Care and Support Services: Privacy Notice
This privacy notice explains how we collect and use your personal information and who we share it with.
It applies to information about customers of our care and support services.
It explains why we process your personal data and the legal basis for the processing (‘processing’ includes us just keeping your personal information). It also explains the choices you have about the data we hold about you.
We make sure our privacy notice is kept up to date. You can find the latest version on our website (www.peabody.org.uk). If you would like a hard copy, please ask your scheme manager who will be able to provide you with one.
- Who we are
- How we collect your information
- How we use your personal information and the legal basis for processing
- What legal basis do we rely on to process your data
- Sharing your personal information
- Keeping your personal information
- Your privacy rights
Peabody is the data controller whose head office is located at 45 Westminster Bridge Road, London SE1 7JB.
We own and manage more than 55,000 homes across London and the South East, housing over 111,000 residents. We also have 8,000 care and support customers. Our mission is to help people make the most of their lives by providing good quality affordable homes, working with communities and promoting wellbeing.
If you would like to find out more about how we use your personal information, you can contact the Group Data Protection Officer at DPO@peabody.org.uk.
We collect most of our information directly from you, including when you use one of our services, complete one of our forms, when you write, email or meet with us.
We also collect information from other third parties where is it relevant to the service we are providing you. This includes:
- Local authorities, health and social care professionals, previous care providers – for information about your health, care and support needs, and those of your household (including your children)
- Other service providers where we are working in partnership with them
To understand your care and support needs and to deliver the right kind of service to you
As a provider of care and support services, we need data about your health and social care to deliver our services and to safely meet your assessed needs.
To keep individuals safe and make sure no one is at risk of harm
We have a legal duty to safeguard individuals; as well as processing data about your health and social care needs, we may also process information about:
- anti-social behaviour;
- financial circumstances (including debts and benefits received);
- housing history (eviction and arrears); and
- risky behaviours (including drug/alcohol misuse and aggression)
We also hold information about criminal activity and convictions
To contact you about your service
We use your contact details (including telephone numbers and email addresses) to get in touch with you about issues relating to the service we have agreed to provide you.
We may pass your details on to our vetted contractors that provide services on our behalf, so that they can contact you. For example, if you are working with our Home Improvement Agency to have adjustments made to your home.
To monitor equality, diversity and inclusion
We may ask you to provide us with your diversity data (ethnicity, religion, sexual orientation). This information is not used to inform any decisions we make about you individually, but is gathered for statistical purposes to help us understand who is using our services. It helps us ensure fairness and equality in the services we provide. You do not have to provide this information but it helps us if you choose to do so.
The law requires us to tell you the basis on which we process your data.
To provide health and social care treatment
We process your information so that we can provide the service we have been asked to provide.
Necessary in the performance of a contract
Some of our processing is carried out to fulfil a contract or an agreement we have with you. Where we require information because it is necessary in the performance of a contract you will not be able to opt out of providing this information. This is because without it we would be unable to do the thing you have asked us to do.
To fulfil our legal and regulatory obligations (substantial public interest)
Some of our processing is carried out to ensure we fulfil our legal and regulatory obligations in providing care and support services, for example under the:
- Care Act 2014;
- Health and Social Care Act 2008 (regulated activities) Regulations 2014
- Mental Capacity Act 2005.
- Mental Health Act 1983
(This is not an exhaustive list)
We must also comply with the Care Quality Commissions standards for quality and safety.
In some instances, we may ask for your consent to process your information. Where this is the case it will be detailed on the individual privacy notices attached to the service.
Where it is necessary for our legitimate interests
In all other cases, we rely on a condition called “legitimate interests”. The law allows us to process your data if it is in our legitimate interests to do so. But we can only do this if:
- it does not disproportionately affect your privacy rights;
- it doesn’t cause you any harm; and
- it isn’t overly intrusive.
The law also says we must let you know what we consider our legitimate interests to be. Our legitimate interests are:
- ensuring that our services meet the needs of our customers;
- ensuring that we make the most efficient use of our resources and we understand how we are performing;
- ensuring we provide a safe service; and
- ensuring we understand our customers’ experiences and views
If you think that anything we do with your data affects you adversely, you can ask us to stop processing it.
If we are working with other organisations or services to support you, we may have to share information with them. We only do this if we have a good reason to and it is necessary for delivering the agreed support. You can object to us sharing your information but this might mean that you don’t get all the services you need.
Where we are providing care and support services as part of a local authority contract, we may share your information with the commissioning local authority or NHS health trust. You can object to us sharing your information but this might mean that you don’t get all the services you need.
Sometimes we might have to share information with authorities if we think that you or someone else is at serious risk of abuse or harm. We don’t need your consent to do this.
Where necessary, we share information across subsidiaries in the Peabody Group, to make sure that you are receiving all the services that are available to you.
We also share some information with our data processors, which are organisations that carry out a service on our behalf, for example IT providers. We only share information which is necessary for them to carry out the service they have been contracted to provide. All our contractors operate under the terms and conditions of a legally enforceable contract and will not use your information for anything other than carrying out a service on behalf of Peabody.
Other organisations we may share your information with include:
- Government departments
- Police and other law enforcement agencies
- MPs and Councillors acting on your behalf
- Care Quality Commission
How long we keep your personal data for can depend on the type of data it is. We will never keep your information for any longer than is necessary for the purposes we need to use it for. The basic health and social care retention period is 8 years after the end of service or 8 years after the last time a customer was seen.
You have several rights which allow you to choose and control how we use your data. These rights are explained below. If you would like to use these rights, please put your request in writing and send them to your support service manager. Alternatively, you can send them to DPO@peabody.org.uk.
Transparency: You have the right to be informed about how we are using your data. If you think we are doing something with your information that we have not told you about in this Privacy Notice, you can object to this.
Access: You have the right to ask us what personal information we hold about you, and to request a copy, free of charge. Please note if we consider that the request is manifestly unfounded, excessive, or repetitive, we can charge a reasonable fee. This fee will be based on the administrative cost of providing the information.
Objection: You can object to the processing of your personal data. You should note that this right does not apply in all circumstances, for example, where we are processing information because it is necessary in the performance of contract we will not be able to stop processing this information.
Withdrawal of consent: if we are processing your data based on your consent, you can withdraw this consent at any time. Where this is the case we may no longer be able to provide the relevant service to you.
Rectification: If you think that the personal data we hold about you is inaccurate or incomplete, you have a right to request that it be rectified.
Erasure: You can ask us to delete your personal data where it is no longer necessary for us to use it, where you have withdrawn consent (if we process based on consent), or where we have no lawful basis for keeping it.
Restriction: You can ask us to restrict the personal data we use about you where you have asked for it to be erased or where you have objected to our use of it.
Data portability: You can ask us to provide you, or a third party (if possible), with some of the personal data we hold about you in a structured, commonly used, electronic form, so that it can be easily transferred.
Appeal: If you are not satisfied with the way that we have dealt with your personal data, please let us know and we will try and resolve your concerns. Please contact your scheme manager in the first instance, or the person who is dealing with the issue. If you are not satisfied with the outcome, you can make a formal complaint through our website.
If you are still not happy with our response, you have the right to appeal directly to the regulator – the Information Commissioners’ Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Visit: https://ico.org.uk or telephone: 0303 123 1113.