VKL Healthcare Ltd

Privacy notice

Summary

• This document applies to people contacting VKL Healthcare Ltd, people using our website, and our clients.
• We always properly protect your information.
• We only use information about you when we are allowed to do so.
• We use information about you only to:

• fulfil a legal obligation or obey a lawful instruction;
• reply to your questions;
• provide our services; and
• pursue, or defend against, legal claims 

• The information we use will depend on why we are using it. For example, when responding to a question you send us via email, we will only ever use your name, contact details, and any information you decide to tell us when you contact us.
• If you consent to us using information about you, you have the right to revoke that consent at any time by contacting us to let us know.
• We only share personal information with third parties in very limited circumstances.
• You have a number of rights about your personal information and they are explained in detail below.

General information

About this document

All organisations that use people’s personal information must explain how they use and protect that information. This document is our way of explaining those things.

This document is not about getting your consent for something. Instead, it is designed to tell you what we do, why we do it, and what rights you have. We are not asking you to agree to anything. If we ask your consent for something, it will be made very clear to you what we are doing and why it is happening at that time. 

This privacy notice will tell you:

• how to contact us;
• how we protect personal information;
• how we get personal information;
• what personal information we use;
• why and how we use personal information;
• why we are allowed to use personal information;
• how long we keep personal information;
• what rights you have over personal information;
• whether we provide access to personal information to other groups; and
• if we intend to transfer personal information to another country.

Our details

VKL Healthcare Ltd operates a patient transport service that specialises in conveying people with mental health issues, older adult care needs, those with forensic and acute mental health issues, learning difficulties, dementia, and challenging behaviour. Our clients include NHS Trusts, private individuals, and private hospitals. We convey people to and from places of care (locally, nationally, and internationally), police custody suites, the community, and court appearances.

We are based in the UK and our company number is 05587615. We are registered with the Information Commissioners’ Office and our registration number is ZA048955. If you have any comments or queries, please contact Ellen Lim (our Data Protection Officer) via telephone on 0208 953 8493, email at info@vklhealthcare.co.uk, or by post at:

VKL Healthcare

Crossoaks Farm

Borehamwood

Hertfordshire

WD6 5PH

If we make changes to this document, we will notify people using our website and, where appropriate, by email, phone, or letter.

If you wish to complain to the Information Commissioner’s Office, you may do so here. 

How we protect personal information

We are committed to protecting the privacy and security of information about you:

• We follow the letter and the spirit of the principles of data protection and all related legislation including the UK General Data Protection Regulation and the UK’s Data Protection Act 2018.
• We have policies and mechanisms in place to protect personal information. For example, only those who need to see personal information have access to it, people with access to your data who are not employed by VKL Healthcare Ltd can only do things to personal information when we give them express written instruction to do so, connections to our website are encrypted, all information is stored off-site using reputable companies, and devices used to access information are kept securely encrypted.  
• We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where necessary.
• We never sell access to the information we collect and hold about you.
• We only collect and use information needed to provide our services.
• We only collect and use the minimum necessary amount of information to provide our services.

Personal information and what we do with it

We will only collect and use personal information that relates to you for the reasons described below, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain why we are allowed to do so.

For people contacting us

How do we collect and use the information?

When you contact us, whether by email, post, phone, or fax, we will automatically collect some information about you. What information is collected will depend on the way you made contact. 

What information do we collect and use?

If you email us, we will collect, store, and use your email address and any other information you include in your email, as appropriate.

If you call us, we will collect, store, and use your phone number and any other information you provide if you leave a recorded message, as appropriate.We record incoming calls for training, quality assurance, and improvement purposes. These recordings are retained in accordance with applicable legal requirements.  If you have any questions about our call recording practices or retention policy, please contact us directly.

If you write to us, we will collect, store, and use any information you include in your letter, as appropriate.

If you fax us, we will collect, store, and use your fax number and any information you include in your letter, as appropriate.

Why do we collect and use the information?

We use this information for two reasons: to be able to reply to your email, letter, or phone call and to respond to the content of your query or comment.

Why are we allowed to collect and use the information?

We can use this information because we have a legitimate interest in doing so. 

We have concluded that we have this interest after assessing the information we use and the way we use it. Our assessment concluded that:

• you would expect us to use your personal information to contact you and reply to your comments and queries and it will cause you no harm for us to do so;
• it is necessary and reasonable for us to use your personal information like this;
• there is no less intrusive way of achieving the result (i.e., replying to you);
• the benefit of us using your personal information in this way falls equally to you and to us; and
• if we did not use personal information like this, our business would suffer greatly without any benefit to you.

For people using our website

We do not collect any personal information about users of our website; we do not use cookies or any other tracking technologies.

For our clients

How do we collect and use the information?

When you contact us through post, email, phone, or fax call we will automatically collect and store some information in our filing, email, phone, and fax systems.

When arranging to use our services, we will ask for (and use) information about you as a client in addition to information about the service user about whom you are contacting us.

What information do we collect, store and use?

Contacting us will result in automatic storage and use of information relating to that contact method (email address, phone or fax number, any information contained in the contact, such as the content of an email).

In addition to the information about the service user, we will require information about you as a client, including name, address, and contact details suitable for the situation (e.g. telephone number and email address).

Why do we collect and use the information?

Biographical and contact details are necessary to deliver the services we provide.

Why are we allowed to collect and use the information?

We can use contact information because it is necessary for entering into and performing a contract between you and VKL Healthcare Ltd.

For legal claims and legal obligations  

How do we collect and use the information? 

Using all the processes we described in the above sections ‘For people contacting us’ and ‘For our clients’.

Why do we collect and use the information?

To pursue, and defend against, legal claims and to comply with legal obligations. 

What information do we collect and use?

If we need to defend or pursue a legal claim, or fulfil a legal obligation, we will use whatever personal information we have that is required. For legal claims this will be, at a minimum, biographical and contact details. 

Why are we allowed to collect and use the information?

We are allowed to collect and use the information because we have certain legal obligations and sometimes will need to make, or defend against, legal claims. Obligations vary but include, for example, prevention of crime, a court order, and bank and payment details so we can fulfil our tax obligations.

How long we keep personal information

• To decide the correct amount of time that we will keep personal information, we have considered the amount, nature, and sensitivity of that information, the potential risk of harm from its unauthorised use or disclosure, the purposes for which we use it, whether we can achieve our purposes through other means, and the applicable legal requirements.

• Information we collected and used to deliver our services is kept for eight years.
• Information collected and used as a consequence of you contacting us outside of the delivery of our services is kept for up to 6 years.

Sharing personal information and international transfer

• We sometimes give access to personal information to third parties. Third parties are required to respect the security of your personal information and to treat it in accordance with the law. If the third parties are using your personal information on our behalf then they must comply with a number of contractual requirements that oblige them to protect personal information. These include that they only act on our written instructions and that they agree to treat the information confidentially and keep it secure.
• We give access to your personal information to third parties if:

• it is part of delivering our service, in particular providing direct care (e.g., providing medical history to the care team of a service user), safeguarding (e.g., advice given to care providers to ensure that adult and children’s safeguarding matters are managed appropriately) and managing serious incidents; and
• we have a legal obligation to do so (e.g., where we are compelled by a court order); or
• we need to use the information for our own legal proceedings.

• VKL Healthcare Ltd is based in the UK and most of the personal information we use is kept in the UK. However, in the course of delivering our services, some of the organisations with whom we contract will transfer personal information outside of the UK. This includes the provision of services for email, remote storage, and information management (client and service user).

• These organisations are allowed to move personal information internationally in the way that they do because they have implemented specific contractual clauses that obligate them to behave in a certain way with respect to the personal information we use.

• We sometimes give access to personal information to third parties. Third parties are required to respect the security of your personal information and to treat it in accordance with the law. If the third parties are using your personal information on our behalf then they must comply with a number of contractual requirements that oblige them to protect personal information. These requirements include that they act only on our written instructions and that they agree to treat the information confidentially and keep it secure.
• We give access to your personal information to third parties if:

• it is part of delivering our service, in particular providing direct care (e.g., providing medical history to the care team of a service user), safeguarding (e.g., advice given to care providers to ensure that adult and children’s safeguarding matters are managed appropriately) and managing serious incidents; and
• we have a legal obligation to do so (e.g., where we are compelled by a court order); or
• we need to use the information for our own legal proceedings.

