Scope of Our Privacy & Data Protection Responsibilities
Data Controller
Alex C&C Healthcare Ltd (Company No. 12394396) acts as the Data Controller for all personal data processed within our health and social care operations. Registered office: 20 Broad St, Bristol BS16 5NX. We are committed to protecting the privacy of our service users, their families, and our workforce in accordance with the UK GDPR and Data Protection Act 2018.
Who This Privacy Notice Applies To
We process personal data belonging to various groups of individuals across our care operations. This notice applies to you if you fall into any of the following categories.
People Receiving or Considering Care
- Individuals receiving healthcare and support in their own homes.
- Prospective service users undergoing health assessments or initial care enquiries.
- Emergency contacts identified in care plans.
Families, Friends and Representatives
- Next of kin, family members, and unpaid carers.
- Legal representatives, including those with Lasting Power of Attorney.
- Individuals who attend meetings or provide feedback on behalf of a service user.
- Please Note: If you provide us with personal data about another person, you must ensure you have the legal right to do so.
Professionals and Partner Organisations
- Healthcare professionals (GPs, nurses, social workers) sharing data for clinical care.
- Suppliers and agency partners providing support services.
- Regulatory and local authority contacts (CQC, NHS England, Bristol City Council).
Employees, Workers and Applicants
- Current and former members of staff, including nursing and care personnel.
- Consultants, contractors, and temporary agency workers.
- Job applicants and individuals undergoing pre-employment screening (DBS, references).
Learners and Training Contacts
- Individuals enrolled in Alex C&C healthcare training programmes.
- Sponsors and awarding bodies involved in professional certifications.
- Academic partners monitoring clinical placements.
Website Visitors and Other Contacts
- Users who visit alexcchealthcare.com and interact with our tools.
- Individuals who subscribe to our newsletters or clinical updates.
- General enquirers contacting our head office.
- Our services are not intended for children, and we do not knowingly collect data from individuals under 18 unless they are identified as dependents within a care package.
Privacy at a Glance
Identity Data
Full name, date of birth, gender, marital status, and government-issued identifiers including NHS Number.
Clinical Data
Health conditions, medication records, allergies, care plans, and daily support logs from healthcare professionals.
Financial Data
Invoicing details, bank accounts, payment history, and funding source information (NHS/Local Authority/Private).
Recruitment Data
Employment history, training certificates, DBS clearance, references, and professional qualifications for care staff.
Where Personal Information Comes From
We may receive personal information directly from the person concerned or from another appropriate and authorised source.
The individual; Family members; Friends involved in care; Informal carers
Emergency contacts; Attorneys; Deputies; Advocates; Representatives
Professional referrers; NHS organisations; Local authorities; Commissioners and brokerage teams
Hospitals; GPs; Nurses; Therapists; Pharmacies; Hospices; Emergency services
Safeguarding authorities; Employers; Training sponsors; Referees
DBS and right-to-work services; Website forms; Uploaded documents; Cookies and website logs
Care records; Digital care and workforce systems; Complaints; Incidents
Safeguarding processes; Publicly available sources where lawful and relevant
A professional or representative providing information about another person must have appropriate authority or another lawful basis to provide it. Alex C&C Healthcare Ltd remains responsible for how it receives, uses, protects and retains that information.
Keeping Personal Information Accurate
Alex C&C Healthcare Ltd takes reasonable steps to ensure that personal information is accurate, complete where necessary and kept appropriately up to date.
Updating Information
Service users, representatives, workers, applicants, learners and other individuals should tell us where relevant contact, care, employment or other information has changed.
Correcting Records
If a person believes that information is inaccurate or incomplete, they may ask us to review and correct it. In some circumstances, the original record may need to remain available with an amendment, clarification or supplementary statement rather than being deleted.
Care and Professional Records
Care and professional records should clearly distinguish between direct observations, information reported by another person, professional opinion, allegations and established findings.
Why We Process Your Data
We only use your personal information when the law allows us to. Broadly, we rely on the following legal bases to provide safe healthcare services.
Contractual Necessity
Where processing is necessary to provide the services you have requested or to fulfill our obligations under our care agreement with you.
Legal Obligation
Where we are required by law to process your data, such as for CQC regulatory compliance, tax purposes, or health and safety regulations.
Care, Family, Capacity and Safeguarding
Care Records
Care workers and authorised staff create accurate, respectful and timely care records. These may include visit times, property access, support offered, support completed or declined, personal care, continence, nutrition, hydration, mobility, medication support, changes in presentation, professional instructions, incidents and emergency action.
