Privacy Policy – Northcresthealth

We use personal data (information that relates to and identifies living people) and other information to help us to carry out our role as the regulator of health and adult social care services in England.

We will always make sure that we protect your information and treat it securely. Any information about you that we hold, or details you give us, will be held in accordance with:

Northcrest Healthcare may use artificial intelligence (AI) tools to process personal data. AI will be used as a tool to support Northcrest Healthcare effectiveness and efficiency but will not be used for automated decision making. Northcrest Healthcare will ensure that any AI tools it uses process personal data lawfully and securely.

Northcrest Healthcare hosts these organisations:

They follow the same rules and policies on processing personal data.

Until 30 June 2026, Northcrest Healthcare hosted the National Guardian’s Office for the Freedom to Speak Up (NGO). From 1 July 2026, the Northcrest Healthcare will continue to securely hold personal data contained in NGO records. This data will be retained only for lawful and necessary purposes, including handling complaints, statutory information access requests, audit, and supporting Public Inquiries or other official investigations.

Information about people who use services and members of the public

How we may access and use your personal and medical records

We have powers under the Health and Social Care Act 2008 to access and use information, including personal and medical records. We may do this where we consider this is necessary for us to carry out our functions as a regulator.

We also have powers under other legislation, including:

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Ut elit tellus, luctus nec ullamcorper mattis, pulvinar dapibus leo.

For example, we check that care services are complying with the regulations regarding record keeping, care planning, consent, co-operating with other providers, and management of medicines.

We have published our guidance for our staff when they need to access medical and care records. We usually look at only a small sample of these records during an inspection, often in anonymised form. In rare circumstances we may take a copy of some sections of a person’s records.

If you do not want us to look at your personal information when we check a service as part of an inspection, you need to tell the service that provides your care. They can mark your records to show that you do not want us to see them.

If we know that you don’t want us to look at your information as part of an inspection, we will respect your wishes, other than in rare circumstances. We explain these in our Code of Practice on Confidential Personal Information.

Other information we receive from care services

Registered providers and managers of care services must tell us about certain events and incidents. Examples include where they have received allegations of abuse, or where someone using the service is seriously injured. Care services also provide us with statistics including the number of complaints they have received.

This information will usually be anonymous, but we may ask for more information if there are concerns or issues that we need to explore further.

Under Regulation 17 of the Care Quality Commission (Registration) Regulations 2009 providers must notify us of the death of a service user who is liable to be detained in their service. In this case we ask for the name and date of birth of the person who died. This is so we can get cause of death information from coroners. GDPR does not apply to information about deceased people, but we will handle the information as confidential. As providers are required to notify us of the death, doing so will not breach their own duty of confidentiality to the deceased person under common law.

We sometimes look at records containing personal data, such as records relating to the handling of complaints. We do this to check how those services comply with their responsibilities.

We also sometimes ask care providers for contact details of people who use their services so that we can seek their views as part of our inspection. If you don’t want us to contact you in this way, please tell the service that provides your care.

Personal data that we receive from other sources

We receive information from people who use the services we regulate, their families, friends and carers. For example, we ask people to share their experiences of care with us. We also talk to people during inspections and receive letters, emails, phone calls, comment cards and survey responses, and through social media in which people tell us about care. These often contain personal data.

Some information from other sources, such as NHS England, other regulators, councils and the police may also sometimes contain personal data.

We use this information to help us decide when, where and what to inspect, and to help us make our judgements when we inspect services.

Data and statistics

We receive data about the quality of care of registered providers from NHS Digital, the trusted national provider of high-quality information, data and IT systems for health and social care.

We use these sources of data that contain personal information:

Find more information about what we hold and how we use these sources on the NHS Digital registers of approved data releases.

What data do we hold from NHS Digital that could potentially identify someone?

The data we hold include the following NHS Digital identifiable items:

Some of this information is unique to a person (for example, local patient identifier), while postcode cannot uniquely identify a person. However, all data is stored and processed with the same robust security applied to identifiable data.

We need this information to help meet our purpose of ensuring safe, effective and compassionate, high-quality care. For example, we may compare death rates at different hospitals, look for unusually high infection rates, and check for appropriate use of the Mental Health Act.

NHS Digital sends this information to us because we meet its strict requirements on keeping it secure and only using it in a way that supports our work. Our powers under the Health and Social Care Act 2008 allow us to require NHS Digital to provide us with this information. Find out more about how we use data to monitor services.

Could others identify individuals from the data?

We may have to raise questions or concerns with a hospital directly, for example if we are concerned about a hospital’s death rates. This only happens in exceptional circumstances.

Under an agreement with NHS Digital, we may send codes (hospital numbers) to the hospital to allow it to review its own medical records to identify specific patients to check whether their care was not of a good quality. These codes originate from the hospital and can only be used by hospital staff to identify patients who have been treated at that hospital. We always treat these codes in strictest confidence, and we will never attempt to link this data with names of individual people.

National data opt-out policy

CQC has legal powers to obtain information, including patient-identifiable data, that we need to carry out our role. The national data opt-out policy does not allow NHS service users to opt out of the use of data where such powers are set out in law. CQC may still access your information if you have registered a national data opt-out. CQC is subject to strict, legal restrictions on the disclosure of confidential personal information. This complies with the national data opt-out policy. Find out more about the national data opt-out programme.

Publishing information

We take care to ensure that our inspection reports and other publications do not identify people who use care services.

