Data Privacy Policy

Introduction

At Caring Habitat, we value the privacy of our client’s confidential information that is in our custody. This information includes the one given to us directly when you visited our facility as well as the ones we became aware of due to your access to our website and other online portals. Please refer to our terms of use of our website as well as our cookies policy.

Purpose

This policy is set out to ensure that Caring Habitat fulfil the legal, statutory and regulatory requirements of the data protection laws.

Types of data we collect and usage

Level 1 data

Public information is the least-sensitive type, intended for public disclosure. It includes press releases and marketing messages, the type of information found on company websites. This includes basic historical data, career information, job postings, news releases, and logos. Our responsibility is to ensure that if we are the custodian of the source information; such information must be kept in strict confidence.

Level 2 data

Company Private Information. These are information that is not meant for the public. If Company Private Information is inappropriately disclosed, such disclosure might cause some embarrassment to Caring Habitat, but it would not cause any serious loss or business interruption. It includes training materials, guidelines, legal contracts, requests for proposals, requests for quotes, requests for information, information about projects, and other information found on the company’s homepage.

Level 3 data

Confidential information is more sensitive than Level 1 or Level 2 information. If confidential information falls into the wrong hands, it might cause serious loss, business interruption, or embarrassment to Caring Habitat or its client. It includes trade secrets, computer code, employee performance and personnel files, employee benefits information, customer lists, guest profiles, non-credit card branded gift and stored value card numbers and more. This type of information is only accessed with approval with evidence of a valid need to know reasons and it must be in compliance with this privacy policy.

Level 4 data

Vital Trust information is the most sensitive of the information data classes. Vital trust information includes but not limited to the following:

Sensitive data as defined in GDPR legislation (which includes racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, generic data, biomedical data for the purpose of uniquely identifying a natural person data concerning health or data concerning a natural person’s sex life or sexual orientation.
Personnel data as gathered using the Patient admission form.
Government-issued identification numbers (including Personnel numbers; Social Security numbers; Social Insurance numbers; Driver’s License numbers; National ID numbers; and Passport numbers).
Bank account numbers (including checking and savings account numbers) or related account information.
User account names and passwords.

The above list is not exhaustive but is merely samples of Vital Trust Data. Any type of personal data not mentioned specifically in the list but which nonetheless constitutes sensitive data in the meaning of the GDPR falls within the Level 4 category.

Caring Habitat assures the confidentiality of all categories of data mentioned above except in cases such as:

Where there is explicit consent of the data subject for one or more specified purposes
For the purpose of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law when authorized

It is particularly important to ensure the sensitive data is not used for other purposes than those for which it has been collected.

Vital Trust information must be encrypted in storage and in transit when sent outside of trusted networks. All Vital Trust data should be stored under lock and key when not in use and is not to be left unattended.

Data Classification Elevation

Caring Habitat may, from time to time, have business requirements to raise data elements to a higher classification. Patients, Clients/governing body may require the company to hold their specific data to a higher standard than that required by these standards. The company can reclassify data to a higher level if required by a client/governing body. By doing so, the company will be meeting a higher level of care with respect to that data and will be held to the control objectives of the higher data classification. In addition, the company is required to communicate the data “re-classification” to employees and to the IT Department.

Data Protection Principle

Caring Habitat is guided by the GDPR/NDPR and other relevant data protection regulations. Caring Habitat is responsible for, and must be able to demonstrate compliance with the following data protection principles:

The principles require personal data to be:

processed lawfully, fairly and in a transparent manner;
collected only for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes;
adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed; accurate and where necessary kept up to date;
not kept in a form which permits identification of data subjects for longer than is necessary for the purposes for which the personal data is processed;
processed in a manner that ensures its security, using appropriate technical and organisational measures to protect against unauthorized or unlawful processing and against accidental loss, destruction, or damage.

Your rights

Our Patients and other Data subjects have rights in relation to the way we handle their personal data. These include the following rights:

where the legal basis of our processing is consent, to withdraw that Consent at any time;
to ask for access to the personal data that we hold;
to prevent our use of the personal data for direct marketing purposes;
to object to our processing of personal data in limited circumstances;
to ask us to erase personal data without delay:

if it is no longer necessary in relation to the purposes for which it was collected or otherwise processed;
if the only legal basis of processing is Consent and that Consent has been withdrawn and there is no other legal basis on which we can process that personal data;
if the data subject objects to our processing where the legal basis is the pursuit of a legitimate interest or the public interest and we can show no overriding legitimate grounds or interest;
if the data subject has objected to our processing for direct marketing purposes;
if the processing is unlawful.

to ask us to rectify inaccurate data or to complete incomplete data;
to restrict processing in specific circumstances e.g. where there is a complaint about accuracy;
to prevent processing that is likely to cause damage or distress to the data subject or anyone else;
to be notified of a personal data breach which is likely to result in high risk to their rights and freedoms;
to make a complaint to the appropriate body;
You must verify the identity of an individual requesting data under any of the rights listed.

Our responsibilities

At Caring Habitat, we are responsible for establishing policies and procedures in order to comply with data protection law. Caring Habitat ensures that:

We protect the rights of individuals with regards to the processing of personal information.
We develop, implement, and maintain a data protection policy, procedure, audit plan and training program for compliance with the data protection laws.
Every business practice, function and process carried out by Caring Habitat, is monitored for compliance with the data protection laws and its principles.
Personal data is only processed where we have verified and met the lawfulness of processing requirements.
We record consent at the time it is obtained and evidence such consent to the Supervisory Authority where requested.
All our employees are competent and knowledgeable about their GDPR/NDPR obligations and are provided with in-depth training in the data protection laws, principles, regulations and how they apply to their specific role and the Company.
We maintain a continuous program of monitoring, review, and improvement with regards to compliance with the data protection laws and to identify gaps and non-compliance before they become a risk, affecting mitigating actions where necessary.
We have appointed a Data Protection Officer who takes responsibility for the overall supervision, implementation and ongoing compliance with the data protection laws and performs specific duties as set out under GDPR/NDPR.
We have a dedicated Audit & Monitoring Program in place to perform regular checks and assessments on how the personal data we process is obtained, used, stored and shared. The audit program is reviewed against our data protection policies, procedures and the relevant regulations to ensure continued compliance.
We provide clear reporting lines and supervision with regards to data protection.
Any information provided to an individual in relation to personal data held or used about them, will be provided in a concise, transparent, and easily accessible form, using clear and plain language.
We have developed and documented appropriate technical and organisational measures and controls for personal data security.

Data Privacy Notice

Caring Habitat considers Personal Data as confidential and as such must be adequately protected from unauthorized use and/or disclosure. Caring Habitat will ensure that its data Subjects are provided with adequate information regarding the use of their Personal Data as well as acquire their respective Consent, where necessary.

Changes to the Policy

Caring Habitat reserves the right to change, amend or alter this Policy at any point in time. If we amend this Policy, we will provide you with the updated version.