Introduction

Your Data Protection Rights

The UK GDPR allows various rights for people whose data is being processed. The rights are not absolute and so sometimes do not apply. Where you wish to exercise any of your rights, you may do so free of charge contacting us at governance@mountainhealthcare.co.uk. We will respond within one month.

Details of the rights within UK GDPR are below. You will be informed if the right is available to you upon application:

 

Complaints

At Mountain Healthcare we want to treat personal information lawfully, correctly and in compliance with the General Data Protection Regulation (GDPR).
​
We will meet the principles of the GDPR by:

• Ensuring that we seek a lawful basis for collecting, processing and sharing personal information.
• Making sure that individuals are made aware of what personal information will be collected and how it will be processed.
• Restricting the processing of data to the purposes for which it is specified to be processed.
• Only collecting and processing information which is necessary for carrying out our services and taking reasonable measures to ensure such information is kept relevant and up-to-date.
• Keeping all personal information safe and secure, through appropriate storage and transfer methods.
• Ensuring that personal information is only kept for as long as required/necessary (our retention schedules are guided by our Commissioners and other professional bodies).

​

Protecting Your Personal Data

Mountain takes protection of your personal data very seriously. Mountain uses a range of precautions that include administrative, technical and physical measures, to safeguard your personal data against loss, theft and misuse, as well as against unauthorized access, disclosure, alteration and destruction. We store the personal data you provide encrypted on computer servers that are in highly secure and controlled facilities. We restrict access to personal data to our employees, contractors and agents who need access to operate, develop, or improve our services and the application.

We follow industry accepted security standards to protect the personal data you submit to us, both during transmission and once we receive it.

We have implemented several technical and organisational measures to ensure your personal data is kept secure. This includes:

• Compliance with the NHS Data Security and Protection Toolkit
• Completing annual Cyber Essentials Plus certification by external security specialist company

• Annual penetration testing of our systems by an external cyber security specialist company
• Annual training for all staff on how to handle information securely.
• Having role-based access controls so that staff can only access records necessary for their role.

 

Website User and Social Media Platforms

Personal data processed:

For website users and social media platforms, where we rely on GDPR Article 6(1)(f) our legitimate interests are as follows:

Marketing our products, services and research.

Information Requests

Under the General Data Protection Regulation (GDPR) and Data Protection Act, individuals have the right to access the information we hold about them, both on paper and electronically. There are some exceptions to this however, which include:

• If information has been provided about the individual by someone else and they have not given their permission for this to be shared with them.

• The information is considered to have the potential to cause mental or physical harm to the individual or someone else.

Please note we will require proof of identity before we can disclose personal information.

 

Mountain Employees

Job Applicants

When potential candidates apply for one of our vacancies, we will collect basic contact details, as well as standard curriculum vitae information. We will also give individuals the opportunity to provide information regarding equal opportunities. As the individual’s application progresses, we may require information to support security checks and professional body compliance. This information is collected to process the individual’s application and to complete our ‘New Starter’ process, should the individual be appointed.

Employees

Mountain will collect your personal data for the performance of your employment contract. We will normally record the following information:

• Basic details
• Contact details
• Curriculum Vitae information, including qualifications, employment history, etc.
• Information to support Equal Opportunities
• Finance/Bank details
• Medical/Health information
• Information required for DBS/Vetting Checks
• Information to confirm compliance with professional bodies such as the GMC/NMC/HCPC
• Staff training and development
• Staff appraisals, probation and promotion

Additional personal information may also be collected throughout your employment with Mountain Healthcare Ltd, to manage your ongoing employment relationship with us. This information may include but is not limited to leave requests, medical certificates, performance appraisals, etc.

The main purposes for collecting your personal information are to process your employment application, maintain your employee records, manage your employment and administer your salary.

Personal employee information, which is collected by Mountain Healthcare Ltd, will be used for managing processes associated with your employment relationship with us.

​We use external companies to support some functions, we may be required to share your personal information with third parties. If you would like further information regarding this, please contact our Human Resources Department by email at hr@mountainhealthcare.co.uk

 

Child-Friendly Privacy Policy

This document is about how we use, and how we look after the information we have got about you.

