Adult Social Care Privacy Notice

Autism Together collects and processes personal data about individuals for the purpose of arranging, providing, managing and reviewing care and associated services. We are committed to protecting your privacy, keeping your information secure, and meeting our obligations under UK data protection law. 

Who are we? 

Autism Together provides services for autistic people, including registered residential care, vocational day services, supported living and work placements. 

What information do we collect? 

In order to provide services to you, we collect and process a range of information about you. This may include, but is not limited to: 

• Name, date of birth, address, gender and NHS number. 

• Details of your family and people who care for you. 

• Information about people who might legally represent you. 

• Details of placements, education or transition information, where relevant. 

• Details about your lifestyle, social and personal circumstances. 

• Visual images, personal appearance, behaviour and risk information. 

• Details about your learning needs. 

• Benefit entitlements. 

• Financial information for purposes of receiving or making payments and calculating how much you might have to pay towards some services we provide or organise for you.  

• Information provided by you, your family, representatives, commissioners, local authorities, NHS bodies, social workers, advocates, safeguarding bodies, or other professionals involved in your care and information from your GP records. 

We may also process the following special category data that requires more protection due to its confidential or sensitive nature: 

• Physical and mental health. 

• Racial or ethnic origin. 

• Religious or other beliefs of a similar nature. 

Other sensitive data that requires more protection: 

• Criminal convictions and offences (including alleged offences). 

Why we use your personal information 

• To communicate with you. 

• To undertake assessment of your needs. 

• To provide the services you have requested, or services requested for you. 

• To investigate concerns or complaints you may have. 

• To provide effective care and support. 

• To detect and prevent fraud or crime. 

• To help with service delivery and training of staff. 

Our lawful bases and conditions for processing 

• Legal obligation: where we need to comply with laws and regulatory duties that apply to our services, including adult social care, safeguarding, health and safety, accounting, audit, complaints, and statutory reporting requirements. 

• Legitimate interests: where processing is necessary for Autism Together’s legitimate interests, or those of a third party, and those interests are not overridden by your rights and freedoms. This may include managing services, maintaining records, handling complaints, improving quality, preventing fraud, ensuring security, and supporting day-to-day administration. 

• Recognised legitimate interests: where processing is necessary for one of the specific recognised legitimate interests set out in data protection law, such as safeguarding, preventing or detecting crime, responding to emergencies, protecting vulnerable individuals, or responding to requests from organisations carrying out public functions. 

• Vital interests: where processing is necessary to protect your life or the life of another person, for example in an emergency where important information needs to be shared with health, care, emergency, or safeguarding professionals. 

• Special category data: where we process information that needs extra protection, such as health, care, racial or ethnic origin, religious beliefs, or similar sensitive information, we identify both a lawful basis under Article 6 of the UK GDPR and a separate condition under Article 9. This may include processing that is necessary for health or social care, safeguarding, substantial public interest reasons, or establishing, exercising, or defending legal claims. 

Who do we share personal data with? 

We only share personal information on a need-to-know basis and follow appropriate safeguards. Most information sharing is with professionals and organisations involved in your care, support, safeguarding, funding, regulation, quality assurance, legal compliance, or service delivery. 

This may include local authorities, NHS bodies, commissioners, social workers, advocates, family members or representatives, safeguarding partners, regulators, emergency services, the police, courts or tribunals, legal advisers, auditors, insurers, IT and records management suppliers, and secure disposal providers. 

In some limited circumstances, we may be legally required to share certain personal data, which might include yours, if we are involved in safeguarding, legal proceedings or complying with legal obligations, a court order, or the instructions of a government authority. 

If any of your personal data is required by a third party, as described above, we will take steps to ensure that your personal data is handled safely, securely, and in accordance with your rights, our obligations, and the third party’s obligations under the law. 

Where do we store and process personal data? 

Data will be stored securely in a range of different places, including electronic and manual filing systems.  

Autism Together does not routinely transfer personal data outside the UK. 

How do we keep your personal data secure? 

We take the security of your data seriously. We have internal policies, access controls, confidentiality requirements, staff training, secure systems, audit arrangements and incident management processes in place to help ensure that your data is not lost, accidentally destroyed, misused, disclosed without authority, or accessed except by staff and authorised service providers who need it for their role. 

How long do we keep your personal data for? 

We will only keep your information for as long as we need it for the purposes for which it was collected, including care provision, legal, regulatory, safeguarding, audit, and complaint-handling purposes. Records are kept in line with Autism Together’s retention schedule, which sets out how long different types of records should be kept and the reasons for those periods. When records no longer need to be kept, they are confidentially destroyed or securely deleted. 

National Data Opt Out 

When you use a health or care service, confidential patient information may be collected about you to support your individual care and treatment.  Confidential patient information can also sometimes be used or shared for planning and research purposes when there is a clear legal basis. 

You have a choice about whether you want your confidential patient information to be used or shared for planning and research.  If you are satisfied with this use of your information, there is no requirement for you to do anything.  If you choose to opt out, your confidential patient information will still be used to support your individual care. 

The National Data Opt Out does not apply where information is used or shared for your individual care, safeguarding, legal obligations, public safety, or where another exemption applies. 

For more information or to register your choice to opt out, please visit: www.nhs.uk/your-nhs-data-matters 

Autism Together has reviewed its current processing activities and has not identified any data sharing for which the National Data Opt Out currently applies. We review this at least annually and when introducing any new processing or data-sharing activity. 

Your rights in relation to personal data 

You have the following rights in relation to the personal data we hold on you: 

Some rights only apply in certain circumstances. We will explain whether a right applies when you contact us and will respond in line with the timescales required by data protection law. 

• The right to be informed about the data we hold on you and what we do with it. 

• The right of access to the data we hold about you. We have a procedure in place for Subject Access Requests, and all such requests will be dealt with accordingly. 

• The right for any inaccuracies in the data we hold on you, however they come to light, to be corrected. This is also known as ‘rectification’. 

• The right to have data deleted in certain circumstances. This is also known as ‘erasure’. 

• The right to restrict the processing of the data. 

• The right to data portability, where this applies. 

• The right to object to certain types of processing, where this applies. 

• The right to safeguards relating to automated decision-making and profiling.  We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. 

• The right to raise a complaint about how your personal data is collected, used, or handled. 

Contact details of data controller: 

Autism Together 

Wirral Centre for Autism 

Oak House 

6 Tebay Road 

Bromborough 

Wirral 

CH62 3PA  

Tel: 0151 334 7510 

If you have any concerns or complaints about the way we handle your personal data, or if you want to exercise your rights, please contact our Data Protection Officer in the first instance using the Data Protection Enquiries Form below or alternatively by post or by telephone using the details provided above. We aim to acknowledge receipt of your complaint within 30 days. 

If your concern or complaint is not resolved to your satisfaction, you can raise a complaint with the Information Commissioner’s Office (ICO) at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, England, or via: https://ico.org.uk/global/contact-us/