Families, Friends and Representatives
Family members, friends and representatives may provide information, receive agreed updates, support decision-making, raise concerns or participate in reviews. Their personal information may appear within care, communication, complaint or safeguarding records. Being a family member, friend or next of kin does not automatically provide unrestricted authority to access information or make decisions.
Mental Capacity and Legal Authority
Mental capacity is decision-specific and may fluctuate. People should be supported to make their own decisions wherever reasonably possible. Where another person claims authority, Alex C&C Healthcare Ltd may need to verify a power of attorney, deputyship, advocacy role or another legal arrangement.
Care Photographs and Body Maps
Body maps and images may be used where necessary for skin monitoring, wounds, bruising, injury, swelling, equipment concerns, incident evidence or safeguarding. Staff should consider whether a written description or body map is sufficient before taking an image. Care images form part of the confidential care or incident record and must not be reused for marketing without a separate lawful basis and appropriate consent.
Safeguarding
Safeguarding information may concern abuse, neglect, self-neglect, domestic abuse, coercive control, exploitation, financial abuse, organisational abuse, medication interference, modern slavery, serious misconduct or criminal conduct. Information may be shared where necessary to protect a person, prevent harm, support a safeguarding enquiry, preserve evidence or meet legal and regulatory responsibilities.
Emergencies and End-of-Life Care
In an emergency, information reasonably necessary to protect life, obtain urgent assistance or prevent serious harm may be shared with appropriate services. Care records may also include palliative and end-of-life needs, emergency plans, family contacts, professional arrangements and relevant wishes.
Recruitment, Workforce and Training Privacy
Job Applicants and Prospective Workers
We may use personal information to consider applications, communicate with candidates, verify identity, check right to work, review qualifications, obtain references, complete DBS-related processes where applicable, review driving information where relevant, consider reasonable adjustments and assess suitability for a role.
- Application forms
- CVs
- Employment history
- Qualifications
- References
- Identity information
- Right-to-work information
- Visa information
- DBS information
- Driving and vehicle information
- Interview notes
- Reasonable adjustments
Core recruitment processing will normally rely on an appropriate lawful basis and should not be treated as optional consent where another lawful basis applies.
Employees and Other Workers
Workforce information may be used to manage employment and working arrangements, rotas, payroll, pensions, mileage, training, competency, supervision, attendance, sickness, occupational health, reasonable adjustments, performance, conduct, complaints, safeguarding, grievances, disciplinary matters, whistleblowing, termination and legal claims.
Access to health information should be limited. Managers should ordinarily receive information about the effect on work and required adjustments rather than unnecessary diagnostic detail.
Learners and Training Contacts
Training information may be used to manage enquiries, bookings, payments, attendance, assessments, competency evidence, certificates, reasonable adjustments, feedback, complaints and approved recordings. Where an employer funds training, learners should be told what attendance or assessment information may be provided to that employer. Training recordings must not automatically be reused for marketing or future commercial training.
Website Forms and Uploaded Documents
The website may contain forms for general enquiries, care enquiries, professional referrals, recruitment, training, complaints, feedback, data-rights requests and data-protection complaints.
We will use the information submitted through this form to process and respond to your request. Some forms may collect sensitive care, health, safeguarding, recruitment or identity information. Please provide only information that is relevant and necessary.
By submitting information concerning another person, you confirm that you are authorised to provide it or otherwise have a lawful basis to do so. Please provide only information relevant and necessary to the proposed care and support.
A Privacy Notice provides information. It is not blanket consent.
- Uploaded files must not be publicly accessible or indexed.
- Access to documents must be restricted to authorised personnel.
- We use controlled file types and malware scanning where available.
- Form responses must not automatically enter marketing lists.
Email, SMS, WhatsApp, Social Media and Online Meetings
Email may be used for enquiries, care coordination, professional communication, recruitment, training, invoices, complaints and data-rights requests. Sensitive information should be minimised and protected appropriately.
SMS
SMS may be used for short operational messages, visit coordination, appointment confirmations, recruitment communication and training reminders. Providing a mobile number does not automatically mean that a person has agreed to receive marketing.
An approved WhatsApp Business account or another approved messaging service may be used for limited enquiries or operational communication.
Do not use WhatsApp for an immediate medical emergency or send unnecessary medical, identity, property-access or safeguarding documents. Relevant messages may be transferred to the appropriate official record.
Social Media
Public social-media comments may be visible to other people. Sensitive care, complaint, employment or safeguarding matters should be moved to an appropriate private communication channel. Relevant messages may be copied into an official care, complaint, safeguarding, employment or legal record where necessary.
Video and Online Meetings
Video or online meetings may be used for assessments, reviews, professional communication, recruitment, training, complaints or management purposes. Participants should receive appropriate information where recording or transcription is used.
Marketing Communications and Your Choices
Alex C&C Healthcare Ltd may occasionally send information about relevant services, training, events, organisational updates or other optional opportunities. We will only send electronic marketing where an appropriate lawful basis applies and where any required permission has been obtained.
Your Choice
Receiving care, applying for work, attending training, submitting an enquiry or providing contact information does not automatically mean that a person has agreed to receive marketing.
Changing Your Preferences
A person may withdraw marketing consent or ask us to stop sending optional promotional communications at any time by using an unsubscribe option or contacting us directly.
Suppression Records
Where a person asks us not to send marketing, we may retain limited information on a suppression list so that the preference can be respected in the future.
Alex C&C Healthcare Ltd shares information with partner organisations involved in your care. This includes the NHS (GPs, District Nurses, and Hospitals) and Local Authorities to ensure safe, coordinated support and effective clinical leadership.
Information Sharing
As a CQC-registered provider, we are legally required to disclose certain data for monitoring, safeguarding, and public health purposes. We maintain strict security protocols to preserve confidentiality during all international and domestic processing.
Recording, Monitoring and Digital Systems
Alex C&C Healthcare Ltd may use approved digital systems to coordinate care, maintain accurate records, verify visits, protect service users and workers, respond to missed care, meet commissioner requirements and support quality assurance.
Electronic Call Monitoring and Visit Verification
Approved systems may record: Scheduled visits; Assigned workers; Addresses; Check-in and check-out; Visit duration; Late or missed visits; Care tasks; Notes; Amendments; Alerts; Audit logs; Mileage; Commissioner evidence; Device information; Location verification where authorised.
Monitoring must not be used to obtain unnecessary information about a worker’s private life.
GPS and Location Information
Location information may be used for visit verification, service-user safety, lone-worker protection, emergency response, route support or authorised mileage. Continuous, background or off-duty tracking must not be activated merely because a system offers that function.
Telephone Calls
Calls are not recorded merely because a telephone system offers that function. Selected calls may only be recorded for a defined and documented purpose: Quality assurance; Accurate instructions; Complaint investigation; Incident investigation; Safeguarding; Threatening communications; Regulatory responsibilities; Legal claims.
Meetings and Transcription
Meetings are not recorded by default. Written minutes should be considered first. Where a meeting is recorded, participants should normally be informed about the purpose, information captured, access, transcription or AI use, retention and reasonable alternatives. Automated transcripts may contain errors, omissions or incorrect speaker attribution and should be checked before reliance.
CCTV and Cameras in Service Users’ Homes
Company-controlled CCTV should only be described as operating where its use has been confirmed. Where CCTV is used, it requires a defined purpose, clear signage, restricted access and an appropriate retention period. Service users and families may operate video doorbells, indoor cameras, audio devices or monitoring sensors. Where Alex C&C Healthcare Ltd receives, downloads, stores or uses a copy of footage, the company becomes responsible for its own copy.
Body-Worn/ Mobile Phone Video
Alex C&C Healthcare Ltd does not routinely record care visits. Recording may only be used in exceptional and serious circumstances where it is necessary to protect safety, address safeguarding concerns or preserve important evidence. It must be proportionate, handled securely and must not normally take place during personal or intimate care.
Artificial Intelligence and Digital Technology
Approved artificial-intelligence, transcription, speech-to-text or automated-support tools may be used for limited administrative and operational purposes.
Draft minutes
Authorised transcription
Document organisation
Missing-field checks
Translation
Rota support
Alerts
Quality checks
Website enquiries
Draft communications
Artificial intelligence does not replace the professional judgement or accountability of our managers, coordinators or care workers.
Any AI-supported output capable of affecting care, safeguarding, recruitment, employment, complaints, disciplinary action or legal rights must be reviewed by a competent and authorised person.
Staff must not enter identifiable care, health, safeguarding, employment, identity, password, key-safe, property-access or confidential business information into an AI system that has not been formally approved.
