Protecting the Privacy of our Residents; their visitors, staff and website visitors
Philiphaugh Manor Care Home is committed to protecting your personal data and handling it responsibly. This Privacy Statement explains how we collect, use and safeguard personal data of our residents, their families, visitors, staff, website users and other relevant individuals in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1.1 Philiphaugh Manor care Home and AbleCare Partnerships ("we", "us", "our", "AbleCare") are committed to protecting and respecting your privacy; and safeguarding your personal information.
1.2 Under the UK GDPR and Data Protection Act 2018, we are required to explain to you how we collect, use, share and safeguard the personal information of our residents, their families, visitors, our staff and other relevant individuals in accordance with the UK General Data Protection Regulation 2018 and the Data Protection Act 2018.
1.3 It is important that you read this Privacy Statement so that you know how and why we use your information. We may update this Privacy Statement at any time. It is also important that you inform us of any changes to the personal information we hold about you so that the information is accurate and up to date.
2.1 We are Philiphaugh Manor Care Home (operated by AbleCare (Philiphaugh) Ltd) is a company registered in England and Wales under company number GB8839680 and with our registered office at 237 Westcombe Hill, London, United Kingdom, SE3 7DW.
2.2 AbleCare is the "Data Controller" for the information which we hold about you. This means that we are responsible for deciding how and why we hold your personal information.
3.1 Our Data Protection Officer (DPO) is responsible for overseeing what we do with your information and monitoring our compliance with the Data Protection Laws.
3.2 Our DPO is Alice Taylor (Manager: Philiphaugh Manor Care Home), who can be contacted via:
- Data Controller Address: Station Road, St Columb Major, Newquay, Cornwall, TR9 6BX
- Email: manager@philiphaughmanor.co.uk
- FreePhone: 0800 - 699 0000
- Telephone: 01637 - 880 520
4.1 Depending on your relationship with us (resident, resident's family or visitor, employee, job applicant or website visitor), we may collect various types of personal information. The table below outlines an illustrative, but not exhaustive, examples of what each type may include:
- Type
- Examples
- Personal Identifiers
- Names, title, date of birth; (including for next-of-kin)
- Contact Details
- Phone numbers, email addresses, postal addresses; (including for next-of-kin)
- Health & Medical Data
- Medication records and history, care plans,diagnoses, treatments, dietary requirements; and NHS and GP data
- Employment Data
- Job title, employment history, qualifications, right to work
- Financial Information
- Bank details, Payment details, Funding Arrangements, payroll and pension information
- Official Documentation
- Driving license, passport, NHS number, National Insurance number
- Online & Digital Identifiers
- IP addresses, geolocation, browser type, cookies, website usage, referrer, device, resolution & OS
- Operational Data
- Car registration, signature, date and time of visit, purpose of visit
- Photos and Videos
- CCTV footage, media captured using company-owned devices
5.1 Certain types of personal data, such as health information, racial/ethnic original, religion, sexual information and political opinions and bio-metrics are classified as "special category data" under the UK GDPR. We handle this data with extra care and apply additional safeguards to prevent misuse, maintain confidentiality, and protect your privacy.
6.1 We process personal information for a number of reasons. To provide our services to our residents, make sure we offer the best care, protection and support, meet legal and regulatory requirements, and perform our contractual service provision; support operational effectiveness and to ensure the health and safety of residents; staff and visitors. The list below outlines our main purposes for processing.
- Contractual Provision of Service
- Fulfilling our agreement to provide residency, care and ensure well-being of residents. Manage care plans
- Vital Interest
- Processing medical and emergency data to protect the life and well-being of our residents
- Legal & Regulatory Obligations
- Meeting regulations set by the Care Quality Commission (CQC) and complying with healthcare, employment, data protection and safeguarding laws and local authority regulations
- Legitimate Interests
- Keeping general administrative records and answering inquiries submitted via our website, email, phone or other communication channels. To keep residents, their families, and authorised individuals informed
- Safety and Security
- To safeguard residents, staff, and visitors, including the use of CCTV
- Billing and Administration
- To manage contracts, handle financials, and process payments
- Health and Safety
- To provide a safe environment and comply with public health guidelines
- Research
- To support studies that focus on enhancing health, care, and overall quality of life
- Service Improvement
- To support quality assurance and improve operational efficiency
- Marketing
- To provide updates and promotional material about our services and events
- Job Applications
- To manage recruitment processes and assess candidate suitability
- Consent
- Clear, recorded permission from you to process your data for a particular purpose.
