Data Protection Policy

Holding Hearts

Novium Clinic trading as Holding Hearts

Effective Date: May 2026

Introduction

Holding Hearts, is committed to protecting the privacy, confidentiality, and security of all personal information handled within our organisation.

As a domiciliary care provider, we understand the importance of handling sensitive personal and health-related information responsibly, securely, and in accordance with all applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This policy outlines how we collect, process, store, protect, and manage personal information relating to clients, families, staff, applicants, and website users.

Our Commitment to Data Protection

Holding Hearts is committed to:

• Processing personal information lawfully, fairly, and transparently
• Collecting only information that is necessary and relevant
• Keeping information accurate and up to date
• Protecting personal data from unauthorised access, misuse, loss, or disclosure
• Ensuring information is only accessed by authorised individuals
• Respecting the privacy and rights of all individuals
• Maintaining secure systems and working practices
• Providing staff with appropriate data protection training and guidance

We take confidentiality and data security seriously across every area of our business.

Information We May Collect

As part of providing our services, we may collect and process the following types of information:

Client Information

• Full names and contact details
• Addresses and emergency contact information
• Health and medical information
• Care needs and support plans
• Medication details
• GP and healthcare professional information
• Visit records and care documentation

Staff & Recruitment Information

• Employment applications and CVs
• Qualifications and training records
• DBS information where required
• Payroll and employment details
• Right to work documentation
• Performance and supervision records

Website Information

• Website usage data
• IP addresses
• Cookie and analytics information
• Online enquiry form submissions

How We Use Personal Information

We use personal information only where necessary to:

• Deliver safe and effective care services
• Develop personalised care plans
• Communicate with clients and families
• Manage recruitment and employment
• Meet safeguarding responsibilities
• Comply with legal and regulatory obligations
• Improve our services and website functionality
• Maintain quality and compliance standards

Personal information will only be processed for legitimate business and care-related purposes.

Lawful Basis for Processing

Holding Hearts processes personal information under lawful bases including:

• Consent
• Contractual necessity
• Legal obligations
• Vital interests
• Legitimate interests
• Provision of health and social care services

Where sensitive personal information is processed, additional safeguards and lawful conditions are applied in accordance with UK GDPR requirements.

Confidentiality & Information Sharing

All information handled by Holding Hearts is treated confidentially.

Information may be shared with:

• Healthcare professionals
• Local authorities
• Regulatory bodies such as the Care Quality Commission (CQC)
• Emergency services where necessary
• Payroll or professional service providers

Information will only be shared where lawful, necessary, and appropriate to support care delivery, safeguarding, or regulatory responsibilities.

We will never sell personal information to third parties.

Data Security

Holding Hearts takes appropriate technical and organisational measures to protect personal data.

These measures include:

• Secure digital systems and password protection
• Restricted access to confidential records
• Staff confidentiality agreements
• Secure storage of physical documents
• Regular staff training on data protection and confidentiality
• Safe disposal of confidential information
• Ongoing monitoring of data security procedures

We are committed to protecting information against unauthorised access, loss, misuse, alteration, or disclosure.

Data Retention

We retain personal information only for as long as necessary to meet legal, contractual, regulatory, and operational requirements.

Retention periods are reviewed regularly in line with health and social care regulations and best practice guidance.

Individual Rights

Under UK data protection law, individuals have rights regarding their personal information, including:

• The right to access personal data
• The right to request corrections to inaccurate information
• The right to request deletion of information where appropriate
• The right to restrict processing
• The right to object to processing
• The right to data portability
• The right to withdraw consent where applicable

Requests relating to personal information will be handled promptly and in accordance with legal requirements.

Staff Responsibilities

All staff at Holding Hearts are responsible for maintaining confidentiality and protecting personal information.

Employees are expected to:

• Follow all data protection procedures
• Handle information securely and responsibly
• Report data breaches or concerns immediately
• Complete relevant training and compliance requirements
• Respect confidentiality at all times

Failure to comply with data protection requirements may result in disciplinary action.

Data Breaches

Any suspected or confirmed data breach will be taken seriously and investigated promptly.

Where required, breaches will be reported to the Information Commissioner’s Office (ICO) and affected individuals in line with legal obligations.

Holding Hearts is committed to responding quickly and effectively to any data security concerns.

Cookies & Website Usage

Our website may use cookies and analytics tools to improve user experience and understand website performance.

Users can manage cookie preferences through their browser settings.

Further information can be found within our Privacy Policy.

Policy Review

This Data Protection Policy will be reviewed regularly to ensure ongoing compliance with relevant legislation, guidance, and operational requirements.

Contact Information

For questions relating to this Data Protection Policy or how personal information is handled, please contact:

Holding Hearts

Novium Clinic
Leeds, West Yorkshire

Email: hello@holdingheartscare.co.uk
Telephone: 0113 345 2460

Information Commissioner’s Office (ICO)

If you are unhappy with how personal information has been handled, you have the right to contact the Information Commissioner’s Office (ICO).

Website: https://ico.org.uk
Telephone: 0303 123 1113