This is a working draft prepared to give your solicitor and Data Protection Officer a substantive starting point rather than a blank page. It has not been reviewed by a legal professional. Every amber-flagged item below must be completed, and the whole document checked, before this website goes live. Bellus Care & Support processes special category health data, so this is not a document to publish on trust.

This policy explains what personal information we collect, why we collect it, what we do with it and what rights you have. It applies to this website and to our services.

We take this seriously because of what we do. Much of the information we hold is about people's health, care needs and personal circumstances — some of the most sensitive information there is.

Who we are

Bellus Care & Support is the data controller for the information described in this policy.

Registered office: ADDRESS
Company registration number: NUMBER
ICO data protection registration: NUMBER
Data protection contact: NAME, ROLE, EMAIL, PHONE — and confirm whether a statutory DPO is required and appointed

Who this policy covers

We hold information about several different groups of people, and what we do with it differs by group:

People we support and people referred to us
Families, next of kin, advocates, attorneys and deputies
People who enquire through this website or by phone
Professionals who refer to us — commissioners, social workers, case managers, clinicians
Job applicants and staff
Website visitors

What information we collect

If you enquire through this website

Your name, phone number, email address, the nature of your enquiry and anything you choose to tell us in the message box. Please don't put detailed health information into the enquiry form — a phone call is safer and easier.

If you are referred to us, or we support you

This will usually include contact details, date of birth, NHS number, next of kin, funding arrangements, and — because we cannot provide safe care without it — information about your health, disabilities, diagnoses, medication, risks, behaviour support needs and care history. This is special category data under UK GDPR and we treat it accordingly.

We may also hold information about criminal convictions or forensic history where it is relevant to assessing risk and providing safe support.

If you make a professional referral

Your name, organisation, role and contact details, together with the information you provide about the person you are referring.

If you apply to work with us

Application details, employment history, references, right-to-work documents, DBS check results and training records. CONFIRM full list and any occupational health data

When you use this website

Technical information such as IP address, browser type, pages visited and how you arrived. See our cookie policy.

Where we get information from

Usually from you directly. We also receive information from local authorities and NHS bodies, referring professionals, previous care providers, GPs and clinicians, and family members or advocates acting on someone's behalf.

Why we use it, and our lawful basis

Under UK GDPR we must have a lawful basis for using personal data, and an additional condition for special category data. THE TABLE BELOW IS A STARTING POINT ONLY. Your DPO or solicitor must confirm each lawful basis and Article 9 condition, and complete a Legitimate Interests Assessment for any row relying on legitimate interests, and an Appropriate Policy Document where required by Schedule 1 of the Data Protection Act 2018.

What we do	Lawful basis (Art. 6)	Condition for health data (Art. 9)
Responding to your enquiry	Legitimate interests / steps prior to a contract	Not usually applicable
Assessing a referral and deciding whether we can support someone safely	Legitimate interests / contract	Art. 9(2)(h) — provision of health or social care
Delivering care and support	Contract / legal obligation	Art. 9(2)(h)
Safeguarding adults at risk	Legal obligation / vital interests	Art. 9(2)(b), (c) or DPA 2018 Sch.1 safeguarding condition
Meeting our regulatory duties to the CQC	Legal obligation	Art. 9(2)(h) / (i)
Recruitment and employment	Contract / legal obligation	Art. 9(2)(b)
Sending you marketing you asked for	Consent	Not applicable

Who we share information with

We do not sell your information, and we never will. We share it only where we need to:

Local authorities and NHS bodies funding or commissioning care
Healthcare professionals involved in someone's care — GPs, community teams, therapists, hospitals
Safeguarding authorities and the police, where there is a risk of harm
The Care Quality Commission, as part of our regulatory obligations
Family members and advocates, where the person has agreed or where there is a legal authority to act
Our IT and software suppliers, who process data on our behalf under contract — LIST processors: CRM/website platform, care planning system, payroll, email. A record of processing and a processor contract is needed for each.

Where your information is held

CONFIRM whether any processor stores or accesses data outside the UK, and if so the transfer mechanism — adequacy regulations, the International Data Transfer Agreement or the UK Addendum. This website and CRM platform is a US-headquartered service, so this section needs real attention rather than a boilerplate answer.

How long we keep it

RETENTION SCHEDULE REQUIRED. Care records, safeguarding records, staff records, recruitment records and enquiry records all have different retention periods. Set them, write them here, and be able to evidence that you follow them.

How we keep it safe

We use appropriate technical and organisational measures to protect personal information, including access controls, staff training and confidentiality obligations. EXPAND with the actual measures in place — encryption, access control model, staff DP training frequency, breach response process, and who to notify.

Your rights

Under UK data protection law you have the right to:

Ask for a copy of the information we hold about you (a subject access request)
Ask us to correct information that is wrong
Ask us to delete information, in some circumstances
Ask us to restrict how we use it, in some circumstances
Object to us using it, in some circumstances
Ask for your information in a portable format, in some circumstances
Withdraw consent at any time, where we rely on consent

Some of these rights are limited where we have a legal or regulatory duty to keep records — for example, care records we are required to retain. We will always explain our reasoning.

To exercise any of these, contact DATA PROTECTION CONTACT. We will respond within one month.

Making a complaint

If you are unhappy with how we have handled your information, please tell us first — see our complaints page. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Changes to this policy

We review this policy regularly. When we make significant changes we will update the date at the top and, where appropriate, tell people directly.

Still to be resolved before publication

A Data Protection Impact Assessment for the online referral form, which collects special category data over the open web
A decision on whether that form should sit behind a professional login instead
Retention schedule
Record of processing activities and processor contracts
Confirmation of international transfer arrangements
Whether a statutory DPO is required