Home care in Wolverhampton and surrounding areas
Privacy Policy
This policy explains what personal information we hold, why we hold it, who we share it with, and the choices and rights you have.
- Confidential by defaultWe share information about you only when you agree, the law requires it, or the public interest outweighs confidentiality.
- Never soldWe do not sell personal information, and we do not use care records for marketing.
- Your rightsYou can ask to see, correct or delete your information. See section 12.
Last updated 10 October 2026
Section 1Who we are
Lifetouch Care is a home care provider based in Wolverhampton, registered with the Care Quality Commission (CQC). Lifetouch Care is the trading name of Lifetouch Ltd. We decide how and why personal information is used in our work, which makes us the data controller under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
This policy explains how we collect, use, store, share and protect personal information about the people we support, their relatives and representatives, our staff and volunteers, and anyone who contacts us or uses our website. We know that the information we hold is deeply personal, and we treat it with respect and in confidence.
We are registered with the Information Commissioner’s Office (ICO), registration number ZB716383. Our registered office is 36 Windmill Lane, Wolverhampton, WV3 8HG. Our Data Protection Lead is Jacob Punnoose and our Caldicott Guardian is Namitha Jacob. Each year we complete the NHS Data Security and Protection Toolkit, and our 2025 to 2026 assessment was published as “Standards Met”.
Alongside the UK GDPR and the Data Protection Act 2018, we follow the Health and Social Care Act 2008 and 2012, the Mental Capacity Act 2005, the common law duty of confidentiality and the NHS Records Management Code of Practice.
Section 2People we support
What information we hold
To give you safe and personal care, we keep accurate records about you. They include:
About you
- Name, address, date of birth and contact details
- Your GP and other professionals involved in your care
- Your next of kin, and anyone who can act for you legally
- How your care is funded
About your care
- Physical and mental health information and medical history
- Care needs, assessments, risk assessments and care plans
- Daily notes, medication records and incident records
- Your wishes and preferences
Sensitive details
- Information about your race, ethnic origin, religion or sexual orientation, where it matters to your care
- Information from health professionals, local authorities and family members
Why we use it and our legal basis
We use your information because we need it to provide and manage your care. Health and social care information is known as special category data and has extra protection under the law.
| What we use it for | Our legal basis |
|---|---|
| Planning, delivering and reviewing your care | Our contract, or steps before a contract, with you or the person funding your care. For health information, the provision and management of health or social care. |
| Meeting our legal duties, including those set by health and social care law and the CQC | Legal obligation |
| Keeping people safe, including safeguarding adults and children at risk | Legal obligation, and substantial public interest in protecting people at risk |
| Sharing information with the health and social care professionals involved in your care | The provision and management of health or social care, together with your consent or the law, as explained below |
| Billing and managing how your care is funded | Our contract, and our legitimate interest in running our service |
| Handling complaints and defending legal claims | Our legitimate interests, and the establishment or defence of legal claims |
| Anything else that needs your permission | Your explicit consent, which you can withdraw at any time |
Confidentiality
We follow the common law duty of confidentiality. This means we use or share your information only if you have agreed, if the law requires it, or if the public interest in sharing outweighs your right to confidentiality. Examples include:
- safeguarding concerns, where someone may be at risk of harm
- preventing or detecting a serious crime
- sharing information with health professionals who are involved in your care
- complying with a court order or other legal duty
If you may not be able to make a decision about your information yourself, we follow the Mental Capacity Act 2005 and act in your best interests, involving the people the law says we should.
Section 3Relatives, friends and representatives
We hold the details of relatives, friends and representatives of the people we support, and emergency contacts for our staff. This can include their name and contact details, their relationship to the person, and details of any Lasting Power of Attorney or deputyship.
We use this information because we have a legitimate interest in knowing who to contact in an emergency and who has legal authority to act for someone. If you have given us your details as a contact, you can ask us to see them or to update or remove them at any time.
Section 4Staff and volunteers
To employ and support our staff, we hold names, addresses, contact details, dates of birth, National Insurance numbers, payroll and tax details, pension details, training and supervision records, performance and appraisal records, absence and leave records, and emergency contacts. We hold limited health information where we need it, such as fit notes or information for statutory pay.
We use this information to meet our legal duties as an employer, to carry out employment contracts, to meet regulatory requirements and for our legitimate interest in managing our workforce safely. When we check criminal records through the Disclosure and Barring Service (DBS), we record that we have carried out the check and its outcome, but we do not keep the DBS information once we have seen it.