Special category personal data: Explicit clear and recorded consent from you to process your sensitive personal data. - Public Interest
- To carry out lawful tasks that benefit society and the local community
6.2 In accordance with the Data Protection Laws, we need a lawful basis for collecting and using information about you. These lawful bases are set out in Article 6 of the UK GDPR and, depending on the type of data, may require reliance on additional safeguards set out in Articles 9 and 10 of the UK GDPR and within the Data Protection Act 2018.
6.3 Our Article 6 GDPR lawful basis for processing this type of data will depend on the circumstances, but will include the following (as appropriate):
6.3.1 You have given us clear consent to process your personal data (in the circumstances where consent is the only available lawful basis) (Article 6(1)(a)) of the UK GDPR); or
6.3.2 It is necessary in order for us to perform our contract for services with you/your loved one/your commissioning body (Article 6(1)(b) of the UK GDPR); or
6.3.3 It is necessary to meet legal / regulatory obligations (Article 6(1)(c) of the UK GDPR); or
6.3.4 It is necessary to protect your life (Article 6(1)(d) of the UK GDPR); or
6.3.5 It is necessary for our legitimate interests (where they are not overridden by your rights) (Article 6(1)(f) UK GDPR).
6.3.6 It is necessary for our compliance with Article 9 UK GDPR and additional date safeguards for special category personal data specified within the Data Protection Act 2018
6.4 In rare cases, legal obligations or safeguarding requirements may override certain data protection rights, such as disclosing personal data without consent to support a legal investigation or protect an individual’s vital interests. In all such cases, we ensure disclosure is lawful and strictly necessary.
7.1 The information described at section 4 which we collect about you will be obtained through a variety of sources. The following table sets out these sources along with illustrative but not exhaustive examples of each:
- Sources
- Examples
- You
- Resident, staff or visitor to our care homes, both directly and information generated for care records and care planning through observations and interactions
- Family or Friends
- Next of kin, emergency contact, spouse
- Public domain
- information which you have made public including social media
- Legal Representatives
- Solicitor, power of attorney holder, court-appointed deputy or others who are acting in your best interests
- Healthcare Providers
- GPs, the NHS, dentist, private healthcare organisations
- Local Authorities
- Adult social care teams, integrated care boards, commissioning bodies, funding bodies
- Employment Agencies
- Hays, Randstad, Blue Arrow
- Job Boards
- Indeed, Reed, Totaljobs
- Former Employers
- Other care providers, nursing agencies, line managers
- Service Providers
- Physiotherapists, occupational therapists, speech therapists, personal care providers
- Regulatory and Public Authorities
- Police, Home Office, Courts, Office of the Public Guardian, coroners, the CQC, safeguarding boards, Food Standards Agency
- Automated Data Collection
- CCTV systems, website interaction, system access control logs
- Professional Services
- Solicitors, Insures and Auditors
8.1 We will comply with the Data Protection Laws when using your personal information. At the heart of the Data Protection Laws are the data protection principles (Article 5(1) of the UK GDPR) which say that the personal information we hold about you must be:
- processed lawfully, fairly and in a transparent way;
- collected only for specified, explicit and legitimate purposes and not used in any way that is incompatible with those purposes;
- adequate and relevant to the purposes we have told you about and limited only to those purposes;
- accurate and, where necessary, kept up to date;
- kept only as long as necessary for the purposes we have told you about; and
- processed in a manner that ensures appropriate security.
