Privacy Policy

Last updated 25 September 2026

Who we are

Qualitcare24-7 Ltd provides domiciliary care, live-in care, respite and supported living services. We are responsible for deciding how we use personal information in our own care, employment, recruitment and business activities. Where we act on a commissioner’s documented instructions, the respective responsibilities will be explained in our contract or other relevant information.

Contact us about this notice, a data rights request or a data protection complaint at info@qualitcare247.co.uk, 023 9217 8770, or Qualitcare24-7 Ltd, 320 Victory Business Centre, Somers Road North, Portsmouth PO1 1PJ. Please mark correspondence “Data protection”.

Whose information we use and what we collect

This notice covers people using or seeking our services, their representatives and contacts, applicants, workers, suppliers, professionals, and visitors to our website. We collect only information relevant to the activity concerned.

Care and support: identity and contact details; emergency contacts; referral, funding and payment information; assessments, care plans, daily notes, medication and incident records; health, disability, communication, support preferences and safeguarding information; and, where relevant, information about capacity, representatives and legal authority.
Employment and recruitment: application and interview details; identity, right-to-work, references and relevant DBS-check outcomes; contracts, rota, pay, tax, pension, training, supervision, performance and absence information; and relevant health, equality and safeguarding information.
Relatives, representatives and professionals: names, contact details, relationship or role, communications, and evidence of authority where needed.
Website and enquiries: information you submit, basic technical and security information, and cookies or similar technologies as described below.

We receive information directly from you and, where appropriate, from relatives or representatives, commissioners, local authorities, health professionals, previous employers, referees, DBS and other authorised sources. We will explain when information is required by law or contract and the likely effect of not providing it.

Why we use information and our lawful bases

We identify and record the Article 6 UK GDPR basis for each purpose. More than one basis may apply to different uses of the same record; we do not treat consent to receive care as blanket consent to process all care records.

Assessing, arranging and delivering care, maintaining safe records and communicating with people involved in care: contract (Article 6(1)(b)) where we contract directly with you; legal obligation (6(1)(c)) where a specific duty applies; and legitimate interests (6(1)(f)) for necessary care administration where the balancing test is met.
Safeguarding, managing incidents, regulatory reporting and complying with court or statutory requirements: legal obligation (6(1)(c)); vital interests (6(1)(d)) where necessary to protect life; or legitimate interests (6(1)(f)) where appropriate. The precise basis depends on the duty and circumstances.
Recruitment, employment, payroll, pensions, training and workforce management: steps before or performance of a contract (6(1)(b)), legal obligation (6(1)(c)), or legitimate interests (6(1)(f)) for proportionate operational management.
Responding to enquiries, administering our website, protecting our systems and dealing with suppliers: legitimate interests (6(1)(f)), contract (6(1)(b)) or legal obligation (6(1)(c)), according to the purpose.
Optional activities for which we ask for a genuine choice, such as a specified use of a photograph or non-essential cookies: consent (6(1)(a)), where consent is the applicable basis. You may withdraw consent at any time, without affecting earlier lawful processing.

Our legitimate interests include delivering and improving safe services, maintaining appropriate records, managing our workforce and protecting our systems and legal rights. We consider the impact on individuals before relying on this basis. We do not generally rely on “public task” simply because we provide commissioned care.

Health and other sensitive information

For special category information, we also identify a separate Article 9 condition. Health and care records may be processed under Article 9(2)(h) for the provision or management of health or social care, subject to confidentiality safeguards. Worker health information may be processed under Article 9(2)(b) for employment and social protection obligations and rights. Safeguarding may rely on Article 9(2)(g) and a relevant substantial-public-interest condition in Schedule 1 to the Data Protection Act 2018 where its requirements are met. Explicit consent under Article 9(2)(a) is used only for a distinct optional purpose where it is valid. We maintain an appropriate policy document where a relied-on condition requires one.

Criminal offence information, including relevant DBS information, is handled only where authorised by law and with an applicable Data Protection Act 2018 Schedule 1 condition. We record the check and suitability decision as needed, and handle certificate contents in line with DBS requirements. We retain only the records needed for these purposes and the applicable retention period.

Who we share information with

We share the minimum necessary information, securely and on a need-to-know basis, with GPs, hospitals, pharmacies and other care professionals; local authorities and commissioners; safeguarding partners; CQC and other regulators; emergency services, police or courts where lawful; payroll, pension, HMRC, DBS and immigration authorities where applicable; and contracted IT, care-record, payment and professional service providers acting under appropriate safeguards. We share with family members or representatives where you agree, they have relevant legal authority, or another lawful basis permits it. Safeguarding or emergency sharing may take place without consent where necessary and lawful. We do not sell personal information.

International transfers and security

If a service provider processes personal information outside the UK, we assess the destination and use a lawful transfer mechanism and safeguards where required. Access is restricted by role; we use appropriate technical and organisational measures, confidentiality obligations, training, secure sharing and incident procedures. No method of transmission is completely risk-free.

How long we keep information

We keep records only as long as necessary for care, legal, regulatory, employment, accounting and safeguarding purposes, then securely delete or anonymise them. Periods differ by record type, age, statutory requirements, claims and any safeguarding hold. Our retention schedule takes account of the current Records Management Code of Practice for Health and Social Care and applicable employment and tax rules. You may ask us for the period or criteria for a particular record. We will not destroy records subject to an active investigation, request or legal hold.

Website cookies

Our website may use cookies and similar technologies needed for its operation, as well as services provided by third parties. These can collect technical and usage information. Where the law requires consent for non-essential technologies, we will seek it before using them. We are reviewing the precise cookies, providers and lifetimes used on this site. You may contact us for current details, and you can block or delete cookies through your browser settings, although some features may then fail.

Your rights

Depending on the circumstances, you can ask to access your information, correct it, erase it, restrict its use, receive or transfer certain information, or object to processing based on legitimate interests. You can withdraw consent where it is relied on. Some rights have exceptions, including where records must be kept for care, safeguarding or legal reasons. We do not make solely automated decisions with legal or similarly significant effects.

Contact us using the details above. We may ask for proportionate proof of identity or authority before disclosing information. We normally respond to rights requests within one month, subject to the legal rules on clarification, extensions and exemptions. Access requests are normally free.

Data protection complaints

You can complain to us by email, telephone or post using the contact details above. Tell us what happened, when, and what outcome you seek; we can help you make the complaint in an accessible way. We acknowledge data protection complaints within 30 days, investigate appropriately without undue delay, keep you informed and explain the outcome. You may also complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint or 0303 123 1113.

Changes to this notice

We review this notice when our services, systems or legal requirements change. We will publish the updated version and draw significant changes to your attention where appropriate.