We share staff information where we need to with HMRC, pension and healthcare providers, our payroll provider, the CQC, safeguarding teams and, where the law requires it, the police.
If you are applying for a job with us, our Candidate Privacy Policy explains how we handle your application.
Section 5Where we get information from
Most of the information we hold comes from you or from the person acting for you. We also receive information from:
- doctors, hospitals, pharmacies and community health teams
- local authorities, social workers and other commissioners of care
- relatives, friends and representatives
- previous employers, referees and the DBS, for people applying to work with us
- HMRC and pension providers, for our staff
We collect information face to face, by phone, by email, by post, through our website and through the digital systems we use to record care.
Section 7National Data Opt-Out
The national data opt-out lets people choose not to have their confidential patient information used for research and planning. We review every way we use data each year to check whether the opt-out applies. At this time, we do not share any data for planning or research purposes to which the national data opt-out would apply.
If that changes, we will assess everything affected, check opt-out status through the NHS MESH service, update this policy and tell the people we support about their rights. You can read more at nhs.uk/your-nhs-data-matters.
Section 8Automated decisions
We do not make decisions about your care, or about an application to work with us, solely by automated means. Our digital systems help our staff to keep records and plan visits, but trained people make the decisions that affect you. If you think a decision about you was made unfairly, you can ask for it to be reviewed by a person.
Section 9Our website
When you use our website, we may collect your IP address, the details you put into a contact form or an online application, and information from cookies. We use this to make the website work, to answer your enquiries and to understand how it is used. You can read how we use cookies, and how to change your choices, in our Cookie Policy.
We do not use the information in care records for marketing. Where we send you anything other than a reply to your enquiry, we will only do so if you have agreed, and you can say no at any time.
Section 10Storage and security
We store your information securely, in line with the NHS Records Management Code of Practice. We protect it with:
- encrypted digital systems
- secure servers and access controls, so only staff who need the information can see it
- locked storage for any paper records
- audit logs and monitoring
- training in confidentiality and data protection for all staff
Our care management system, Nurse Buddy, stores data on Amazon Web Services servers in Ireland and Germany. The UK treats countries in the European Economic Area as providing an adequate level of data protection. If we ever needed to send information anywhere else, we would first make sure the law’s safeguards were in place.
When we no longer need information, we dispose of it securely. We shred paper records with a cross-cut shredder, and we delete or wipe digital records to a legal standard of destruction.
Section 11How long we keep it
We keep information only for as long as we need it for the purposes in this policy, or for as long as the law requires.
| Information | How long we keep it |
|---|---|
| Care records of the people we support | For the period the NHS Records Management Code of Practice sets for each type of record. We can tell you the period that applies to your records if you ask us. |
| Staff records | For the length of employment and afterwards for the time that employment, tax and pension law requires. |
| DBS information | We do not keep it once we have seen it. We keep a record that the check was done and its outcome. |
| Enquiries and website messages | For as long as we need them to deal with your enquiry, and then they are deleted. |
| Job applications | As set out in our Candidate Privacy Policy. |
Section 12Your rights
Under data protection law you have the right to:
- ask for a copy of the information we hold about you, which we do not normally charge for
- ask us to correct information that is wrong or incomplete
- ask us to delete information we no longer need to keep
- ask us to restrict how we use your information while we look into a concern
- object to us using your information in certain circumstances
- withdraw your consent at any time, where we rely on it
We will answer your request as soon as we can and within one month at the latest. We may need to check who you are first. These rights are not absolute, so we may sometimes have to refuse a request, for example where the law requires us to keep a record. If we do, we will explain why. To make a request, use the details in section 15.
Section 13Data breaches
If personal information is lost, shared by mistake or accessed without permission, we act quickly to contain the problem and put it right. We keep a record of every incident. If a breach is likely to put people’s rights at risk, we report it to the ICO within 72 hours, and where the risk is high we tell the people affected without delay.
Section 14Changes to this policy
We review this policy at least once a year, and sooner if the law or the way we use information changes. The date at the top of this page shows when it was last updated. The next scheduled review is in August 2027.
Section 15Contact and complaints
If you have a question about this policy, or want to use your rights, contact our Data Protection Lead, Jacob Punnoose.
If you are not happy with how we have handled your information, you have the right to complain to the Information Commissioner’s Office (ICO). Its address is Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, its helpline is 0303 123 1113 and its website is ico.org.uk. We would like the chance to put things right first, so please contact us if you can.
