Privacy policy

Azalea Care Services (“we”, “us”, “our”) is committed to protecting and respecting your privacy. This policy explains what personal information we collect, how we use it, who we share it with, how long we keep it, and the rights you have under UK data protection law.

This policy is written in line with the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (“PECR”). As a regulated home care provider we also follow the data-protection requirements of the Care Quality Commission (CQC).

1. Who we are

Azalea Care Services is the data controller for the personal information described in this policy.

• Registered office: Ciba Building Suite 203i, 146 Hagley Road, Birmingham, Edgbaston, England, B16 9NX
• Email: info@azaleacareservices.com
• Telephone: 07387 882620
• ICO registration number: [REVIEW – add your ICO registration number, e.g. ZA123456]
• CQC provider ID: [REVIEW – add your CQC provider ID]

If you have any questions about this policy or how we handle your personal information, please contact us using any of the details above. [REVIEW – if you have a designated Data Protection Officer or appointed representative, name them here.]

2. Information we collect

a. Visitors to our website

When you browse our site we may collect basic technical information automatically: IP address, browser type, device type, pages viewed, time spent on the site and referring URL. This information is used to keep the site secure and to understand how it is used.

b. People who contact us through the website or by phone

If you fill in our contact form, email us, or call us, we collect the information you provide — typically your name, telephone number, email address and the details of your enquiry. Form submissions are processed for us by Formspark, with spam protection by Botpoison (see Section 6 — Sharing).

c. Prospective and current service users

When you enquire about or receive home care from us, we collect information needed to assess and deliver care. This includes:

• Identity and contact details (name, address, date of birth, phone, email).
• Health and care information — including medical history, medication, conditions such as dementia, mobility needs, dietary requirements, language and cultural preferences, and care plans. This is “special category” data under UK GDPR.
• Funding and billing details (e.g. whether you are funded by Birmingham City Council, the NHS or privately).
• Next-of-kin and emergency contact details — for which we expect you to have the consent of the person whose details you are sharing with us.
• Records of care delivered — visit logs, observations, incident reports and communications with you, your family and other professionals.

d. Job applicants and employees

If you apply to work with us, we process the information in your application — CV, references, right-to-work documentation, DBS check results, qualifications and training records. Detailed information for staff is in our separate Employee Privacy Notice.

3. Lawful bases for processing

We rely on the following lawful bases under Article 6 of the UK GDPR:

• Consent (Art. 6(1)(a)) — for marketing emails (where applicable) and for the contact form on this website.
• Contract (Art. 6(1)(b)) — to enter into and perform our care agreement with you.
• Legal obligation (Art. 6(1)(c)) — to comply with CQC, employment, health-and-safety and tax law.
• Vital interests (Art. 6(1)(d)) — to protect someone’s life in an emergency.
• Legitimate interests (Art. 6(1)(f)) — to keep our website secure, prevent fraud, manage our business and respond to enquiries.

Where we process special category data (health information) we additionally rely on Article 9 of the UK GDPR, principally:

• Article 9(2)(h) — provision of health and social care, by qualified professionals under a duty of confidentiality.
• Article 9(2)(c) — protection of vital interests where you cannot give consent.
• Article 9(2)(a) — your explicit consent, where it has been freely given.

4. How we use your information

• To assess your needs and prepare a care plan tailored to you.
To deliver, document and review your home care service. To liaise with the people involved in your care — for example your GP, hospital, district nurse, pharmacist, social worker, family or advocate. To respond to enquiries you make through the website, by email or by phone. To handle billing, payments and any disputes. To meet our legal and regulatory obligations (CQC inspections, safeguarding, tax records, employment law). To improve the quality and safety of our service through audits and incident reviews.

5. Cookies and tracking

Our website uses a small number of cookies and similar technologies. Strictly necessary cookies are set to keep the site secure and working — these do not require consent under PECR. Any other cookies (e.g. analytics) are only set after you give consent through our cookie banner. You can withdraw consent at any time by clearing cookies in your browser or using the cookie settings link in the footer.

[REVIEW – list the actual cookies in use here, e.g. WordPress session cookies, any analytics provider, the Botpoison anti-spam script.]

6. Sharing your information

We never sell your personal information. We share it only where necessary to deliver care and run our service, including with:

Healthcare professionals involved in your care, such as GPs, district nurses, hospital teams, pharmacists and palliative care teams. Birmingham City Council and other commissioning local authorities, where they fund or oversee your care. The NHS and integrated care boards, where care is funded or coordinated through them. The Care Quality Commission (CQC) as our regulator, in the course of inspections and incident notifications. Family members or representatives where you have asked us to. Trusted service providers acting as our processors, such as Formspark and Botpoison (contact form delivery and spam protection), our website hosting provider [REVIEW – name your hosting provider], our email provider [REVIEW] and our care-management software provider [REVIEW]. Law enforcement or other authorities where we are required by law, for safeguarding, or to protect vital interests.

Where third parties act as our processors they are bound by a written data-processing agreement that requires them to protect your information and only use it on our instructions.

7. International transfers

Some of our processors (for example Formspark) are based outside the UK. Where we transfer personal information abroad we use one of the safeguards required by UK GDPR — typically the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or transfers to countries the UK Government has deemed to provide adequate protection.

8. How long we keep your information

We keep your information only for as long as we need it to fulfil the purposes set out in this policy and to meet our legal obligations. Indicative retention periods are:

Adult social-care records: 8 years after the end of care, in line with NHS / Department of Health guidance. [REVIEW] Financial and billing records: 6 years from the end of the relevant tax year (HMRC requirement). [REVIEW] Job applicant records of unsuccessful applicants: 6 months after the recruitment decision. [REVIEW] Website enquiries that do not result in a service: up to 24 months, then deleted. [REVIEW] Website server logs: up to 12 months. [REVIEW]

9. How we keep your information secure

We take appropriate technical and organisational measures to protect your information. These include access controls, role-based permissions, encrypted transmission of data, secure storage, staff training in confidentiality and data protection, and regular review of our policies. Despite this, no method of transmission over the internet or method of electronic storage is completely secure — if you have any concerns about how we handle your information please contact us.

10. Your rights

Under UK GDPR you have the following rights, free of charge:

Access — to be told whether we hold information about you and to receive a copy. Rectification — to ask us to correct information that is inaccurate or incomplete. Erasure — to ask us to delete your information in certain circumstances (“the right to be forgotten”). Restriction — to ask us to limit how we use your information while we investigate a query. Portability — to receive your information in a machine-readable format, where applicable. Object — to processing based on legitimate interests or for direct marketing. Withdraw consent — at any time, where we rely on consent. Not be subject to automated decision-making — we do not currently make decisions about you using purely automated processes.

To exercise any of these rights, contact us using the details in Section 1. We will respond within one calendar month, as required by UK GDPR.

11. Children’s data

Our home care services are provided to people aged 18 and above, and our website is intended for an adult audience. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child please contact us so we can delete it.

12. Complaints to the ICO

We hope you will speak to us first if you are unhappy with how we have handled your information — we will do our best to resolve your concern. You also have the right to complain to the UK regulator at any time:

Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Helpline: 0303 123 1113 Online: ico.org.uk

13. Changes to this policy

We may update this privacy policy from time to time to reflect changes in our service, technology, legal requirements or how we operate. We will publish any updated version on this page and update the “Last updated” date at the top. If we make significant changes we will let you know — for example by email if you are a current service user.