Confidentiality & Data Protection

Why this matters

We hold deeply personal information about the people we support — health conditions, home access details, family situations. Health and care information is special-category data under UK GDPR, with the highest legal protection. One careless message can destroy the trust our care depends on.

The rules

• Share client information only with people who need it to deliver that person's care: colleagues on their rota, managers, and health professionals involved in their care.
• Never discuss clients in public places, with your family or friends, or with other clients — even without names, small communities identify people easily.
• Never post anything about work, clients or their homes on social media. No photos in or of a client's home, ever, unless the support plan explicitly requires it through the Hub.
• No client details over WhatsApp, text or personal email — names, addresses, conditions or door codes. Work information travels through the Hub or a phone call to the office.
• Keep paper (run sheets, notes) out of sight in transit and return or destroy it as instructed. Key-safe codes are never written on anything that also shows an address.

Clients' rights

• People can ask to see the information we hold about them (a subject access request). If a client or family member asks, don't refuse or promise anything — pass the request to your manager the same day; we have one month to respond.
• If you realise information has been lost or sent to the wrong person, report it to your manager immediately. Some breaches must reach the ICO within 72 hours, so speed matters and honesty is never punished.