Privacy & Data Protection Policy

Ontra Healthcare is committed to safeguarding the privacy of our service users, their families, our staff, and visitors to our website and care facilities. This policy outlines how we handle personal and sensitive care data in compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and Care Quality Commission (CQC) regulatory standards.

1. Data Controller Information

Ontra Healthcare operates as the Data Controller responsible for the processing of your personal data collected through our website, care assessments, support plans, and service delivery.

2. Types of Information We Collect

To deliver high-quality, personalised care and manage our employment relationships, we may collect and process the following categories of information:

• Personal Identifiers: Names, dates of birth, contact details (address, phone number, email address), emergency contacts, next of kin.
• Special Category Health & Care Data: Medical histories, support plans, dietary requirements, mental health assessments, medication administration records, risk assessments, and behavioral support plans.
• Recruitment & Staff Data: CVs, employment references, Disclosure and Barring Service (DBS) certificates, right to work verification, and professional training certifications.
• Technical & Website Data: IP addresses, browser types, page interaction statistics collected anonymously to enhance website performance.

3. Lawful Bases for Processing

We process personal data strictly in accordance with lawful bases defined in Article 6 and Article 9 of the UK GDPR:

4. Data Security & Confidentiality

We maintain rigorous technical and organisational security measures to protect data from unauthorised access, loss, alteration, or disclosure. All digital care management systems utilize enterprise-grade encryption, role-based access control, and audited activity logs. Physical documents are secured in locked, fireproof storage facilities.

5. Information Sharing

We never sell or rent personal information to third parties. Information is only shared on a strict need-to-know basis with:

• Multi-disciplinary teams, NHS practitioners, GPs, social workers, and local authority commissioning partners involved directly in the person's care.
• Statutory regulators including the Care Quality Commission (CQC) and Safeguarding Adults/Children Boards.
• Secure third-party IT service providers operating under strict UK GDPR Data Processing Agreements.

6. Retention of Records

Care records and employee files are retained in accordance with the Records Management Code of Practice for Health and Social Care and statutory retention periods. When retention periods expire, records are securely destroyed or permanently anonymised.

7. Your Individual Rights

Under the UK GDPR, you hold specific rights regarding your personal data:

• Right of Access: You can request a copy of the personal information we hold about you (Subject Access Request).
• Right to Rectification: You can ask us to correct inaccurate or incomplete details.
• Right to Erasure: In certain circumstances, you may request the deletion of personal data where retention is no longer legally required.
• Right to Restrict or Object: You may object to specific processing activities or request restriction while inquiries are investigated.

To exercise any of these rights, please contact our Data Protection Lead in writing at info@ontrahealthcare.co.uk. We respond to all verified requests within one calendar month at no charge.

8. Complaints & Supervisory Authority

If you have any concerns regarding how your data is handled, we encourage you to contact us first so we can resolve the issue promptly. You also retain the statutory right to lodge a formal complaint with the UK Information Commissioner’s Office (ICO):