Privacy Notice

This Privacy Notice explains how Crelake House collects, uses, stores, and shares personal information about residents, staff, relatives, and visitors.
It ensures transparency under the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018.

Who We Are

Crelake House provides residential care services regulated under the Health and Social Care Act 2008.
Registered with: Care Quality Commission (CQC)
Data Controller: Crelake House / Crelake Care Ltd
Registered Manager: Ioan - Ciprian Popa
ICO Registration Number:  ZB537972.

Contact:
Crelake House, 4 Whitchurch Road, Tavistock, PL19 9BB
Cjpopa@crelakehosue.co.uk | 01822616224

Whose Data We Collect

• Residents – personal, medical, care, and financial information.

• Relatives / Representatives – contact and relationship details.

• Staff / Contractors – employment, payroll, and training records.

• Visitors / Professionals – identification and access information.

What Data We Collect

Category	Examples	Purpose
Identification	Name, DOB, NHS number, photograph	Verify identity, provide personalised care
Health & Care	GP, diagnosis, allergies, medication, care plans	Deliver safe and effective care
Financial	Fees, funding, next-of-kin payments	Manage accounts, invoicing
Contact	Phone, email, address	Communication, emergencies
Employment	References, DBS, payroll, training	HR and legal obligations
CCTV	Video footage (public areas)	Safety, safeguarding, security

Lawful Bases for Processing

Lawful Basis (UK GDPR)	Example
Contract	Providing care under a service agreement
Legal Obligation	Employment law, CQC regulations, safeguarding duties
Vital Interests	Sharing medical information in emergencies
Public Task	Collaboration with health and social care agencies
Consent	Use of photos, certain data sharing, optional activities
Legitimate Interests	Site safety, staff management, service improvement

Special category data (health, ethnicity, religion) is processed under Article 9(2)(h) – health and social care provision.

How We Collect Data

• Directly from residents or their representatives

• From GPs, hospitals, social workers or other professionals

• From staff, job applicants, and contractors

Data is recorded securely in the PCS (Person Centred Software) system or locked cabinets

How We Use and Share Information

We use data to:

• Deliver safe, person-centred care

• Communicate with families and professionals

• Meet CQC and local authority requirements

• Ensure safety, safeguarding, and staff management

We share information only with authorised partners such as:

• GPs, hospitals, and pharmacies

• Local authorities and safeguarding teams

• CQC (regulatory purposes)

• Payroll and pension providers

• Insurers or legal representatives (where appropriate)

No information is shared outside the UK without consent and safeguards.

Data Retention and Disposal

All records follow statutory retention periods under the Records Management Code of Practice for Health and Social Care 2023 (e.g., resident records – 8 years after death/discharge).
When no longer required, records are securely destroyed or erased.

Your Rights

Under the UK GDPR you have the right to:

• Access your information (Subject Access Request)

• Rectify incorrect data

• Request erasure (“right to be forgotten”)

• Restrict or object to processing

• Data portability (where applicable)

Requests should be made in writing to the Registered Manager.

If you are not satisfied, you may contact the Information Commissioner’s Office (ICO):
www.ico.org.uk | ☎️ 0303 123 1113

Automated Decision Making

Crelake House does not carry out automated decision-making or profiling.

How We Protect Your Data

• Encrypted PCS system access with unique logins and MFA

• Firewalls, antivirus and secure Wi-Fi networks

• Encrypted backups and restricted physical access

• Confidential waste disposal

• Regular staff training and audits

Updates

This Privacy Notice is reviewed annually and updated whenever data-processing activities change.
Last Reviewed: 28/10/2025