Effective date: June 2026 
Next review date: June 2027

Review note: This Privacy Policy should be reviewed annually or earlier if there are changes to legislation, website functions, service delivery arrangements, referral processes, commissioning requirements or data protection guidance.

1. Policy Statement

Heathview Pathways Ltd is committed to protecting the privacy, dignity and confidentiality of all individuals who use, access or engage with our services.

We recognise that, as a supported accommodation provider, we may collect and process personal information relating to residents, prospective residents, referral agencies, local authorities, social workers, healthcare professionals, staff, contractors, visitors and other professional partners.

We understand that some of the information we handle may be sensitive, including information relating to health, safeguarding, risk, vulnerability, support needs, accommodation history, mental wellbeing and personal circumstances.

Heathview Pathways Ltd will handle all personal information lawfully, fairly, transparently and securely, and will only use personal information where there is a clear and appropriate reason to do so.

This policy should be read alongside our Confidentiality Policy, Safeguarding Policy, Referral and Assessment Policy, Support Planning Policy, Complaints Policy and other relevant organisational policies.

2. Purpose of this Policy

The purpose of this Privacy Policy is to explain:

• What personal information we collect.
• Why we collect and use personal information.
• How we use personal information.
• Who we may share information with.
• How we keep information safe.
• How long we keep information.
• What rights individuals have in relation to their personal information.
• How individuals can raise questions or concerns about how their information is handled.

This policy applies to information collected through our website, referral forms, email communication, telephone enquiries, professional referrals, assessments, support planning, resident records, incident reporting, safeguarding processes, staff records and day-to-day service delivery.

3. Who this Policy Applies To

This policy applies to personal information relating to:

• Residents.
• Prospective residents.
• Individuals referred to Heathview Pathways Ltd.
• Family members or representatives where relevant.
• Referring professionals.
• Local authorities and commissioning bodies.
• Social workers, personal advisors and support agencies.
• Health and social care professionals.
• Staff, workers, volunteers and contractors.
• Visitors to our accommodation.
• Website visitors.
• Anyone who contacts Heathview Pathways Ltd by telephone, email, website form, post or in person.

4. Our Role as Data Controller

For most of the personal information we collect and use, Heathview Pathways Ltd is the Data Controller. This means we are responsible for deciding why and how personal information is used.

In some circumstances, we may process information on behalf of another organisation, such as a local authority, commissioner or referring agency. Where this applies, responsibilities for information handling may be set out within referral, placement, contract or commissioning arrangements.

5. Types of Personal Information We May Collect

Depending on the nature of the enquiry, referral, placement or working relationship, Heathview Pathways Ltd may collect and process the following types of personal information:

General Personal Information

• Full name.
• Date of birth.
• Age.
• Gender.
• Address and previous addresses.
• Telephone number.
• Email address.
• Emergency contact details.
• Nationality.
• NHS number, where relevant.
• Identification information, where required.
• Referrer details.
• Professional contact details.
• Placement and accommodation details.
• Financial or funding information relating to placement arrangements.

Referral and Assessment Information

• Reason for referral.
• Current accommodation status.
• Placement history.
• Support needs.
• Risk information.
• Safeguarding concerns.
• Known triggers or vulnerability factors.
• Details of professional involvement.
• Requested move-in date.
• Suitability assessment information.
• Support planning information.

Your existing referral and support documentation includes information such as current risks, support needs, placement history, funding arrangement, professional involvement and safeguarding concerns.

Support and Accommodation Information

• Support plans.
• Risk assessments.
• Review records.
• Key worker session notes.
• Welfare check records.
• Incident records.
• Behavioural concerns.
• Complaints or feedback.
• House meeting records.
• Licence agreement information.
• Move-on planning information.

Sensitive or Special Category Information

We may process more sensitive personal information where it is necessary and lawful to do so. This may include:

• Physical health information.
• Mental health and emotional wellbeing information.
• Disability information.
• Medication-related information, where relevant.
• Safeguarding information.
• Domestic abuse information.
• Vulnerability or exploitation concerns.
• Religious or cultural needs, where relevant to support.
• Information relating to risk, self-harm, substance misuse or safety concerns.
• Information relating to criminal allegations, offending history or police involvement, where relevant to placement suitability, safeguarding or risk management.

The UK GDPR treats health information and other sensitive information as special category data, and organisations need both a lawful basis and an additional condition to process this type of information. 

6. How We Collect Personal Information

We may collect personal information directly from the individual or from other people and organisations involved in their support, referral or placement.

Information may be collected through:

• Website enquiry forms.
• Email enquiries.
• Telephone calls.
• Referral forms.
• Assessment meetings.
• Professional referrals.
• Local authority placement requests.
• Social workers or personal advisors.
• Support planning meetings.
• Risk assessment processes.
• Incident reports.
• Safeguarding reports.
• Complaints and feedback.
• Staff recruitment and employment processes.
• Visitor records.
• CCTV systems, where in operation and clearly notified.

