HFHC Specialist Supported Living
Legal

Privacy Policy

How we collect, use, and protect your personal information.

Last updated: 21 May 2026

1. Who We Are

HFHC Specialist Supported Living (“we”, “us”, “our”) is the data controller responsible for your personal data. We are committed to protecting the privacy of everyone who interacts with us, including people who use our services, their families, visitors to our website, job applicants, and professional contacts.

If you have any questions about this policy or how we handle your personal data, please contact us:

2. What Information We Collect

We may collect and process the following types of personal data:

Information you provide to us

  • Name, email address, phone number, and postal address when you contact us or make an enquiry
  • Information submitted via our contact forms or by email
  • CV, qualifications, and employment history if you apply for a role with us
  • Details about care needs if you or a family member are enquiring about our services

Information collected automatically

  • Technical data such as your IP address, browser type, operating system, and device information
  • Details of your visits to our website, including pages viewed, time spent, and navigation paths
  • Cookie data (see our Cookies Policy for full details)

3. How We Use Your Information

We use your personal data for the following purposes:

  • Responding to enquiries - to answer your questions about our services, whether for yourself, a family member, or on behalf of a professional referral
  • Service delivery - to assess, plan, and provide specialist supported living services
  • Recruitment - to process job applications and manage our recruitment activities
  • Website improvement - to analyse how our website is used so we can improve your experience
  • Legal and regulatory obligations - to comply with our obligations under health and social care regulations, safeguarding duties, and other applicable laws
  • Communication - to keep you informed about our services where you have given consent or where we have a legitimate interest in doing so

4. Our Legal Basis for Processing

We process your personal data on the following legal bases under the UK General Data Protection Regulation (UK GDPR):

  • Consent - where you have given clear consent for us to process your personal data for a specific purpose (e.g. subscribing to updates)
  • Contract - where processing is necessary for a contract we have with you or to take steps at your request before entering into a contract
  • Legal obligation - where processing is necessary to comply with the law (e.g. safeguarding, CQC requirements, health and safety)
  • Legitimate interests - where processing is necessary for our legitimate business interests, provided these are not overridden by your rights (e.g. improving our website, responding to professional enquiries)
  • Vital interests - in rare cases, where processing is necessary to protect someone's life

Where we process special category data (such as health information), we do so on the basis of explicit consent, the provision of health or social care, or safeguarding obligations, as applicable.

5. Who We Share Your Data With

We may share your personal data with:

  • Local authorities, clinical commissioning groups, and integrated care boards involved in care arrangements
  • The Care Quality Commission (CQC) and other regulatory bodies where required
  • Healthcare professionals involved in the care and support of individuals using our services
  • Our IT and website hosting providers who process data on our behalf under strict data processing agreements
  • Professional advisors such as solicitors and accountants where necessary

We will never sell your personal data to third parties. We only share information where there is a lawful basis to do so.

6. How Long We Keep Your Data

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Specific retention periods vary depending on the type of data:

  • Website enquiries - retained for up to 12 months after your last contact with us, unless a longer period is required
  • Recruitment data - unsuccessful applications are retained for 6 months after the recruitment process concludes
  • Service user records - retained in accordance with health and social care record-keeping requirements [PLACEHOLDER - confirm retention period against your records management policy]

7. Your Rights

Under the UK GDPR, you have the following rights in relation to your personal data:

  • Access - you can request a copy of the personal data we hold about you
  • Rectification - you can ask us to correct inaccurate or incomplete data
  • Erasure - you can ask us to delete your personal data in certain circumstances
  • Restriction - you can ask us to restrict the processing of your data in certain circumstances
  • Portability - you can request your data in a structured, machine-readable format
  • Objection - you can object to processing based on legitimate interests or for direct marketing
  • Withdraw consent - where we rely on consent, you can withdraw it at any time

To exercise any of these rights, please contact us using the details in Section 1. We will respond to your request within one month.

If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

8. Data Security

We take the security of your personal data seriously. We have implemented appropriate technical and organisational measures to protect your data against unauthorised access, loss, destruction, or alteration. These measures include encrypted data transmission, access controls, and regular security reviews.

9. International Transfers

We do not routinely transfer personal data outside the United Kingdom. If any transfer is necessary (for example, through the use of cloud-based services), we ensure appropriate safeguards are in place in accordance with the UK GDPR.

10. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. Any significant changes will be communicated via our website. We encourage you to review this page periodically.

11. Contact Us

If you have any questions about this privacy policy or wish to exercise your data protection rights, please get in touch: