Visitors Privacy Notice

Protecting Privacy, Supporting Simply Good Care

At Harbour Healthcare, protecting your privacy is central to everything we do.

We welcome family members, friends, healthcare professionals, contractors, volunteers, advocates, regulators and other authorised visitors to our homes. When you visit us, we may need to collect and use some personal information to help keep residents, visitors and staff safe, support safeguarding, meet legal obligations and manage access to our homes.

This notice explains how we collect, use, share and protect personal information relating to visitors.

Data Controller

Harbour Healthcare Ltd is the data controller responsible for your personal information.

Data Protection Officer (DPO):
Sarah Campbell
The Lodge House, Dodge Hill
Heaton Norris, Stockport, Cheshire SK4 1RD

Email: DPO-GDPR@harbourhealthcare.co.uk

Regulation and Compliance

We are regulated by:

• Care Quality Commission (CQC) in England
• Care Inspectorate Wales (CIW)

We maintain strong governance arrangements including records of processing activities, risk management frameworks, visitor management procedures and regular data protection reviews.

What Information Do We Collect?

Depending on the purpose of your visit, we may collect:

Personal Data

• Name
• Address
• Telephone number
• Email address
• Organisation or company name (where applicable)
• Relationship to a resident
• Vehicle registration details where applicable
• Correspondence and communication records

Visitor Information

We use an electronic visitor management system called eReception to manage access to our homes.

Information recorded may include:

• Name
• Contact details
• Organisation details
• Purpose of visit
• Person being visited
• Arrival and departure times
• Signature where applicable
• Emergency evacuation information
• Historical visitor records

CCTV Footage

Where CCTV is in operation, your image may be captured within communal areas and external areas of our homes.

Health and Safety Information

Where necessary, we may collect information relating to:

• Accidents and incidents
• Emergency situations
• Infection prevention and control
• Fire evacuation arrangements
• Safeguarding concerns

Photographs and Video Recordings

Photographs or recordings may occasionally be taken during events, celebrations and activities hosted within our homes.

How Do We Use Your Information?

We use personal information to:

• Manage access to our homes
• Maintain visitor records
• Support resident wellbeing through family and professional visits
• Safeguard residents, visitors and staff
• Meet health and safety requirements
• Maintain emergency evacuation records
• Investigate incidents, complaints and safeguarding concerns
• Prevent and detect crime
• Meet legal and regulatory obligations
• Communicate with visitors where necessary

Where appropriate consent has been provided, photographs and recordings may also be used for newsletters, websites, social media and other communications.

Lawful Basis for Processing

We process visitor information under the following lawful bases:

• Article 6(1)(c) – Legal obligation
• Article 6(1)(f) – Legitimate interests (safe and effective operation of our homes)
• Article 6(1)(d) – Vital interests (protecting life and health)
• Article 6(1)(e) – Public task (where safeguarding or statutory duties apply)

Where special category information is processed, we may rely upon:

• Article 9(2)(h) – Health or social care
• Article 9(2)(g) – Substantial public interest
• Article 9(2)(c) – Vital interests

Business Continuity Arrangements

Harbour Healthcare primarily uses eReception to manage visitor records.

If electronic systems are unavailable due to a power outage, network issue or other disruption, visitor information may be recorded using paper-based visitor registers or other temporary manual systems.

Information collected through these arrangements will be used for the same purposes described in this notice and managed in accordance with our information governance and retention requirements.

Sharing Your Information

We may share personal information where necessary and lawful with:

• NHS organisations
• Local authorities
• Safeguarding teams
• Regulators including CQC, CIW and ICO
• Police and law enforcement agencies
• Coroners
• Courts and legal authorities
• Approved suppliers and service providers
• Professional advisers involved in investigations or claims

All third parties are subject to appropriate contractual and data protection requirements.

We do not sell personal data.

International Transfers

Your information is usually stored within the UK or the European Economic Area (EEA).

Where information is transferred outside the UK, we ensure appropriate safeguards are in place, including:

• International Data Transfer Agreements (IDTAs)
• Standard Contractual Clauses (SCCs)

How Long We Keep Your Information

We retain personal information in accordance with legal requirements, regulatory expectations and organisational need.

Visitor records, eReception records, visitor sign-in records and emergency evacuation records are retained in accordance with Harbour Healthcare’s Records Retention and Destruction Policy.

CCTV footage is normally retained for up to 30 days unless required for an investigation.

How We Keep Your Information Secure

We use appropriate technical and organisational measures, including:

• Role-based access controls
• Secure systems and infrastructure
• Encryption where appropriate
• Audit logs and monitoring
• Staff training and confidentiality obligations

Where paper visitor registers are used, appropriate safeguards are implemented to minimise the risk of visitors viewing personal information belonging to other visitors.

CCTV

CCTV may be used in communal and external areas for safety, security and safeguarding purposes.

• CCTV is not used in residents’ bedrooms, bathrooms or other private areas
• Access is restricted to authorised personnel
• Footage may be shared with police, regulators or safeguarding authorities where lawful and necessary

Safeguarding and Legal Requirements

We may share personal information where necessary to:

• Protect individuals from harm
• Support safeguarding investigations
• Comply with legal obligations
• Assist police, courts, regulators or coroners

Your Rights

You have the right to:

• Be informed about how your information is used
• Access copies of your personal information
• Request correction of inaccurate information
• Request deletion where appropriate
• Restrict or object to processing
• Request data portability where applicable
• Raise concerns about how your information is handled

Requests can be made to the Data Protection Officer.

Photography and Social Media

We may occasionally take photographs or recordings during events, celebrations or activities.

Personal images or identifiable information will only be used where appropriate consent has been obtained.

Marketing and promotional communications require explicit opt-in consent.

Complaints

If you are unhappy with how your personal information has been collected, used, shared or protected, you have the right to make a data protection complaint directly to Harbour Healthcare.

Complaints may be made by contacting:

Sarah Campbell
Data Protection Officer

Email: DPO-GDPR@harbourhealthcare.co.uk

Alternatively, concerns may be raised through your Home Manager.

In accordance with the requirements introduced by the Data (Use and Access) Act 2025, Harbour Healthcare will:

• Acknowledge complaints within 30 days;
• Investigate concerns appropriately;
• Make enquiries where necessary;
• Keep individuals informed where appropriate; and
• Provide an outcome without undue delay. [lewissilkin.com], [privacymat…apiper.com], [ico.org.uk]

If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO).

Website: https://ico.org.uk/make-a-complaint

Telephone: 0303 123 1113

Contact Us

For any data protection queries:

Sarah Campbell
Data Protection Officer

Email: DPO-GDPR@harbourhealthcare.co.uk

Version Control

Document Title: Visitors Privacy Notice
Version: 2.0
Effective Date: July 2026
Review Date: Annually or upon significant change
Owner: Data Protection Officer