Last updated: [DATE]
1. Who we are
This website is operated by [FULL LEGAL COMPANY NAME] Ltd, company number [COMPANY NUMBER], registered in England and Wales at [FULL REGISTERED OFFICE ADDRESS]. We are registered with the Information Commissioner’s Office under number [ICO NUMBER].
AM Wellbeing is a group of separately registered care providers. If you contact us about a particular service, your information passes to that service, and the company below becomes the data controller for it:
| Service | Data controller | Regulator |
|---|---|---|
| Woofferton Residential Care Home, Ludlow | Fidelity Care Services Ltd | CQC, location 1-123567394 |
| Our Care, Wolverhampton (care in your own home) | Our Care Ltd | CQC, location 1-2153634626 |
| AM Nant Y Gaer | [ENTITY] — registration pending | Care Inspectorate Wales |
| Woodlands Care Home | [ENTITY] — registration pending | CQC |
For anything else, [FULL LEGAL COMPANY NAME] Ltd is the controller.
This notice covers people who visit this website, enquire about care, or apply for a job with us. If you or a relative already receive care from us, a separate and fuller notice covers your care records — ask your service manager for a copy.
2. What we collect
If you enquire about care: your name and contact details; the name of the person needing care and your relationship to them; anything you tell us about their care needs or health; and our correspondence with you. You don’t have to tell us about someone’s health to make an initial enquiry.
If you apply for a job: your contact details, CV, employment history and qualifications; right-to-work documents; references; and DBS check results where the role requires one.
If you visit this website: your IP address, device and browser type, and the pages you visit — see section 6.
Some information reaches us from someone other than you: a relative enquiring on your behalf, a local authority or NHS referral, or a referee you have named.
3. Why we use it, and our lawful basis
| Purpose | Lawful basis | Health data condition |
|---|---|---|
| Responding to your enquiry and assessing whether we can meet the person’s needs | Legitimate interests, or steps before a contract | Art. 9(2)(h) — provision of social care |
| Arranging an assessment or visit | Steps before a contract | Art. 9(2)(h) |
| Meeting our duties to CQC, Care Inspectorate Wales and local authorities | Legal obligation | Art. 9(2)(h) |
| Safeguarding adults and children at risk | Legal obligation, or vital interests | Art. 9(2)(h) and 9(2)(c) |
| Recruitment, including right-to-work and DBS checks | Legal obligation; steps before a contract | Art. 9(2)(b) — employment law |
| Handling complaints and concerns | Legal obligation; legitimate interests | Art. 9(2)(h) |
| Keeping the website secure and working | Legitimate interests | — |
| Website analytics, where you agree | Consent | — |
| Marketing, if you ask for it | Consent | — |
Where we rely on legitimate interests, our interest is in responding to people who contact us about care and running our services safely. You can object at any time — see section 8.
We will never use a care enquiry as a marketing list. If you enquire and decide not to proceed, we won’t add you to a mailing list without asking.
Health, disability and care-needs information is special category data under UK GDPR. We rely on the conditions shown above, supported by Schedule 1 Part 1 of the Data Protection Act 2018. Everyone who handles it for us is under a duty of confidentiality.
We do not make decisions about you by automated means, and we do not carry out profiling.
4. Who we share it with
- The service you enquired about, so it can respond
- Local authorities and NHS bodies, where they are commissioning, funding or referring
- Health professionals involved in someone’s care
- The Care Quality Commission and Care Inspectorate Wales, as our regulators
- Local authority safeguarding teams and the police, where we have a duty to raise a concern
- The Local Government and Social Care Ombudsman, or the Public Services Ombudsman for Wales, if a complaint is escalated
- The Disclosure and Barring Service, for pre-employment checks
- Our solicitors, insurers and auditors, where necessary
- Our service providers — hosting, email, care planning and recruitment systems — who act only on our written instructions
We do not sell your information or share it for anyone else’s marketing.
We keep information in the UK where we can. Where a provider stores or accesses it outside the UK, the transfer is protected by UK adequacy regulations or the International Data Transfer Agreement. Ask us for details.
5. How long we keep it
| Information | Retained |
|---|---|
| Enquiries that don’t lead to a service | [12] months from your last contact |
| Care records, where we provide care | 8 years after the person leaves the service or dies (NHS Records Management Code of Practice) |
| Safeguarding records | [6] years after the case closes |
| Complaints | [6] years after the complaint closes |
| Unsuccessful job applications | [6] months from the decision |
| DBS certificate information | Destroyed within 6 months of the decision, per the DBS Code of Practice. We keep only the date and reference of the check. |
| Website analytics | [26] months, if you consented |
We then delete the information securely or anonymise it.
6. Cookies
[WRITE THIS SECTION FROM THE COOKIE AUDIT. The shape below is a placeholder.]
Strictly necessary cookies make the site work and don’t need your consent. Analytics and marketing cookies are only set if you agree — you can accept or reject them when you arrive, and change your mind any time via Cookie Preferences in the footer. Rejecting them won’t affect your ability to use the site or contact us.
Full details are in our Cookie Policy.
7. Keeping it safe
We restrict access to those who need it for their role, encrypt information in transit and at rest, dispose of records securely, train staff in data protection and confidentiality, and hold written contracts with every provider that processes information for us.
If a breach is likely to put your rights at risk, we report it to the ICO within 72 hours and tell you directly where the risk to you is high.
8. Your rights
You have the right to be informed about how we use your information; to access it; to have it corrected; to ask us to delete it (though we cannot delete care records we are legally required to keep); to ask us to restrict or to object to our use of it; to data portability; and to withdraw consent at any time where we rely on it.
To exercise any of these, contact us using section 10. We respond within one calendar month and don’t charge a fee. We may need to confirm your identity, and if you are acting for someone else, evidence of your authority.
9. Complaints
Please tell us first, using section 10, so we can put things right. You can also complain to the Information Commissioner’s Office at any time:
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF · 0303 123 1113 · ico.org.uk/make-a-complaint
If your concern is about the quality or safety of care rather than your information, contact the Care Quality Commission at cqc.org.uk (England) or Care Inspectorate Wales at careinspectorate.wales.
10. Contact us
[DATA PROTECTION LEAD JOB TITLE], [FULL LEGAL COMPANY NAME] Ltd [REGISTERED OFFICE ADDRESS] [dataprotection@amhealthcare.uk] · [GROUP PHONE NUMBER]
For care enquiries, please use the contact details on the relevant service page.
11. Changes
We review this notice at least annually and whenever our services or use of information changes. The date at the top shows the last update. We will tell you directly about any change that materially affects how we use your information.