Data Protection Rights

Your Rights Under Data Protection Law

Under UK data protection law (UK GDPR and the Data Protection Act 2018), you have certain rights in relation to your personal information.
When you exercise your rights, Harbour Healthcare will:
• Respond within one calendar month (unless an extension is required)
• Communicate in clear and plain language
• Confirm your identity before releasing personal data
• Provide information free of charge (unless requests are excessive or unfounded)
• Explain if we are unable to comply with your request
• Ensure the rights of other individuals are protected

These rights apply to living individuals only.

1. The Right to Be Informed

You have the right to know how and why we collect, use, and store your personal information.
This information is provided through our Privacy Notices when we collect your data, or within one month if data is obtained from another source.
In some circumstances, we may not provide this information where it would prejudice investigations or where we are legally required to obtain information without notice.

2. The Right to Access Your Information

You have the right to request a copy of the personal information we hold about you. This is known as a Subject Access Request (SAR).
This includes:
• Confirmation that your data is being processed
• Access to your personal data
• Information about how and why your data is used

Care or employment records may include the names and roles of staff involved in providing care or services. This ensures records are complete and accurate.
Information relating to other individuals that is not relevant will not be shared.
You can request your data in a preferred format, including paper or electronic copies.
Proof of identity may be required before information is released.

To make a request, please contact:
DPO-GDPR@harbourhealthcare.co.uk

3. The Right to Rectification

You have the right to request correction of personal information that is inaccurate or incomplete.
Where we are unable to amend information (for example where it reflects a professional opinion), we will record your view and include it alongside the relevant record.

4. The Right to Erasure

You can request that we delete your personal data (the “right to be forgotten”).
This right does not apply where we must retain information:
• To comply with legal obligations
• For safeguarding or public health purposes
• For the establishment, exercise, or defence of legal claims
Retention periods are set out in our Records Retention and Destruction Policy.

5. The Right to Restrict Processing

You have the right to request that we limit how we use your personal data where:
• You contest its accuracy
• Processing is unlawful but you do not want it deleted
• We no longer require the data, but you require it for legal purposes

6. Other Rights

You may also have the right to:
• Request transfer of your personal data to another organisation (data portability)
• Object to certain types of processing, including where legitimate interests are used
• Not be subject to decisions made solely by automated means
Harbour Healthcare does not currently carry out automated decision-making that would significantly affect individuals.

7. Deceased Individuals and Access to Records

Data protection law does not apply to personal data relating to individuals who have died.
However, Harbour Healthcare continues to handle such information with care and confidentiality.
Access to health records of deceased individuals is managed in accordance with the Access to Health Records Act 1990 and relevant professional and legal guidance.
Requests may be considered from authorised individuals such as:
• Personal representatives (executors)
• Individuals with a legal claim arising from the death

8. Complaints

If you are unhappy with how your personal data has been handled, we encourage you to contact our Data Protection Officer in the first instance so we can try to resolve your concern.

Data Protection Officer:
Sarah Campbell
Email: DPO-GDPR@harbourhealthcare.co.uk

We will investigate and respond in line with our data protection procedures.
If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):
Information Commissioner’s Office
Website: https://ico.org.uk/make-a-complaint
Telephone: 0303 123 1113

You can contact the ICO at any time and do not need to contact us first.
We take all complaints seriously and use them to improve our data protection practices.

Version Control

Organisation: Harbour Healthcare
Document Title: Data Protection Rights
Version: 2.0
Effective Date: July 2026
Review Date: Annually or upon significant change
Owner: Data Protection Officer