Privacy Notice – People Who Use Our Services
Last updated: June 2026
1. Who we are
Dementia Resource Community Ltd is a CQCregistered community nursing service.
We are the data controller for the personal information we collect and process.
• Email: admin@drc.care
• Regulator: Care Quality Commission (CQC)
This privacy notice explains how we use personal information, how we keep it safe, and your rights under data protection law.
2. Why we collect personal information
We collect and use personal information so that we can:
• Provide safe, effective nursing and care services
• Assess needs and plan care
• Safeguard people at risk
• Communicate with professionals involved in your care
• Meet legal, regulatory, and contractual requirements
We only collect information that is necessary and lawful.
3. What information we collect
Personal information
This may include:
• Name, address, date of birth
• Contact details
• Next of kin or legal representatives
• Funding and payment arrangements
Health and care information (special category data)
This may include:
• Physical and mental health information
• Care plans, assessments, and risk information
• Medication and treatment details
• Capacity and consent records
• Information about race, religion, or sexual orientation where relevant to care
Health and care information receives extra protection under the law.
4. Legal basis for using your information
Under UK data protection law (UK GDPR), we are allowed to process personal data because:
• It is necessary to comply with legal obligations
• It is required to carry out tasks in the public interest
• It is necessary to provide health and social care services
• In limited situations, we may ask for your consent (for example, for optional information sharing beyond care)
Legitimate interests, where individuals contact us directly with an enquiry and we need to respond appropriately
We do not rely on consent to deliver essential care.
5. How information is collected and used
Information may be collected:
• Directly from you or your representative
• From GPs, hospitals, pharmacies, or social services
• Through facetoface contact, phone, email, post, or secure systems
Information is stored securely and only accessed by authorised staff.
6. Who we share information with
We may share information on a needtoknow basis with:
• GPs, hospitals, nurses, and other healthcare professionals
• Pharmacies
• Local authorities and social workers
• NHS organisations
• Safeguarding teams
• Care Quality Commission (CQC)
• Police or courts where legally required
• Family members or friends, with your permission
We do not use personal information for marketing or insurance purposes.
7. National Data OptOut
As a CQCregistered health and social care provider, we are legally required to comply with the National Data OptOut (mandatory since 31 July 2022).
The National Data OptOut allows you to stop your confidential patient information being used for purposes beyond your direct care, such as planning or research.
What this means for you
• Your information will always be used for your direct care
• Opting out will not affect your care
• Where the optout applies, we will respect your decision
At present, we do not routinely share confidential patient information for research or planning purposes beyond direct care. If this changes, you will be informed.
How to opt out
You can set or change your choice at any time:
• Website: https://digital.nhs.uk/services/national-data-opt-out
• Phone: 0300 303 5678
If you lack capacity, the decision can be made by someone legally authorised to act on your behalf, such as a Lasting Power of Attorney (LPA).
8. How long we keep information
We keep personal information in line with:
• NHS Records Management Code of Practice
• Information Governance Alliance guidance
• Legal and regulatory requirements
Adult social care records are usually retained for at least 8 years after care ends.
9. Your rights
You have the right to:
• Access your personal information
• Ask for incorrect information to be corrected
• Request deletion where appropriate
• Ask us to restrict how we use your information
• Object to certain types of processing
• Withdraw consent (where consent is used)
Requests are normally responded to within one month.
10. If you have concerns
If you have concerns
If you have any questions or concerns about how we use your personal data, you can contact us at:
Email: admin@drc.care
We will acknowledge your complaint within 30 days and aim to respond without undue delay.
We keep a record of data protection complaints and how they are handled.
If you are not satisfied with our response, you have the right to complain to the Information Commissioner’s Office (ICO).
- Website enquiries
When you contact us via our website, email or phone, we will collect your name, contact details and any information you choose to provide.
We use this information to respond to your enquiry and provide appropriate support.
Please avoid including detailed medical or sensitive information in initial enquiries. If further information is required, we will collect it securely.
The legal basis for this processing is our legitimate interests in responding to enquiries and, where appropriate, taking steps at your request prior to providing care services.
DATA PROTECTION LEAD
Dementia Resource Community Ltd has appointed a Data Protection Lead who is responsible for overseeing compliance with data protection legislation and information governance requirements.
Data Protection Lead: Helen Lovett
Email: helen.lovett@nhs.net
Any questions regarding this Privacy Notice or the way we process personal information should be directed to the Data Protection Lead.
AUTOMATED DECISION-MAKING AND ARTIFICIAL INTELLIGENCE
We do not make decisions about individuals solely through automated means.
Any decisions regarding care, assessments, referrals, safeguarding, treatment, or service provision are made by appropriately qualified professionals.
We may use administrative technologies, including artificial intelligence (AI) tools, to assist with tasks such as drafting documents, improving service efficiency, analysing trends, summarising information, or supporting service administration.
Where AI-assisted tools are used, outputs are reviewed by a member of staff before any action is taken.
AI systems are not used to make clinical decisions without appropriate human oversight.
SERVICE PROVIDERS AND DATA PROCESSORS
We use trusted third-party suppliers to help us operate our services. These may include:
• Secure cloud storage providers
• Electronic care planning systems
• Email and communication providers
• IT support providers
• Website hosting providers
• Secure document management systems
All suppliers are subject to contractual requirements to protect personal information and may only process information on our instructions and in accordance with applicable data protection legislation.
WEBSITE ANALYTICS AND COOKIES
Our website may use cookies and similar technologies to improve user experience, maintain website security, and understand how visitors use our website.
Where required by law, we will seek your consent before placing non-essential cookies on your device.
Analytics information is generally collected in an aggregated form and is not used to identify individuals.
Further information is available in our Cookie Policy.
RESEARCH, AUDIT AND SERVICE IMPROVEMENT
We may use information for:
• Clinical audit
• Quality assurance
• Service monitoring
• Regulatory inspections
• Service improvement activities
Where possible, information used for these purposes will be anonymised or pseudonymised.
Any use of confidential patient information beyond direct care will be undertaken in accordance with applicable legal requirements and the National Data Opt-Out where relevant.
INTERNATIONAL TRANSFERS
We primarily store and process information within the United Kingdom.
Where information is transferred outside the UK, we will ensure appropriate safeguards are in place in accordance with UK data protection law.
CHILDREN AND YOUNG PEOPLE
Our services are primarily provided to adults.
Where we process information relating to children or young people, we do so in accordance with applicable safeguarding and data protection requirements.
DATA PROTECTION COMPLAINTS
If you have concerns about how we handle your personal information, please contact our Data Protection Lead in the first instance:
Helen Lovett
Data Protection Lead
Email: helen.lovett@nhs.net
We will acknowledge your complaint within 30 days and aim to resolve concerns promptly and fairly.
We keep a record of data protection complaints and how they are handled.
If you remain dissatisfied with our response, you have the right to complain to the Information Commissioner’s Office (ICO).
Information Commissioner’s Office
Website: www.ico.org.uk
Telephone: 0303 123 1113
CHANGES TO THIS PRIVACY NOTICE
We may update this Privacy Notice from time to time to reflect changes in legislation, regulation, guidance, or our services.
The latest version will always be available on our website.
Last reviewed: April 2026