Privacy Policy

This notice explains how Lidder Care Group Limited uses personal information when you visit our website, make an enquiry, receive care, support someone receiving care, apply for a role or work with us. It covers information we handle in connection with Lidder Home Care, Newgate Lodge and Lowmoor Nursing Home, where relevant to our responsibilities.

Read the sections relevant to you, together with any information provided for a particular service, application, employment activity or form. You can ask us for this notice in another format or for help understanding it.

1. Who is responsible and how to contact us

Lidder Care Group Limited is the controller for personal information where we determine why and how it is used. Company number: 11296727. Registered office: 3–5 College Street, Nottingham, Nottinghamshire, England, NG1 5AQ.

For privacy questions, rights requests or complaints, email info@liddercare.com, marking your message “Data protection”, or write to our registered office. You can also telephone 01623 752288 or 01623 622322 and ask for your enquiry to be passed to the person responsible for data protection. You do not need to use a particular form.

Your care agreement and any service-specific privacy information identify any other legal entity responsible for your care records. Where another organisation determines its own use of information, its privacy notice also applies. Our shared branding does not remove that organisation’s responsibilities.

2. The information we collect and where it comes from

Personal information identifies you or can be linked to you. We collect only what is relevant to the activity involved. Health information and some information about beliefs, ethnicity or sexual life receive additional protection as special-category data. Criminal offence information is also subject to specific legal safeguards.

We receive information directly from you and, where relevant, from relatives, authorised representatives, referral and hospital discharge teams, local authorities, health professionals, recruitment platforms, agencies, referees, training providers and organisations carrying out lawful checks. Relevant professional registration information may come from public registers.

We provide privacy information when collecting information from you. When information comes from someone else, we normally provide it within one month, or sooner at our first communication with you or before disclosure to another recipient, unless a lawful exception applies.

Some information is needed to provide safe care, fulfil an agreement or meet a legal duty. Without necessary care or medication information we may be unable to provide a service safely. Without required employment or right-to-work information we may be unable to progress an application or employment. We explain what is required and why. Optional marketing and publicity permissions are voluntary.

3. Website visitors and enquiries

We may collect your name, contact details, location, enquiry, care requirements, quotation or callback requests, correspondence and communication preferences. Website systems may also collect IP addresses, device and browser information, security logs and information about pages visited, depending on the technologies used.

We use enquiry information to respond, assess the suitability of our services, arrange discussions or assessments, prepare quotations and keep appropriate records. We use necessary technical information to operate and secure the website. Please avoid sending detailed health records through a general website contact form; contact us to arrange an appropriate way to provide sensitive information.

For steps you request before entering into a contract with us, we rely on Article 6(1)(b) UK GDPR. For general enquiries, appropriate follow-up, record keeping, website operation and security we rely on our legitimate interests under Article 6(1)(f), where your rights do not override them. We rely on legal obligation under Article 6(1)(c) where a legal duty applies, and consent under Article 6(1)(a) where required for the activity. Necessary health information for a care assessment also requires the condition explained in section 5.

An enquiry does not automatically subscribe you to marketing. External websites and recruitment platforms have their own privacy information for their independent use of your data.

4. Marketing cookies and website technologies

We use contact details and communication preferences to send requested newsletters and other lawful marketing. Where consent is required, we obtain it first. You can unsubscribe using the email link or contact info@liddercare.com. You can object to direct marketing at any time. We keep limited suppression information where necessary to respect your opt-out. Necessary communications about your care, employment or an enquiry are separate from marketing.

We do not sell personal information. Where an email distribution provider supports communications, it receives only the information needed for that service.

Cookies and similar technologies may support website operation, security, preferences and measurement. Some technologies collect online identifiers and browsing information. The information displayed with the website’s cookie choices explains the technologies in use, their purposes, providers and durations.