National data opt-out

The national data opt-out allows a patient to choose if they do not want their confidential patient information to be used for purposes beyond their individual care and treatment (i.e. for research and planning). Patients, or people acting for them by proxy, have control over setting or changing their own opt-out choice, and can change their mind at any time. 

VKL does not disclose or use data for the purposes of research or planning and so is not required to implement technical solutions for the national data opt-out. However, VKL has put in place procedures to assess future relevant uses or disclosures and is ready to implement appropriate technical measures if necessary.

Your rights

You have a number of rights about personal information we hold about you. They are described briefly below. More information about your rights can be found on the webpage of the Information Commissioner's Office (ICO). Under some circumstances, by law you have the right to:

• Be informed in a clear, transparent and easily understandable way about how we use your personal information and about your rights. If you need more information about how we use your personal information, please let us know.
• Request access to your personal information (this is known as a ‘data subject access request’). This right lets you receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
• Request correction of the personal information that we hold about you. This lets you correct any incomplete or inaccurate information we hold about you.
• Request erasure of your personal information. This means you can ask us to delete or remove personal information where there is no good reason for us continuing to store or use it. An example of a good reason for us to keep it is to continue to comply with our legal obligations. You can also ask us to delete or remove your personal information where you have exercised your right to object to us storing or using or your personal information (see below).
• Object to us storing or using your personal information where we rely on a legitimate interest (or those of a third party) and there is something about your situation which makes you want to object to us using personal information on this basis. We might have a compelling legitimate basis for doing so which overrides your rights, interests and freedoms, in which case your objection may not be accepted. For example, we may need your personal information to defend a legal claim. You also have the right to object where we are processing your personal information for direct marketing purposes.
• Request the restriction of the storage or use of your personal information. This allows you to ask us to temporarily stop what we are doing with your personal information. For example, if you want us to establish the accuracy of your personal information.
• Request the transfer of your personal information to another party where you provided it to us and we are using it based on your consent, or to carry out a contract with you, and we process it using automated means.
• Withdraw consent. If we rely on your consent to collect and use your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. Once we have received notification that you have withdrawn your consent, we will no longer process personal information for the purpose or purposes you originally agreed to, unless we have another compelling legitimate interest in doing so.
• Lodge a complaint. If you think that we are using your personal information in a way which breaches data protection law, you have the right to lodge a complaint with your national data protection supervisory authority (if you are in the UK, this will be the ICO).

If you want to contact us to review, verify, correct, request erasure, object, withdraw your consent, or request that we transfer a copy of your personal information to another party, please contact Ellen Lim at ellen.lim@vklhealthcare.co.uk

No fee is usually required. You will not have to pay to access your personal information or to exercise any of the other rights. However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive.

What we may need from you. We may need to request specific information from you to help us understand the nature of your request, to confirm your identity, and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it. If we request any identification from you for this purpose, it is on the basis that it is necessary to comply with our legal obligations, and we will only keep and use this until your identity has been verified.

Timescale. We will respond to your request as soon as we can. This should be within one calendar month from when we receive your request but, if the request is going to take longer to deal with, we will let you know. For example, if identification is necessary, the time limit will be from the day we receive that information. 

Call Recording

VKL Healthcare uses CircleLoop to manage telephone communications. Calls may be recorded for quality, training, and service improvement purposes.

Any personal data captured in these recordings will be:

• Processed lawfully, fairly, and transparently;
• Used only for the purpose of improving our services or resolving enquiries;
• Stored securely and retained only as long as necessary; and
• Accessible only to authorised personnel.

By contacting us via telephone, you consent to your call being recorded. You have the right to request access to any personal data we hold about you, or to raise concerns regarding how it is processed.

For more information about your rights, please see the Your Rights section of this privacy notice.

Social Media Engagement

VKL Healthcare maintains official LinkedIn and Instagram profiles to share news and engage with the public. Interactions on these platforms (e.g., likes, comments, messages) are processed by the platforms themselves; we recommend reviewing their privacy policies:

• LinkedIn
• Instagram

If you contact us directly via these channels, any personal data you provide will be used only to respond to your inquiry or manage your engagement, in line with UK data protection law and GDPR.