Context and Overview

SAL Healthcare Services (Supportive Ability Living Limited) holds information about individuals including customers, suppliers, business contacts, employees and other people the organisation has a relationship with. This policy describes how personal data must be collected, handled and stored to meet the company's data protection standards and comply with the law.

Policy Aim

This policy ensures SAL Healthcare Services:

• Complies with data protection law and follows good practice
• Protects the rights of team members, customers and partners
• Is open about how it stores and processes individuals' data
• Protects itself from the risks of a data breach

Data Protection Law

The GDPR 2018 describes how organisations must collect, handle and store personal information. These rules apply regardless of whether data is stored electronically or on paper. Personal data must be: processed lawfully and transparently; collected for specified legitimate purposes; adequate and limited to what is necessary; accurate and kept up to date; kept only as long as necessary; and processed with appropriate security measures.

Scope and Responsibilities

This policy applies to all offices, team members, volunteers, contractors and suppliers of SAL Healthcare Services. It covers all data relating to identifiable individuals including names, addresses, email addresses, telephone numbers and any other personal information.

Nathan Kiflom, Managing Director, is ultimately responsible for ensuring legal compliance including data protection training, handling subject access requests, reviewing procedures, and ensuring all systems meet security standards.

Data Storage and Security

Paper records: Kept in secure locations, locked when not in use, shredded when no longer required.

Electronic data: Protected by strong passwords via a password manager. Stored only on designated drives and approved cloud services. All sensitive data encrypted at rest (AES-256) and in transit (SSL/TLS). Full disk encryption on all devices. Regular tested backups. Security software and firewalls on all systems.

Subject Access Requests

Individuals may request to see what data we hold about them, how it is processed, and for what purpose. They may also request correction, deletion or transfer of their data. Requests should be made via email to the data controller. We aim to respond within one month, in line with the Data Protection Act 2018.

Signed by
SAL Healthcare Services (Supportive Ability Living Limited)
Nathan Kiflom — Managing Director