Autism Together collects and uses personal data about individuals for the purpose of arranging, providing, managing and reviewing care and associated services. We are committed to protecting your privacy, keeping your information secure, and meeting our obligations under UK data protection law.

Who are we?

Autism Together provides services for autistic people, including registered residential care, vocational day services, supported living and work placements.

What information do we collect?

In order to provide services to you, we collect and use a range of information about you. This may include, but is not limited to:

· Name, date of birth, address, gender and NHS number.

· Details of your family and people who care for you.

· Information about people who might legally represent you.

· Details of placements, education or transition information, where relevant.

· Details about your lifestyle, social and personal circumstances.

· Visual images, personal appearance, behaviour and risk information.

· Details about your learning needs.

· Benefit entitlements.

· Financial information for purposes of receiving or making payments and calculating how much you might have to pay towards some services we provide or organise for you.

· Information provided by you, your family, representatives, commissioners, local authorities, NHS bodies, social workers, advocates, safeguarding bodies, or other professionals involved in your care.

We may also process the following special category data that requires more protection due to its confidential or sensitive nature:

· Physical and mental health.

· Racial or ethnic origin.

· Religious or other beliefs of a similar nature.

Other sensitive data that requires more protection:

· Criminal convictions and offences (including alleged offences).

Why we use your personal information

· To communicate with you.

· To undertake assessment of your needs.

· To provide the services you have requested, or services requested for you.

· To investigate concerns or complaints you may have.

· To provide effective care and support.

· To detect and prevent fraud or crime.

· To help with service delivery and training of staff.

Our lawful bases and conditions for processing

· Legal obligation, where we need to comply with laws that apply to our services.

· Legitimate interests, where processing is necessary for our organisation or a third party and those interests are not overridden by your rights and freedoms.

· Recognised legitimate interests, where processing is necessary for one of the specific public interest purposes recognised in law, such as safeguarding, emergencies, crime prevention or responding to requests from organisations carrying out public tasks.

· Vital interests, where processing is necessary to protect someone’s life.

· Health or social care, where we process special category data that is necessary to provide health or social care services, manage those services, or support safeguarding and related care duties.

Who do we share personal data with?

We only share personal information on a need-to-know basis and follow appropriate safeguards. Most information sharing is with professionals and organisations involved in your care, support, safeguarding, funding, regulation, quality assurance, legal compliance, or service delivery.

This may include local authorities, NHS bodies, commissioners, social workers, advocates, family members or representatives, safeguarding partners, regulators, emergency services, the police, courts or tribunals, legal advisers, auditors, insurers, IT and records management suppliers, and secure disposal providers.

In some limited circumstances, we may be legally required to share certain personal data, which might include yours, if we are involved in safeguarding, legal proceedings or complying with legal obligations, a court order, or the instructions of a government authority.

If any of your personal data is required by a third party, as described above, we will take steps to ensure that your personal data is handled safely, securely, and in accordance with your rights, our obligations, and the third party’s obligations under the law.

Where do we store and process personal data?

Data will be stored securely in a range of different places, including electronic and manual filing systems.

Autism Together does not routinely transfer personal data outside the UK.

How do we keep your personal data secure?

We take the security of your data seriously. We have internal policies, access controls, confidentiality requirements, staff training, secure systems, audit arrangements and incident management processes in place to help ensure that your data is not lost,

accidentally destroyed, misused, disclosed without authority, or accessed except by staff and authorised service providers who need it for their role.

How long do we keep your personal data for?

We will only keep your information for as long as we need it for the purposes for which it was collected, including care provision, legal, regulatory, safeguarding, audit, and complaint-handling purposes. Records are kept in line with Autism Together’s retention schedule, which sets out how long different types of records should be kept and the reasons for those periods. When records no longer need to be kept, they are confidentially destroyed or securely deleted.

National Data Opt Out

When you use a health or care service, information is collected about you in a patient record for that service to support your care and treatment. The information collected can also be used and provided to other organisations for the purpose of research and planning when there is clear legal basis.

You have a choice about whether you want your confidential patient information to be used in this way. If you are satisfied with this use of your information, there is no requirement for you to do anything. If you do choose to opt out, your confidential patient information will still be used to support your individual care.

For more information or to register your choice to opt out, please visit: http://www.nhs.uk/your-nhs-data-matters

At this time, Autism Together does not share any data for planning or research purposes for which the national data opt out would apply. We review this on an annual basis for any new processing.

Autism Together is currently compliant with the national data opt out policy.

Your rights in relation to personal data

You have the following rights in relation to the personal data we hold on you:

Some rights only apply in certain circumstances. We will explain whether a right applies when you contact us and will respond in line with the timescales required by data protection law.

· The right to be informed about the data we hold on you and what we do with it.

· The right of access to the data we hold on you. We have procedures in place for Subject Access Request, and all such requests will be dealt with accordingly.

· The right for any inaccuracies in the data we hold on you, however they come to light, to be corrected. This is also known as ‘rectification’.

· The right to have data deleted in certain circumstances. This is also known as ‘erasure’.

· The right to restrict the processing of the data.

· The right to data portability, where this applies.

· The right to object to certain types of processing, where this applies.

· The right to safeguards relating to automated decision-making and profiling. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

· The right to raise a complaint about how your personal data is collected, used, or handled.

Contact details of data controller:

Autism Together

Wirral Centre for Autism

Oak House

6 Tebay Road

Bromborough

Wirral

CH62 3PA

Tel: 0151 334 7510

If you have any concerns or complaints about the way we handle your personal data, or if you want to exercise your rights, please contact our Data Protection Officer in the first instance using the Data Protection Enquiries Form below or alternatively by post or by telephone using the details provided above. We aim to acknowledge receipt of your complaint within 30 days.

If your concern or complaint is not resolved to your satisfaction, you can raise a complaint with the Information Commissioner’s Office (ICO) at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, England, or via this link: Contact us – public | ICO