We obtain consent before using optional technologies where the law requires it. You can refuse those technologies and withdraw consent through the website’s cookie controls. If we rely on a lawful exception, such as a qualifying statistical-purpose exception, we provide the required information and means of objecting. Advertising and tracking are not treated as exempt simply because they also measure website use.

5. People receiving care and their representatives

We collect information needed to assess, arrange, deliver and review care. This can include identity and contact details, date of birth, emergency contacts, authorised representatives, health and medication information, allergies, care needs, communication needs, preferences, care plans, visit or daily records, assessments, incidents, safeguarding concerns, complaints and relevant professional advice. We also use funding, fee, billing and payment information.

We use this information for safe care, continuity, medicines support, referrals, communication, quality assurance, auditing, responding to concerns, safeguarding, regulatory records and administering fees. Approved AI may support administration and audit checks subject to section 9.

Contract or requested pre-contract steps under Article 6(1)(b) apply where processing is necessary for an agreement with you. If a commissioner or another person contracts for your care, we do not assume you are a party to that contract; we use the appropriate alternative ground. Legal obligation under Article 6(1)(c) applies to required care records and statutory duties. Legitimate interests under Article 6(1)(f) apply where necessary and proportionate for coordination, quality, complaints and protection of people and the organisation, subject to your rights.

Health and other special-category information needed to provide or manage health or social care is processed under Article 9(2)(h), with Data Protection Act 2018 Schedule 1 Part 1 paragraph 2 and the required confidentiality safeguards. For necessary legal claims, Article 9(2)(f) may apply. For safeguarding where applicable, Article 9(2)(g) may apply with Schedule 1 Part 2 paragraph 18 and its specific conditions. We use the grounds appropriate to the circumstances and maintain an appropriate policy document where required.

In a life-threatening emergency, Article 6(1)(d) may apply. Article 9(2)(c) applies to special-category information only where its conditions are met, including where the person is physically or legally incapable of giving consent. Emergency grounds are not a blanket basis for routine care.

For optional publicity, we seek suitable consent and, where relevant, explicit consent for special-category information. Permission to receive care and requirements concerning confidential information are considered separately from our data protection lawful basis. A relative, emergency contact or person paying fees does not automatically have access to all care information. We consider the person’s wishes, capacity for the particular decision, any legal authority to act and our confidentiality obligations.

6. Recruitment employees and other workers

We use information about current and former employees, applicants, agency workers, contractors and volunteers where relevant. It may include contact details, applications and CVs, work history, interview notes, qualifications, references, right-to-work evidence, permitted DBS information, contracts, work schedules, training, attendance, performance, payroll, bank, tax, pension and benefit information. Limited health information may be needed for sickness management, adjustments or occupational health.

We use it to assess applications, carry out lawful checks, arrange employment, pay staff, plan staffing, provide training, manage performance and workplace concerns, fulfil legal duties and protect people receiving care. Contract or requested pre-contract steps under Article 6(1)(b), legal obligation under Article 6(1)(c), and legitimate interests under Article 6(1)(f) apply according to the activity. Our legitimate interests include assessing suitability, planning staff deployment, managing performance and investigating concerns, subject to individual rights. Employment consent is reserved for genuinely optional purposes, such as agreed publicity.

Health processing necessary for employment-law duties and rights uses Article 9(2)(b) and Schedule 1 Part 1 paragraph 1, with an appropriate policy document. Occupational health may use Article 9(2)(h) and Schedule 1 Part 1 paragraph 2 with professional confidentiality safeguards. Any equality monitoring or other special-category processing requires its own relevant condition and explanation.

Criminal offence information is processed under Article 10 UK GDPR, an appropriate Article 6 basis and the relevant Data Protection Act 2018 authorisation, with required safeguards. Checks must be legally permitted for the role; not every role qualifies for the same DBS or barred-list check. We restrict access and keep certificate information separately from general employment records as appropriate.

We provide applicants and workers with targeted privacy information at the relevant collection stage. This includes applicable retention periods, checks, monitoring and any automated screening arrangements. Recruitment platforms may also process information independently under their own notices.

