Privacy Policy, How We Handle Your Data

Who We Are

Novaedge Services Limited is the data controller for the personal information described here. We are registered in England and Wales, company number 16962542, at HQ, 2 St Peter's Street, Huddersfield, West Yorkshire, HD1 1LN.

We handle some of the most private information there is: your health, your body, your home and your money. This notice explains what we hold, why, and what you can make us do about it, under the UK General Data Protection Regulation and the Data Protection Act 2018. We do not currently operate a public website, so this notice is published ready for launch and until then applies to the information we hold offline and in our care management systems.

What We Collect

• Identity and contact details: name, address, date of birth, telephone, email and emergency contacts
• Health and care information: diagnoses, medicines, mobility, risk assessments, care plans, daily notes, incidents and safeguarding records
• Special category data: your health, and where relevant your race, religion and sexual orientation, because these shape how care is given
• Financial information: funding source, financial assessment outcomes, invoices and payments
• Records of contact: enquiries, complaints and correspondence
• Staff and applicant data: recruitment records, DBS outcomes, right to work evidence, training and payroll

Why We Use It, and Our Lawful Bases

For most of what we do our lawful basis is performance of a contract with you, together with our legal obligations as a care provider and the public interest in the provision of health and social care. For health information and other special category data our condition is Article 9(2)(h) of the UK GDPR: the provision of health or social care and the management of those services. We also rely on Article 9(2)(b) for employment, and Article 9(2)(c) where vital interests are at stake.

We do not rely on consent as our default basis for delivering care. Consent can be withdrawn at any moment, and a care record you might need in an emergency should not disappear because a form was ticked differently last month. Where we do ask for consent, for example to share information with a relative or to use a photograph, it is a genuine choice you can withdraw at any time.

Who We Share It With

• Health and care partners: your GP, district nurses, hospital teams, pharmacies and the NHS West Yorkshire ICB, where sharing is needed for your care
• Kirklees Council: for assessments, funding, contract monitoring and safeguarding
• The Care Quality Commission: as our regulator, including statutory notifications
• Emergency services: where there is a risk to life
• Our software providers: care planning, call monitoring, medication and payroll systems, under contracts requiring UK or adequate country storage
• Others with your agreement: relatives, attorneys, advocates or anyone you nominate

We do not sell your data, use it for advertising, or make automated decisions about you.

How Long We Keep It, and How We Protect It

Care records are kept for eight years after our involvement ends, in line with the NHS Records Management Code of Practice, and longer where a safeguarding matter or claim requires it. Unsuccessful applicant records are kept for six months and financial records for six years. Everything is then securely destroyed.

Access is restricted to those who need it for their role. Systems are password protected with multi factor authentication where available, devices are encrypted, paper records are locked away, and every member of staff completes data protection training annually.

Your Rights

• Access: a copy of the information we hold about you, normally within one month and free
• Rectification: have inaccurate information corrected
• Erasure: ask us to delete information, although care records must be kept for the periods set by law
• Restriction and objection: limit how we use your information, or object to particular uses
• Portability: receive certain information in a portable electronic format
• Withdraw consent: where consent was the basis, without affecting your care
• Complain: to us if you wish, and to the regulator at any time

To exercise any of these, contact the Registered Manager on 07934 583993 or hello@novaedgelimited.com. If you are unhappy with how we have handled your information you can complain to the Information Commissioner's Office on 0303 123 1113 or at ico.org.uk, without coming to us first.