Privacy notice - Collection of information in response to COVID-19
Privacy notice for care customers - Collecting and retaining personal information.
Collection of information in response to COVID-19
Loretto Care trading as Wheatley Care (Wheatley Care) is a charitable care and support provider. We are members of Wheatley Group, Scotland's leading housing, care and property-management group.
Wheatley Care will be the 'data controller' of the personal information you provide to us. This privacy notice is to provide you with more information about how Wheatley Care is collecting information about you in relation to our response to the COVID-19 pandemic.
We may collect and process your personal data which is above and beyond what we would ordinarily collect in order to ensure your safety and the well-being of our employees, contractors, care home residents and People We Work For (PWWF).
Such information will be limited to what is proportionate and necessary, taking into account the latest guidance issued by the Government, the Information Commissioner’s Office and health professionals, in order to manage and contain coronavirus transmission. It will enable us to effectively fulfil our functions and to keep people safe, put contingency plans into place to safeguard those vulnerable and aid business continuity.
Our Data Protection Officer is Ranald Brown who can be contacted on #firstname.lastname@example.org.
What we need
We will collect details about your health in order protect the health of our employees and contractors who may have to visit your home to provide an essential service. If you live in one of our residential care services we may also use your information to facilitate testing for COVID-19 and on-site vaccination by NHS staff.
How we collect your personal data?
We may receive this information from you or from a third party.
How we will use the information we hold about you?
We will use the information you provide to:
- protect the health of our employees who may require to visit your home to provide an essential service or support to you in the community or other setting;
- facilitate COVID-19 testing if you live in one of our residential care services and
- facilitate on-site COVID-19 vaccination if you live in one of our residential care services.
COVID-19 testing for registered care home residents
If you are a resident of a registered care home we will use your information to facilitate COVID-19 testing. This involves sharing limited personal data (name, address, date of birth) with NHS Scotland. Testing is entirely voluntary and you do not have to participate if you do not wish to. However, testing will contribute to the safety of all staff and residents.
The Care Manager at our care homes may have access to COVID-19 test results in order to ensure the health and safety of residents and staff in the event of a confirmed virus case on the premises.
You can find more information about how our partners manage your personal information relating to testing for COVID-19 at https://www.informationgovernance.scot.nhs.uk/testing-for-covid19-privacy-information/
COVID-19 vaccination for registered care home residents
If you are a resident of a registered care home we will use your information to facilitate on-site COVID-19 vaccination. This involves sharing limited personal data as follows with NHS Scotland:
- date of birth;
- CHI number;
- GP name;
- details of any allergies;
- capacity (Power of Attorney; Guardianship Order).
The vaccination is entirely voluntary and you do not have to participate if you do not wish to. However, vaccination will contribute to the safety of all staff and residents.
Why we need your personal information
Personal data required for our response to the COVID-19 emergency is processed under our legitimate interest in order to protect the health and safety of our staff and contractors, our residents and visitors to our sites. Special category data, such as health information, requires an additional condition for processing. In this case processing is necessary for “reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health.” The current pandemic being an example of such a situation.
Who we will share your information with?
We will normally only share your information with other partner organisations as part of the response to the COVID-19 outbreak.
We will not share your information with anyone else unless required to do so under additional legal requirements, for example to assist the government in containing the spread of COVID-19. This may be where we are required to do so by law, to safeguard public safety, and in risk of harm or emergency situations.
We share information with NHS Scotland, the local authority and the Scottish Government in order to support the COVID-19 testing and vaccination programme.
In our registered care homes the Care Manager may have to inform residents and staff in the event of a positive test in line with our duty to ensure the health and safety of employees and residents. However, where possible they will avoid naming individuals and will not provide more information than is absolutely necessary.
We will also share limited personal data with our contractors who are carrying out services on our behalf.
Our contractors are required to comply with the law and our own Data Processing Agreement or Data Processing Clauses within our contracts to ensure data is managed appropriately and for specified purposes.
We may transfer information about you to other Wheatley Group companies for purposes connected with the protection of staff and our customers and the management of the company’s business.
Any information which is shared will only be shared on a need to know basis, with appropriate individuals. Only the minimum information for the purpose will be shared.
How we protect your personal information
Your personal information is stored on our paper and IT filing systems which may be copied for testing, backup, archiving and disaster recovery purposes. Access to your information is limited to those who require it to provide services to you. All data is held within the European Union (EU).
If any of your personal information is transferred out with the European Union or the European Economic Area by any of our contractors, we will ensure there are adequate safeguards in place to protect your personal information in accordance with the UK General Data Protection Regulations and applicable UK Data Protection Legislation.
How long we keep your personal information
We will only keep your information for as long as it necessary, taking into account of Government advice and the on-going risk presented by COVID-19. At a minimum the information outlined in this privacy notice will be kept for the duration of the COVID-19 response.
Information provided in relation to this outbreak of COVID-19 will not be used for any other purpose, including to be held within files ‘just in case’ it may be needed again.
When the information is no longer needed for this purpose, it will be securely deleted.
You can exercise any of the following rights by writing to us at InformationRequests@wheatley-group.com
Your rights in relation to your personal information are:
- you have a right to request access to the personal information that we hold about you by making a "subject access request";
- if you believe that any of your personal information is inaccurate or incomplete, you have a right to request that we correct or complete your personal information;
- you have a right to request that we restrict the processing of your personal information for specific purposes; and
- if you wish us to delete your personal information, you may request that we do so.
Any requests received will be considered under applicable UK Data Protection Legislation. If you remain dissatisfied, you have a right to raise a complaint with the Information Commissioner's Office at www.ico.org.uk
We seek to ensure that our information collection and processing is always proportionate. The accuracy of our information is important to us - please help us keep our records updated by informing us of any changes to your personal information.
Changes to our Privacy Notice
This Privacy Notice is regularly kept up to date and this version was updated on 8 January 2021.