You can always:

• Ask us for a copy of the information we have about you
• Ask us to update the information we have about you
• Ask us to delete the information we have about you
• We will always:
• Follow the law on how we can keep and use the information we have about you
• Make sure our policies are the best they can be
• We will never:
• Give the information we have about you to anyone else, unless…
• …you tell us we can
• …we think that doing so will protect you from harm
• …the law says we have to (e.g. to prevent a crime)
• Tell people about our work with you in a way that you can be identified unless you have told us we can
• Use the information you have given us to sell you anything unless you have told us we can

And here is more detail:

At Mountain Healthcare we do our very best to keep the information we have about you safe and private.  This goes for all the children and young people we support.  It goes for our staff and other people who work with us too.  We have made sure that we have set up good ways to keep information about you safe and private.  We keep checking these to make sure they are as good as possible.

We keep to what the law says about using and looking after information about people.  We will keep to the latest rules about this which are part of the law from 2018 onwards.  The main law is called the “Data Protection Act”.  This became law in 1998.  The latest rules are called the General Data Protection Regulations 2018, sometimes called GDPR.

The sort of information we have about you might be your name, your date of birth, your email and postal addresses, your phone number, and your health.

We may ask you about your physical and mental health, the choices you may make about sex, your race and background, and your religion.  We might of course know other things about you as part of our treatment.  We only keep information like this about you so we can use what we know to help you, or so we can work with you in the future.  For example, if we are going to give you help and advice, we may see from our records that there are other problems you have already told us about.  Using that information about you means we can give you better help or advice.  As another example, we may need to use the address, email address or phone number you have given us, to get in touch with you again if we need to.

We only ask things about you that you want to tell us, or things that we think we need to know so we can help you, even though they are very private.  We will not tell anyone else what we know about you unless you ask us to or if we need to ask other people to help you.

The law says there are only two ways we can use any information we have about you.

One is when you have given us your permission.  We have only got your permission if you have actually told us it is ok.  We can’t say you have given us permission just because you haven’t said “no” to something.

The other way we can use information about you is when we think that using it will really help us to help you, even though it is very private.  Before we use information about you, we decide whether it is more important to use it to help you, or not to use it because it is private.

There can be times when the law says we must pass on some information about people.  For example to help stop someone from helping you.  If the law says we have to pass something on we don’t have a choice.  We aren’t allowed to say no, even if you haven’t given us permission.

We need to see how well we are doing in helping children from different groups.  Sometimes we need to use information like your age or whereabouts you live, so we can see the sorts of people we are helping.  We also need to give some information about our work to people who are giving us money towards our work, or to people who are checking to see how well we are doing.  What we tell them is about the work we do, not private information about particular people.   The information we share is “anonymous”, which means nobody can tell which bits of information are about you.  They will not be able to see the name of anyone any of the information is about.  For example, we might simply tell them the sorts of problems we have helped people with over the past year, but not the personal details of anyone.

If another organisation tells us something about you, we will keep to their rules about what we do with what they have told us.  We will keep to any permission you have given them about using what they tell us about you.

Your rights

The law says that you can always …

• Ask us for a copy of the information we have got about you
• Change the information we have got about you, or bring it up to date, if it is wrong
• Change how you’d like us to get in touch with you
• Ask us to delete all the information we have got about you unless another law tells us we can’t

• Tell us if you are worried about the way we are keeping or using information about you, and want to make a complaint about this.

Contact Details:

• Full Name: Mountain Healthcare Limited
• Email and postal address for contacting us and our DPL:
• Email address: governance@mountainhealthcare.co.uk
• Registered Office: First Floor, Station Place, Argyle Way, Stevenage, SG1 2AD, UK
• Telephone: 0330 223 009

We will get back to you in a month – or sooner.

You can get in touch with us in any of these ways too if you have any questions about how we keep what we know about you safe and private.

 

About our website

Like lots of websites, ours downloads tiny files called “cookies” onto your computer.  These help our website to work properly for you.  You can find out lots about cookies here.

You can stop your computer from having cookies put on it.  The “Help” part of your computer’s web browser should tell you how to do this.  It is best not to do this though because stopping cookies can mean that websites like ours won’t work so well on your computer.