7. Why We Use Personal Information

Heathview Pathways Ltd uses personal information for the following purposes:

• To respond to enquiries.
• To assess referral suitability.
• To consider placement compatibility.
• To provide safe and appropriate accommodation.
• To deliver housing-related and community-based support.
• To create and review support plans.
• To assess, manage and reduce risk.
• To promote safeguarding and wellbeing.
• To communicate with residents and professionals.
• To work collaboratively with local authorities, social workers and support agencies.
• To manage licence agreements and placement arrangements.
• To maintain accurate records.
• To respond to incidents, complaints or concerns.
• To meet legal, safeguarding, contractual and regulatory responsibilities.
• To improve service quality.
• To manage staff, recruitment, training and supervision.
• To maintain property safety and security.
• To manage website enquiries and communication.

Heathview Pathways’ wider service documents describe the service as safe, structured and person-centred, with support tailored to individual needs and with safeguarding, risk assessment, support planning and professional collaboration forming part of service delivery.

8. Lawful Basis for Processing Personal Information

Under UK data protection law, Heathview Pathways Ltd must have a lawful basis for processing personal information.

Depending on the circumstances, we may rely on one or more of the following lawful bases:

Consent

Where an individual has clearly agreed to us using their information for a specific purpose.

Contract

Where processing is necessary in relation to a placement agreement, licence agreement, service agreement, employment contract or other contractual arrangement.

Legal Obligation

Where we need to process information to comply with the law.

Vital Interests

Where processing is necessary to protect someone’s life or prevent serious harm.

Public Task

Where information is processed as part of a task carried out in the public interest, where applicable through statutory or public authority involvement.

Legitimate Interests

Where processing is necessary for the legitimate interests of Heathview Pathways Ltd or another organisation, provided those interests are not overridden by the rights and freedoms of the individual.

Examples may include managing service enquiries, maintaining safe accommodation, responding to complaints, improving services, managing professional relationships and protecting staff, residents and property.

The ICO confirms that organisations must identify a lawful basis before processing or sharing personal data.

9. Special Category Data and Sensitive Information

Because Heathview Pathways Ltd provides supported accommodation and support services, we may need to process sensitive information in order to understand needs, manage risk and promote safety.

This may include information relating to health, mental wellbeing, disability, safeguarding, domestic abuse, vulnerability, exploitation, substance misuse or other sensitive circumstances.

Where we process special category data, we will only do so where there is a lawful basis and an additional legal condition for processing this information.

We will ensure that sensitive information is:

• Collected only where necessary.
• Used only for appropriate purposes.
• Shared only where there is a lawful and justified reason.
• Kept secure.
• Accessed only by those who need to know.
• Reviewed and retained only for as long as necessary.

The ICO advises that privacy information should make clear which categories of special category data are being processed.

10. Safeguarding and Limits to Confidentiality

Heathview Pathways Ltd respects confidentiality and privacy. However, confidentiality is not absolute.

There may be circumstances where we need to share information without consent, particularly where there are concerns about:

• Risk of harm to the individual.
• Risk of harm to another resident.
• Risk to staff, visitors or the public.
• Safeguarding concerns.
• Abuse, neglect or exploitation.
• Criminal activity.
• Serious health and safety concerns.
• Emergency situations.
• Legal or regulatory requirements.

This reflects the approach already set out in your Confidentiality Policy, which states that Heathview Pathways cannot guarantee full confidentiality where safeguarding duties or public interest responsibilities are greater than the responsibility to an individual.

Where information needs to be shared, we will aim to share only what is necessary, with the appropriate person or organisation, and with suitable records of the decision and reason for sharing.

11. Who We May Share Information With

Where necessary and lawful, Heathview Pathways Ltd may share personal information with:

• Local authorities.
• Social workers.
• Personal advisors.
• Commissioners.
• Safeguarding teams.
• Healthcare professionals.
• Mental health services.
• Police.
• Emergency services.
• Housing teams.
• Probation or youth justice services, where relevant.
• Support agencies.
• Advocacy services.
• Education, training or employment providers, where relevant.
• Family members or representatives, where appropriate and lawful.
• Legal advisors.
• Insurance providers.
• Professional consultants.
• IT and website service providers.
• Accountants or payroll providers.
• Regulatory or statutory bodies where required.

Information will only be shared where there is a proper reason to do so, such as safeguarding, risk management, service delivery, legal compliance, contractual necessity or consent.

12. Website Information and Cookies

When someone visits the Heathview Pathways Ltd website, we may collect basic technical information such as:

• IP address.
• Browser type.
• Device type.
• Pages visited.
• Date and time of visit.
• Website enquiry form submissions.
• Cookie preferences.

Cookies may be used to help the website function properly, improve user experience, understand website performance or support website security.

Where non-essential cookies are used, visitors should be given clear information and, where required, the opportunity to accept or reject them.

A separate Cookie Policy or cookie notice may be used on the website to explain what cookies are used and how visitors can manage their preferences.

13. How We Keep Personal Information Safe

Heathview Pathways Ltd will take appropriate steps to protect personal information from loss, misuse, unauthorised access, disclosure, alteration or destruction.

