant and reasonably necessary for the purpose for which it is being processed.

Health and other sensitive information

Care and support services may require us to process information that receives additional protection under data-protection law.

Depending on the circumstances, this may include information concerning:

• Physical or mental health.
• Disability and support needs.
• Medication-related information where relevant to the service.
• Communication and accessibility requirements.
• Relevant risk and safety information.
• Other special-category information where it is necessary and lawful to process it.

We only process special-category personal information where an appropriate legal basis and additional condition for processing applies.

How we obtain personal information

Personal information may be obtained directly from the individual concerned or, where appropriate and lawful, from another person or organisation.

Sources may include:

• Individuals contacting us about care or support.
• Family members, representatives or people authorised to act on someone's behalf.
• Social workers and other health or social-care professionals.
• Commissioners, local authorities or other relevant organisations involved in arranging support.
• Job applicants, employees and workers.
• Suppliers, contractors and business contacts.
• Website, telephone, email and other communications.

Where information is provided by someone other than the individual concerned, we expect information sharing to have an appropriate and lawful basis.

How we may use personal information

Personal information may be processed for purposes including:

• Responding to enquiries about care and support.
• Considering whether we can appropriately meet an individual's assessed needs.
• Assessing, planning, arranging and reviewing support.
• Delivering agreed care and support.
• Promoting continuity, safety and effective communication.
• Maintaining appropriate service records.
• Communicating with representatives and professionals where appropriate.
• Managing referrals and professional relationships.
• Responding to concerns, complaints, incidents and safeguarding matters.
• Meeting regulatory, contractual and legal requirements.
• Recruiting, employing and managing staff.
• Managing business administration, governance, quality and information security.
• Maintaining and improving our services.

Our lawful bases for processing

Data-protection law requires personal information to be processed on an appropriate lawful basis. The basis used depends on the purpose and circumstances of the processing.

Depending on the activity, relevant lawful bases may include:

• Processing necessary to enter into or perform a contract.
• Processing necessary to comply with a legal obligation.
• Processing necessary for our legitimate interests or those of another party, where those interests are not overridden by the individual's rights.
• Processing necessary to protect vital interests in appropriate circumstances.
• Processing carried out with valid consent where consent is the appropriate lawful basis.

Special-category information

Where special-category information is processed, an additional condition must also apply. Depending on the circumstances, this may include conditions connected with health or social care, employment and social protection, substantial public interest, vital interests, legal claims or explicit consent where appropriate.

We do not rely on consent simply because information is sensitive. The appropriate legal basis depends on why the information is being processed.

When information may be shared

We do not treat personal information as something to be shared indiscriminately.

Where necessary, proportionate and lawful, information may be shared with relevant parties such as:

• Staff and workers who require information to perform their authorised responsibilities.
• Health and social-care professionals involved in a person's support.
• Local authorities, commissioners or funding bodies where relevant.
• Representatives or family members where they are appropriately authorised or another lawful basis applies.
• Regulators and statutory bodies where required.
• Safeguarding or emergency services where necessary.
• Professional advisers, insurers, auditors or legal representatives where appropriate.
• Technology, administrative or other service providers processing information on our behalf under appropriate arrangements.

We aim to limit disclosures to information that is relevant to the purpose for which it is being shared.

Safeguarding, safety and legal disclosure

Confidentiality is important, but it is not always absolute.

There may be circumstances in which information needs to be disclosed without consent, including where disclosure is necessary and lawful in connection with safeguarding, serious risk, legal obligations, regulatory requirements or the prevention or detection of crime.

Any such disclosure should be considered carefully and limited to what is appropriate in the circumstances.

Recruitment and employment information

If you apply to work with Earlston & Doune, we may process information relevant to assessing your application and, where applicable, managing employment.

This may include:

• Name and contact information.
• Employment history and curriculum vitae.
• Qualifications and training information.
• References.
• Right-to-work information.
• Information required for safer-recruitment checks.
• Professional-registration information where applicable.
• Other information reasonably required for recruitment or employment purposes.

Recruitment information is processed only for appropriate recruitment, employment, safeguarding, legal and organisational purposes.

Website, cookies and digital information

When somebody visits our website, certain technical information may be processed automatically by the website platform and technologies used to operate, secure or understand use of the website.

Depending on the configuration of the website, this may include information such as:

• Device or browser information.
• Internet Protocol information.
• Pages visited and interactions with the website.
• Approximate technical or location information.
• Cookie and similar technology information.

Some technologies may be necessary for the website to operate, while others may depend on consent or user choices.

Further information should be read alongside our Cookies information .

Retention and information security

How long we keep information

Personal information is not intended to be kept indefinitely simply because it has been collected.

Retention periods depend on factors such as the nature of the record, the purpose for which it is held, legal or regulatory requirements, contractual obligations, safeguarding considerations and the need to establish or defend legal claims.

Records are reviewed and retained or securely disposed of in accordance with applicable organisational retention arrangements.

Protecting information

We use organisational and technical measures intended to protect personal information against unauthorised access, loss, misuse, alteration or inappropriate disclosure.

Measures may include appropriate access controls, staff responsibilities, confidentiality requirements, information-security procedures, secure systems, training, incident management and oversight of relevant service providers.

International data transfers

Some technology or service providers may process information outside the United Kingdom.

Where personal information is transferred internationally, we seek to ensure that an appropriate lawful transfer mechanism or other protection required by applicable data-protection law is in place.

Your data-protection rights

Depending on the circumstances and the applicable law, individuals may have rights concerning their personal information.

These may include the right to:

• Be informed about how personal information is used.
• Request access to personal information.
• Ask for inaccurate information to be corrected.
• Request deletion of information in circumstances where the right applies.
• Request restriction of processing in certain circumstances.
• Object to certain types of processing.
• Receive certain information in a portable format where data portability applies.
• Withdraw consent where processing is based on consent.
• Raise concerns about the handling of personal information.

These rights are not absolute in every circumstance. Legal exemptions or other obligations may affect whether and how a request can be fulfilled.

Information about other people

If you provide us with personal information about another person, you should ensure that you are authorised to provide that information or that another appropriate lawful basis applies.

This is particularly important when information relates to health, care needs, safeguarding or other sensitive matters.

Links to other websites

Our website may contain links to websites operated by other organisations.

Earlston & Doune is not responsible for the privacy practices of independent third-party websites. Visitors should review the privacy information provided by the relevant organisation.

Changes to this Privacy Policy

We may update this Privacy Policy when our services, legal obligations, technologies or data-processing practices change.

The latest version should be published on this website with an updated review date where appropriate.

Questions, concerns and complaints

If you have a question about this policy, want to exercise a data-protection right or have concerns about how we have handled personal information, please contact us.

Earlston & Doune Care Services Ltd
City of Edinburgh
EH15 3EU
Scotland

Telephone: 07432 362561

Email: info@earlstondoune.co.uk

Individuals may also have the right to complain to the UK's independent data-protection regulator, the Information Commissioner's Office, where they are dissatisfied with the handling of their personal data.