 

7. Who we share information with

We share only relevant information where necessary and lawful. Recipients may include authorised representatives; NHS organisations, GPs, pharmacists and other care professionals; commissioners and local authorities; safeguarding teams; emergency services; CQC and other regulators; courts and law enforcement; insurers and professional advisers.

For recruitment and employment, relevant recipients include referees and lawful check providers, payroll and pension providers, HMRC, occupational health, recruitment agencies and training or registration bodies. Relevant information may also be shared with another Lidder Care service or legal entity for an identified lawful purpose, with appropriate confidentiality and data-sharing arrangements.

Suppliers supporting our work include care record systems, digital forms, policy and compliance systems, email and cloud services, recruitment platforms, IT support, accounting, website hosting, communication services and approved AI providers. Known systems include Nourish, QCS, Jotform, Microsoft 365 and Outlook, and Indeed where used for the relevant activity. Not every system receives every type of information.

Suppliers acting on our behalf must have appropriate processing contracts, security and confidentiality arrangements. Some organisations act as independent controllers for their own functions. Ask us for the recipients relevant to your information.

8. National data opt out

The national data opt-out in England allows you to choose whether confidential patient information is used for research and planning where the scheme applies. It does not stop necessary sharing for your individual care. Other exclusions and exemptions may apply, including disclosures required by law.

We assess whether proposed uses or disclosures fall within the scheme and apply registered opt-outs where required. We do not assume that all quality assurance, auditing or AI use falls outside the scheme; the purpose and confidentiality arrangements must be assessed.

You can find out more and make or change your choice at Your NHS Data Matters

Ask us for help accessing this information.

9. How we use AI

We use AI to support appropriate administration, document preparation, quality assurance and auditing. It may help organise material, identify missing or inconsistent information and highlight matters for staff to investigate. AI does not replace professional decisions or our accountability. Relevant outputs must be checked by staff with appropriate knowledge before they are relied on; staff remain responsible for care decisions and final audit findings.

Personal or confidential information must only be used with an AI service approved for the particular purpose. We use the minimum necessary information and anonymised material where practicable. Removing a name alone does not necessarily make information anonymous.

Before personal information is processed, the use requires a suitable lawful basis and, where relevant, a special-category or criminal offence condition. We assess confidentiality, accuracy, fairness, access, supplier terms, retention, any use of inputs for model training and international transfers. A data protection impact assessment is undertaken where required. We do not permit unrestricted disclosure to public or unapproved AI tools.

Any processing of confidential care or employment information for general-purpose model training requires separate assessment and authority; this notice does not grant that permission. Where an AI use introduces a new purpose or requires further explanation, we provide additional privacy information.

10. Automated decisions and profiling

Digital recruitment systems may use screening questions and filters. An automated rejection can be significant even if a person originally selected the questions. The privacy information for the application process explains any solely automated significant decision, the information and main factors used, its consequences and the review route where such a process is used.

You can contact info@liddercare.com to ask whether an automated decision affected your application, make representations, challenge it and request human intervention. Required safeguards and any additional restrictions for special-category information apply. AI-assisted drafting or checks do not, by themselves, mean that a significant decision is made solely by automation.

11. Photographs, CCTV, recordings and monitoring

Photographs may be used where necessary for identification, care records or documenting relevant concerns. Publicity uses require separate consideration and suitable permission. Agreement to a care photograph does not authorise an unrelated marketing use.

If CCTV, audio or video recordings, call recording, electronic monitoring or automated transcription are used, we provide information about the particular activity, purpose, lawful basis, access, retention and rights through relevant notices and signs. Information revealing health or other protected characteristics requires additional safeguards. Staff and visitors receive information relevant to any monitoring affecting them.

