Privacy Policy

Last updated: March 2026.

Introduction

OliveCross Healthcare Ltd ('we', 'us', 'our') is committed to protecting the privacy and security of your personal data. This privacy policy explains how we collect, use, store, and protect information about you in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

OliveCross Healthcare Ltd is the data controller for the personal data we process. Our registered address is 3rd and 4th Floors, 84 Salop Street, Wolverhampton, WV3 0SR.

Personal Data We Collect

Identity data: full name, date of birth, gender, marital status, National Insurance number (where required)
Contact data: home address, email address, telephone numbers
Health data: medical conditions, diagnoses, medication details, care needs, GP information, hospital records (special category data under UK GDPR)
Financial data: funding source, financial assessment information, bank details for direct payment arrangements
Next of kin and emergency contact details
Care records: care plans, daily visit notes, medication administration records, risk assessments, incident reports
Recruitment data: CVs, application forms, references, DBS check results, training records, NMC or other professional registration details
Website data: IP address, browser type, pages visited, and cookies (if you use our website)

How We Use Your Data

To assess your care needs and develop a personalised, person-centred care plan
To deliver safe, effective, and high-quality home care services
To communicate with you, your family, and healthcare professionals involved in your care
To manage medications safely, including maintaining accurate medication administration records
To meet our legal and regulatory obligations, including reporting to the CQC and safeguarding duties
To manage our workforce, including recruitment, training, supervision, and payroll
To respond to complaints, feedback, and safeguarding concerns
To improve our services through quality monitoring, audit, and analysis

Legal Basis for Processing

Consent: where you have given clear, informed consent for a specific purpose
Contract: where processing is necessary for a care service agreement
Legal obligation: where required by law (CQC regulations, safeguarding duties, employment law)
Vital interests: where necessary to protect someone's life in an emergency
Legitimate interests: where necessary for our business operations, provided your rights are not overridden

For health data and other special category data, we rely on the condition that processing is necessary for the provision of health or social care under Article 9(2)(h) of UK GDPR.

Who We Share Data With

Healthcare professionals involved in your care, including GPs, district nurses, hospital teams, and specialist practitioners
The City of West Midlands Council, where they are funding or coordinating your care
NHS bodies, where relevant to your care or funding
The Care Quality Commission, as required by regulation
Emergency services, where necessary to protect your safety
Our digital care management platform provider, who processes data on our behalf under a strict data processing agreement

We will never sell your personal data to third parties, and we will never use it for marketing purposes without your explicit consent.

Data Security

We take the security of your data seriously. We have implemented appropriate technical and organisational measures, including encrypted digital systems, role-based access controls, secure physical storage, regular security reviews, and mandatory staff data protection training.

Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Care records are retained for a minimum of eight years after the care arrangement ends, in line with NHS and social care retention guidance. Recruitment records for unsuccessful applicants are retained for six months.

Your Rights Under UK GDPR

Right of access: to request a copy of the personal data we hold about you
Right to rectification: to request correction of inaccurate or incomplete data
Right to erasure: to request deletion of your data in certain circumstances
Right to restrict processing: to request limits on how we use your data
Right to data portability: to request transfer of your data to another organisation
Right to object: to object to certain types of processing
Right to withdraw consent: where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, please contact us at info@olivecrosshealthcare.co.uk or call 0333 772 4801. We will respond within one month.

Complaints

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at www.ico.org.uk or by calling 0303 123 1113.

Updates to This Policy

We may update this privacy policy from time to time. The latest version will always be available on our website at www.olivecrosshealthcare.co.uk/privacy.