Covers: The Old Coach House Residential Home and Priory Care Residential Home

Privacy Notice

Last updated: October 2025

1. Introduction

This Privacy Notice explains how The Old Coach House Residential Home & Priory Care Residential homes ltd (part of DEMA Residential homes ltd & Bismor Care Homes Ltd) collects, uses, and protects personal information about residents, staff, visitors, and business partners.

We are committed to handling all personal data lawfully, fairly, and transparently in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Our goal is to ensure your information is handled with care, respect, and confidentiality.

2. Who We Are

Data Controller:
The Old Coach House Residential Home

Priory Care Residential homes
(Trading name of  DEMA Residential homes ltd & Bismor Care Homes Ltd)
Email: info@demabismorcare.co.uk

We are registered with the Information Commissioner’s Office (ICO).
Our Data Protection Officer (DPO) oversees how we collect, store, and use your information.

3. The Information We Collect

We collect personal information to provide care, employment, and services. The type of information we collect depends on your relationship with us:

For Residents / Service Users

• Name, address, date of birth, NHS number
• Health and care information, medications, care plans, and assessments
• Next of kin or emergency contact details
• GP and other healthcare professional details
• Financial or payment information (if applicable)

For Employees / Job Applicants

• Contact and identification details
• Employment history, references, and qualifications
• Payroll, tax, and pension details
• DBS checks and right-to-work information
• Training and professional development records

For Visitors and Suppliers

• Contact details (name, phone, email)
• Business and service information
• CCTV footage (where applicable for safety and security)

4. How We Use Your Information

We use your information to:

• Provide high-quality care and support
• Develop and review individual care plans
• Manage staffing, training, and payroll
• Comply with regulatory requirements (CQC, NHS, Local Authority)
• Maintain health and safety standards
• Process payments and manage contracts
• Improve our services and respond to feedback

We do not sell or share personal information for marketing purposes.

5. Legal Basis for Processing

We rely on one or more of the following legal bases under the UK GDPR:

• Article 6(1)(c) – processing is necessary to comply with a legal obligation
• Article 6(1)(e) – processing is necessary for a public task or legitimate interest
• Article 9(2)(h) – processing is necessary for the provision or management of health and social care
• Article 6(1)(b) – processing is necessary for a contract (e.g., employment or service agreement)

Where required, we will seek explicit consent (for example, to share photos or testimonials on social media).

6. Sharing Your Information

We may share your information with:

• Healthcare professionals and organisations (GPs, hospitals, community health teams)
• Local authorities and social services
• Regulatory bodies (e.g. CQC, local safeguarding boards)
• Payroll and HR providers (for staff)
• External auditors or insurers (for compliance and safety)

We only share the minimum data necessary and ensure all partners meet the same high standards of data protection.

For residents, certain data is shared via the Humber and North Yorkshire Shared Care Record to ensure joined-up health and care.
(See our Shared Care Record Privacy Policy for details.)

7. How We Store and Protect Your Information

• All records are stored securely on encrypted systems or locked storage.
• Access is restricted to authorised personnel.
• Paper files are disposed of securely in line with retention schedules.
• Digital data is backed up and monitored to prevent loss or misuse.
• All staff receive data protection and confidentiality training.

8. How Long We Keep Your Information

We follow the NHS and Local Authority Records Management Code of Practice.
Information is retained only as long as necessary to fulfil legal, contractual, or care obligations.
Once no longer needed, data is securely destroyed.

9. Your Data Protection Rights

You have the right to:

• Be informed about how your data is used.
• Access your personal information.
• Request correction of inaccurate data.
• Object to certain types of processing.
• Request deletion (“the right to be forgotten”) in some cases.
• Withdraw consent (where consent was the lawful basis).
• Data portability, where applicable.

To exercise any of these rights, please contact our Data Protection Officer at info@demabismorcare.co.uk.

10. CCTV Monitoring

We use CCTV in certain areas to maintain safety and security.
Images are retained for a limited period and may be shared only with the police or relevant authorities if required by law.

11. Website and Cookies

When you visit our website, we may collect basic usage data through cookies to improve functionality and user experience.
Please see our Website Privacy & Cookie Policy for full details.

12. Transfers Outside the UK

We do not routinely transfer personal data outside the UK.
If ever required (e.g., via cloud-based systems), we ensure appropriate safeguards are in place under UK data protection law.

13. How to Complain

If you are concerned about how we have used your data, please contact our Registered Manager or Data Protection Officer first.

If you remain dissatisfied, you can contact:
Information Commissioner’s Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Website: www.ico.org.uk