12. How long we keep information

We retain information only for as long as necessary for its purpose. Periods differ by record type, service, legal duty and circumstances. We consider applicable care and employment requirements, health and social care records guidance, contractual obligations, tax and pension duties, complaints, safeguarding investigations and relevant time limits for claims.

Enquiries are retained while they are active and for a justified follow-up or complaint period. Inactive enquiries are reviewed rather than kept indefinitely. Marketing subscription and suppression records are retained as needed to manage preferences and honour objections.

Care records are retained during care and for the justified period afterwards. Care plans, medicines records, incidents and financial records may have different periods. Unsuccessful applications are kept for a justified period to manage recruitment queries and potential claims; retaining them for future vacancies is a separate purpose explained to the applicant. Successful application records become part of the relevant employment record. Employment, payroll, training, health, disciplinary and DBS records may have different periods.

Records needed for an investigation or legal hold may be kept beyond their usual period while that need continues. We review continued retention. You can contact us for the period applicable to a particular record. When information is no longer needed, we securely delete, anonymise or destroy it, including managing archived and backup copies appropriately.

13. Security and personal data breaches

We take technical and organisational measures appropriate to the risks, including access restrictions, individual accounts, authentication controls, staff confidentiality and training, secure storage, supplier controls, backups and incident procedures. Measures depend on the system and activity. We use digital systems to reduce paper where practical; necessary paper records must still be protected and securely shredded or otherwise destroyed when due for disposal.

We assess suspected breaches and take steps to contain harm. Where notification is required, we notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware. Where a breach is likely to create a high risk to people, we inform affected individuals without undue delay unless a lawful exception applies. Not every security incident requires notification.

14. Internal processing and transfers

Some service providers may store information outside the UK or allow access from another country. We assess these arrangements; UK storage alone does not establish that there is no overseas access.

Where a restricted international transfer occurs, we use an applicable UK adequacy arrangement or appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses, with the required assessment of protection. An exception is used only where its conditions are satisfied.

Contact us for the destinations, recipients and transfer arrangements applicable to your information and for a copy of the relevant safeguards, subject to necessary redactions. Additional supplier or process-specific information explains the arrangements relevant to that activity.

15. Your rights

Depending on the legal basis and circumstances, you may request access to your information, correction, erasure, restriction or data portability. You may object to processing based on legitimate interests on grounds relating to your situation. You have an absolute right to object to direct marketing, including associated profiling. Where we rely on consent, you can withdraw it without affecting earlier lawful processing.

Rights have conditions and exemptions. For example, some care or employment records must be retained to meet legal duties. We consider each request and explain any refusal or restriction. Safeguards for significant solely automated decisions are described in section 10.

Use the contact details in section 1. Requests are normally free. We may charge a reasonable fee or refuse a request only where the law permits it, and we explain the reason. We may ask for information reasonably needed to verify identity or authority to act for another person.

We normally respond without undue delay and within one month. Where permitted for complex or multiple requests, we may extend by up to two further months and explain this within the initial period. Any permitted adjustment for necessary identity checks or clarification is explained. You can ask us for help making a request.

16. Complaints

If you are concerned about our handling of information, contact us using section 1. You may complain by email, post or telephone; ask for assistance if needed. Tell us what happened and how we can contact you. We acknowledge data protection complaints within 30 days, make appropriate enquiries, keep you informed and communicate the outcome without undue delay.
You can also complain to the Information Commissioner’s Office, independently of our process: or telephone 0303 123 1113. The postal address is Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

17. Children and changes to this notice

Lidder Home Care provides domiciliary care to adults aged 18 and over. Our website is not directed at children. We may receive limited information about children connected with an adult’s care, a worker’s dependants or another necessary interaction. We use it only where necessary and lawful, with appropriate safeguards and suitable privacy information. We do not apply a blanket parental-consent rule to every use of children’s information.

We update this notice when relevant services, systems, purposes or legal requirements change. The website shows the current revision date. We provide further information about material changes and new uses where required, rather than relying solely on visitors checking this page.