Privacy Policy

Who we are

Exordior Care provides care and support services and operates recruitment and employment services. For the personal information covered by this notice, Exordior Care is normally the data controller. This means we decide why and how that information is used.

This notice applies to people who use or enquire about our services, their relatives and representatives, staff, workers and job applicants, professionals and partner organisations, suppliers, and visitors to our websites.

Information we collect

The information we collect depends on your relationship with us. It may include:

• identity and contact details, including names, addresses, telephone numbers, email addresses and dates of birth;
• care and support information, assessments, care plans, daily records, risk information, preferences and communication needs;
• health, medication, disability, mobility and other information needed to deliver safe, person-centred care;
• details about relatives, representatives, attorneys, advocates and emergency contacts;
• recruitment and employment records, qualifications, work history, references, training, right-to-work evidence, DBS information, payroll and attendance records;
• communications, compliments, complaints, safeguarding concerns, incidents and quality-assurance records;
• financial and invoicing information; and
• technical website information such as IP address, browser type, device information and cookie preferences.

We may receive information directly from you or from people and organisations involved in your care or our work, such as relatives, representatives, local authorities, health professionals, previous employers and referees.

How we use your information

We use personal information where it is necessary and proportionate to:

• assess, arrange, deliver, review and improve care and support;
• communicate with you, your representatives and relevant professionals;
• manage medication, risk, incidents, emergencies and safeguarding concerns;
• meet contractual, regulatory, legal and professional obligations;
• recruit, employ, train, schedule and support staff and workers;
• process payments, payroll, invoices and accounts;
• respond to enquiries, feedback and complaints;
• protect our systems, people and services from misuse or harm; and
• monitor quality, audit our services and plan improvements.

Our legal bases

Under UK data protection law, we must have a lawful basis for each use of personal information. Depending on the circumstances, we rely on performance of a contract, compliance with a legal obligation, protection of vital interests, legitimate interests, public task where applicable, or consent.

Information about health, ethnicity, religion and certain other sensitive matters is known as special category data. When we use it, we also identify an additional condition under the UK GDPR and Data Protection Act 2018. This will commonly be because processing is necessary for health or social care, employment and social protection, substantial public interest, protection of vital interests, or because you have given explicit consent where consent is appropriate.

Who we share information with

We share only the information reasonably needed for the purpose. Depending on the circumstances, recipients may include:

• your authorised relatives, representatives, attorneys or advocates;
• local authorities, integrated care bodies, NHS services, GPs, pharmacies and other health or care professionals;
• the Care Quality Commission, safeguarding teams, emergency services, law-enforcement bodies, courts or other authorities where required or permitted by law;
• our staff, workers and professional advisers; and
• trusted service providers supporting secure IT, care-management systems, communications, training, payroll, finance, storage and business administration.

Service providers must protect the information, act only on our instructions where they process it for us, and meet appropriate confidentiality and security requirements. We do not sell personal information.

Security and international transfers

We use proportionate technical and organisational safeguards to protect personal information from loss, misuse, unauthorised access, alteration or disclosure. These include access controls, secure systems, staff confidentiality duties, training and record-management procedures.

If a supplier processes information outside the United Kingdom, we take steps required by data protection law to protect it, such as using an approved adequacy arrangement or appropriate contractual safeguards.

How long we keep information

We keep personal information only for as long as it is needed for the purpose for which it was collected and to meet care, safeguarding, employment, tax, insurance, contractual and regulatory requirements. Retention periods differ according to the type of record and the circumstances. When information is no longer required, we securely delete, anonymise or destroy it.

Your data protection rights

Depending on the circumstances, you may have the right to:

• Be informed about how your information is used.
• Access the personal information we hold about you.
• Rectify information that is inaccurate or incomplete.
• Erase information in certain circumstances.
• Restrict how your information is used in certain circumstances.
• Object to certain uses of your information.
• Data portability for certain information you provided to us.
• Withdraw consent where our use depends on consent.

These rights are not absolute and exemptions may apply. We may need to confirm your identity before responding. You will not usually have to pay a fee to exercise your rights.

Cookies and website information

Our websites may use necessary cookies to function securely and remember essential choices. Where we use non-essential analytics or similar technologies, we will request consent where the law requires it. You can also control cookies through your browser settings, although blocking necessary cookies may affect how parts of the website work.

Our websites may contain links to other organisations. Their privacy practices are governed by their own notices, and we encourage you to read them.

Changes to this notice

We review this notice regularly and update it when our services, practices or legal responsibilities change. The review date at the top of this page shows when it was last checked.