9.1 We do not sell or share your data with third parties for marketing. We only share information with trusted parties where it is strictly necessary and there is a lawful basis for doing so. This includes:
- External Healthcare Providers
- GP, Dentist, Hospital Staff, district nurses, other care providers - To coordinate care and support treatment need
- Local Authorities and Safeguarding Boards
- To meet statutory obligations and reporting duties
- Law Enforcement or Legal Authorities
- Police, Courts, Home Office, the Office of the Public Guardian and coroners; Attorneys, Court Deputies, Local Government & Social Care Ombudsman - When required by law or to protect vital interests, including where necessary to investigate complaints
- Regulatory Bodies
- The Care Quality Commission (CQC) and safeguarding teams - To comply with legal and regulatory inspections or audits
- Service Providers
- External IT and software providers, solicitors, auditors, insurers - who may on occasion have access to information where it s necessary for them to provide IT and operational services on our behalf and they appropriately protect personal information
- Research Partners
- When involved in approved health or social care research studies
- Website Analytics Providers
- To improve website functionality and user experience
10.1 We strive to ensure that any data necessary to be shared with the companies we work with (i.e. our supply chains) remains within the UK or the European Economic Area in the first instance. However, to meet our legal obligation or support the services we provide, some companies are located in, or run their services from, countries outside of these areas and resultantly, on occasion, your personal data may be transferred to countries outside of these areas. In such cases, we rely on safeguards like Standard Contractual Clauses (SCCs) or equivalent transfer mechanisms to protect your information in line with UK GDPR
11.1 We apply robust technical and organisational measures to protect your data against unauthorised access, loss, or destruction.
11.1 The length of time we retain information varies based upon the type and sensitivity of the information, risks of unauthorised use, disclosure or loss and the applicable legal requirements, with sensitive information only retained for as long as necessary. Examples include:
- Type
- Retention Period
- Residents Care and Health Records
- 10 years after a resident’s departure or longer if required by law
- Financial Records
- 7 years to meet tax and audit obligations
- Employee personnel records
- 6 years after employment ends
- CCTV Footage
- 30 days unless required for an investigation or other lawful purpose
- Website visitor analytics
- Raw visitor data is retained for 365 days; aggregated reports are deleted after 2 years
12.1 You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making.
13.1 Under GDPR, you hold several rights regarding your personal information. For example:
- Right to Access
- You can request a copy of the personal data we hold about you, such as care records or CCTV footage. Commonly known as a “data subject access request”, enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it
- Right to Data Portability
- Obtain a copy of your data in a structured, machine-readable format
- Right to Rectification
- You can ask us to correct or update inaccurate or incomplete information
- Right to Erasure
- You can request that we delete or remove some or all of your data (this is subject to legal and regulatory retention requirements)
- Right to Restrict or Object
- You can object to us processing, or request limitations in how we process, your data under certain circumstances
- Right of Withdrawal
- Withdraw consent to processing your personal data at any time.
13.2 To exercise these rights, please contact our Data Protection Officer (DPO).
13.3 Individuals can choose not to share their confidential patient information beyond care and treatment, such as for research or planning, through the NHS National Data Opt‑Out, without affecting the services they receive.For more information or to set your preference, visit https://www.nhs.uk/your-nhs-data-matters.
14.1 If you have any questions, want to exercise your rights, or wish to file a complaint about how we handle your data, please contact us via email at admin@menwinnioncarehome.co.uk or write to Data Protection Officer, Station Road, St Columb Major, Newquay, Cornwall, TR9 6BX
14.2 If you are not satisfied with the way we use your information or the way your complaint has been handled, you may escalate have your complaint to the Information Commissioner's Office (ICO):
- Website
- https://ico.org.uk/make-a-complaint
- casework@ico.org.uk
- Phone
- 0303 123 1113
- In writing
- Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
15.1 We reserve the right to update this Privacy Statement for Residents/Patients at any time where appropriate
15.2 Last updated: Monday, July 13, 2026