Security measures may include:

• Password-protected systems.
• Restricted access to records.
• Secure storage of paper files.
• Use of encrypted devices or secure systems where appropriate.
• Staff confidentiality expectations.
• Clear information-sharing procedures.
• Secure email and document handling where possible.
• Regular review of records.
• Safe disposal of confidential information.
• Staff training and supervision.
• Incident reporting where a data breach is suspected.

All staff, workers and contractors are expected to treat personal information confidentially and in line with Heathview Pathways Ltd policies and procedures.

14. Data Accuracy

Heathview Pathways Ltd will take reasonable steps to ensure that personal information is accurate, relevant and kept up to date.

Individuals, residents, staff and professionals are encouraged to inform us of any changes to personal details, contact information, support needs, risk information or professional involvement.

Where information is found to be inaccurate, we will take reasonable steps to correct or update it.

15. How Long We Keep Information

Heathview Pathways Ltd will only keep personal information for as long as necessary for the purpose it was collected, or for as long as required by law, regulation, contract, safeguarding guidance, insurance requirements or legitimate business need.

Retention periods may vary depending on the type of information, for example:

• Referral records.
• Resident records.
• Support plans.
• Safeguarding records.
• Incident reports.
• Complaints.
• Financial and invoicing records.
• Staff records.
• Website enquiry records.

Information will be securely destroyed or deleted when it is no longer required.

A separate Data Retention Schedule may be maintained by Heathview Pathways Ltd to support consistent record keeping.

16. Individual Rights

Under UK data protection law, individuals have rights in relation to their personal information.

These may include the right to:

• Be informed about how personal information is used.
• Access personal information held about them.
• Request correction of inaccurate information.
• Request deletion of information in certain circumstances.
• Request restriction of processing in certain circumstances.
• Object to processing in certain circumstances.
• Request data portability in certain circumstances.
• Withdraw consent where processing is based on consent.
• Complain about how their information is handled.

Some rights may not apply in all circumstances, particularly where information needs to be kept or shared for legal, safeguarding, contractual or public interest reasons.

The ICO confirms that individuals have the right to object to processing in certain circumstances.

17. Subject Access Requests

Individuals have the right to request access to personal information held about them.

Requests should be made in writing to Heathview Pathways Ltd using the contact details provided in this policy.

Before releasing information, we may need to verify the identity of the person making the request.

In some cases, information may be withheld or redacted where disclosure would affect the rights and freedoms of another person, prejudice safeguarding activity, affect legal obligations or where another exemption applies.

18. Data Breaches

A data breach may include:

• Personal information being sent to the wrong person.
• Loss of paperwork or electronic devices.
• Unauthorised access to records.
• Accidental disclosure of confidential information.
• Cyber security incidents.
• Loss, theft or misuse of personal data.

All suspected data breaches must be reported promptly to the Director or responsible manager.

Heathview Pathways Ltd will investigate the breach, take appropriate action, record the incident and, where required, report the breach to the Information Commissioner’s Office and/or affected individuals.

19. Staff Responsibilities

All staff, workers, volunteers and contractors working with or on behalf of Heathview Pathways Ltd are responsible for:

• Handling personal information confidentially.
• Accessing information only where necessary for their role.
• Sharing information only where there is a lawful and appropriate reason.
• Keeping records accurate and professional.
• Reporting concerns about confidentiality or data protection.
• Following organisational policies and procedures.
• Completing relevant training where required.
• Taking safeguarding responsibilities seriously.

Failure to handle personal information appropriately may result in management action, disciplinary action, contract review or referral to relevant external bodies where appropriate.

20. Privacy and Safeguarding Balance

Heathview Pathways Ltd recognises the importance of balancing privacy, dignity and confidentiality with our responsibility to safeguard residents, staff, visitors and the wider community.

We will always aim to respect privacy wherever possible. However, where there is a risk of harm, abuse, neglect, exploitation, criminal activity or serious concern, information may need to be shared with appropriate professionals or authorities.

Our approach will be proportionate, respectful and focused on safety, wellbeing and the protection of individuals.

21. Complaints and Concerns

Anyone who is concerned about how Heathview Pathways Ltd has handled their personal information should contact us using the details below.

We will take concerns seriously and aim to respond promptly and appropriately.

If an individual remains dissatisfied, they have the right to complain to the Information Commissioner’s Office.

22. Contact Details

Heathview Pathways Ltd
West Midlands, United Kingdom

Responsible Person: Jessie Samra, Director
Email: info@heathviewpathways.co.uk
Telephone: 07518 866 050
Website: www.heathviewpathways.co.uk

Information Commissioner’s Office:
Individuals can contact the ICO for advice or to raise a complaint about data protection matters.

23. Review

This policy will be reviewed annually or sooner if:

• UK GDPR or Data Protection Act requirements change.
• ICO guidance changes.
• Service delivery arrangements change.
• Website functions or cookies change.
• Referral or assessment processes change.
• A data breach, complaint or audit identifies the need for review.
• Commissioning, safeguarding or contractual requirements change.