Approved technology should be assessed for: Purpose; Lawful basis; Sensitive-data conditions; Data minimisation; Removal of identifiers; Model training; Retention; Hosting; Security; Sub-processors; International transfers; Accuracy; Bias; Explainability; Human review; Deletion; Data-protection impact.
AI-generated content may be inaccurate and is not automatically an authoritative record. Do not name a specific AI provider as formally approved unless this has been confirmed by Alex C&C Healthcare Ltd.
Photography, Video and Testimonials
Care-Related Images
Photographs and body maps may be used where necessary to support care, monitor skin integrity, document wounds or injuries, record equipment concerns, investigate incidents or support safeguarding. Care-related images form part of the confidential care or incident record. They must be handled securely and must not automatically be reused for publicity, marketing or social media.
Publicity and Testimonials
Service users, representatives, workers or learners may sometimes be invited to provide a testimonial, photograph, video, audio recording, interview or case study. Participation is voluntary. Refusing to participate will not affect care, employment, recruitment, training, complaints or any other service. Publicity and testimonial material must only be used for clearly explained purposes and with an appropriate lawful basis and specific consent where required. Consent for publicity must be separate from consent to care, employment or training. A person may withdraw consent for future use, although information already lawfully published or distributed may not always be fully recoverable.
Personal Data Breaches and Security Incidents
A personal data breach may involve personal information being lost, destroyed, altered, disclosed without authority, accessed by an unauthorised person or becoming unavailable when it is needed.
Reporting and Containment
Suspected incidents should be reported promptly so that Alex C&C Healthcare Ltd can contain the issue, preserve relevant evidence, protect affected people and restore secure access where necessary.
Assessment
We assess the type of information involved, the people affected, the possible consequences, the likelihood of harm and the measures available to reduce risk.
Notification
Where the law requires it, we will report a qualifying personal data breach to the Information Commissioner’s Office within the applicable timescale. Where a breach is likely to create a high risk to an individual’s rights and freedoms, we will also communicate appropriate information to the affected person unless a lawful exception applies.
Learning and Improvement
We document security incidents, actions taken, decisions made and lessons learned. Where appropriate, we update systems, procedures, training or access controls to reduce the risk of recurrence.
Anyone who believes that personal information has been sent to the wrong person, lost, accessed without permission or otherwise compromised should contact our Privacy and Data Protection Lead promptly.
Security and Confidentiality
We employ enterprise-grade technical and organisational measures to protect your health records. This includes encrypted mobile devices for care staff, secure cloud-based planning systems, and rigorous access controls. Our staff undergo comprehensive training in data confidentiality and the Data Security and Protection Toolkit (DSPT) standards.
Data Retention Periods
Alex C&C Healthcare Ltd adheres to the Records Management Code of Practice for Health and Social Care. Adult care records are typically retained for 8 years after the last entry or 10 years after death if applicable. Recruitment records are kept for 6 years post-employment. All data is destroyed through secure, audited processes at the end of its retention lifecycle.
Your Individual Rights
Under the UK GDPR, you have significant rights regarding your personal information. This data request portal allows you to securely exercise these rights at any time.
International Processing & Security
We ensure your data is protected with the highest security standards, whether processed locally or through cross-border services. Your privacy remains our priority across all digital touchpoints.
International Transfers
Data is primarily stored in the UK. Any international transfers utilize standard contractual clauses and rigorous security assessments to ensure UK GDPR compliance.
Cookie Choices
We use essential cookies for site functionality. Analytics cookies are only active with your explicit consent. You can manage your preferences at any time via our cookie banner.
Web Security
Our site uses SSL encryption and firewalls to protect data submitted via forms. We maintain strict access controls and regular security audits to prevent unauthorized access.
Read or Download Our Complete Policy
This Privacy and Data Protection Centre provides an accessible overview of how Alex C&C Healthcare Ltd handles personal information throughout the organisation. Our complete Privacy, Data Protection and Information Governance Policy provides further detail about care delivery, family and professional information, workforce information, recruitment, training, website services, communications, recording, monitoring, safeguarding, artificial intelligence, information sharing, security, records management, retention and organisational accountability.
Alternative formats may be requested by contacting our Privacy and Data Protection Lead.
Alex C&C Healthcare Ltd
Privacy and Data Protection Lead
20 Broad Street
Staple Hill
Bristol
BS16 5NX
Email: info@alexcchealthcare.com
Telephone: 0117 235 6961
Privacy Complaints
If you are not satisfied with our response or believe we are not processing your personal data in accordance with the law, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO).
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Website: www.ico.org.uk