In some exceptional circumstances (for example, where only a very small number of people use a service) it may be possible to identify somebody who is mentioned in a report. Where we think this may happen, we will take care to include only the minimum necessary personal information, and we will discuss this with the person (or their family or representatives) before publication.

Information about care providers, registered persons, and people who work at care services

To carry out our role, we need personal data about people who provide, manage and work at care services.

The personal data that we obtain and use mainly relates to:

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Ut elit tellus, luctus nec ullamcorper mattis, pulvinar dapibus leo.

However, in the course of our work, we do also obtain and use some information about other people who work for, with, or at those services too.

Applications to register

Anyone applying to be a ‘registered person’ will be asked to submit an application form. Applications are also submitted by organisations wishing to be registered.

We may also collect additional personal data, for example through interviews, by asking them to undertake Disclosure and Barring Service (DBS) checks, or through our partner organisations or publicly available sources.

We will use this personal data to make decisions regarding registration and may also use it in the course of our subsequent regulation of the services they provide or manage.

We may share personal data we obtain in the course of our activities with other organisations where we need to do this to carry out our role, or to assist those bodies in their roles. For example, we may make referrals to the DBS or professional regulators, or may share information with NHS England, NHS Improvement or service commissioners or other regulatory bodies to.

We are required to publish a register of providers and managers of the services we regulate. The published register includes the names of registered providers and managers, and of nominated individuals, along with contact details. Entries on this register are available to view by searching our website.

Email addresses

We ask providers and managers for email addresses so we can contact them for reasons relating to our role, for example, to:

These email addresses do not form part of the public register and are not published.

We may share these email addresses with other public bodies where there is a lawful and legitimate reason to do so. We will not share email addresses with private organisations or for marketing purposes.

People who work at care services

In the course of our work, we do obtain some information about people who work at care services. For example, we sometimes look at training records or evidence of recruitment checks as part of our inspection of a care service.

We sometimes receive information from other sources, such as other regulators and government agencies. This happens when the information is relevant to our role, or needed for joint working.

We sometimes ask for staff contact details so that we can ask them about the services where they work.

Our inspection powers allow us to interview any person who works for a registered care provider in private. We take notes of these interviews and use the information that we receive to guide our inspections and make our regulatory judgements.

People who work for registered providers may also contact us to share concerns about services, or other information that may assist us in our work. Find out more about raising concerns about services where you work.

We consider the records of interviews, and other information we receive from people who work at care services, to be confidential, and we handle this information in accordance with data protection law and our Code of Practice on Confidential Personal Information. There may be times when we need to share this information with others. This includes where we believe a vulnerable person is at risk of harm, or when another organisation needs to take action to ensure the safety and quality of care.

Covert activities

Under Schedule 1 of the Regulation of Investigatory Powers Act 2000 (RIPA), we are classed as a ‘relevant authority’. This means we can conduct directed surveillance and use covert human intelligence sources (CHIS) when:

We are currently testing these powers through a phased pilot and do not use covert activities as a standard practice.

We may use directed surveillance to collect personal data covertly (without people knowing) in several ways such as:

We may use these methods when:

CHIS are people who we direct to covertly gather information on our behalf. This could include a person working undercover in a care service, or a care professional we have asked to collect information at their workplace.

We do not have powers that allow us to:

Information about our own staff and people applying to work for or with us

We need to process personal data about our own staff (and people applying to work for us) so that we can carry out our role. This is to ensure that we have the right staff to perform our inspections) and so we can meet our legal and contractual responsibilities as an employer.

The personal data that we process includes information about:

We use this information to check that we are promoting and ensuring diversity in our workforce and to make sure we are complying with equalities legislation.

Our employees decide whether they wish to share this monitoring data with us, and can choose to withdraw their consent for this at any time. Employees who wish to withdraw their consent for us to process this data can contact our People team.

Other personal data that we are required to process includes information on:

We check that people who work for us are fit and suitable for their roles. This may include asking people to undertake Disclosure and Barring Service (DBS) checks.

People joining CQC will be asked to complete a ‘declaration of interests’ form. This is to identify any services we regulate to which they have close links (for example, because they have previously worked there or because the service is run by a close relative) or any other issues which could cause a perceived conflict of interest. Staff are regularly asked to update these forms.

We share information about our employees as required to meet our contractual obligations to them, for example by sharing relevant personal data with pension service administrators. We also share personal data where required by law, for example by providing information about our employees to HMRC.

We also share employee payroll data with the Cabinet Office as part of the National Fraud Initiative (NFI). This allows the Cabinet Office to cross-check that data with similar data from multiple other government departments and public bodies for the purposes of identifying and investigating possible fraudulent claims and payments.

We have a legal obligation to comply with the Freedom of Information Act 2000. This may include the requirement to disclose some information about our employees – especially those in senior or public-facing roles. We also publish some information about our staff, including the names and work contact details of people in some roles and information on the salary bands of all employees.

Information about people who use our website

We will only collect personal information that you volunteer through our website, such as:

We will use this personal information about you will be used to exercise our functions, and to improve the quality and safety of care.

We use Google Analytics and Microsoft Clarity to monitor use of our website. Google Analytics and Microsoft Clarity use cookies to help analyse how people use our site, and this information will include your IP address and the pages you visit. You may refuse the use of cookies using your browser’s settings.

This privacy statement covers the Northcrest Healthcare website – it does not cover links within this site to other websites.

Online services – ‘Your Northcrest Healthcare account’

Any details we collect through your Northcrest Healthcare account and our online notification and registration forms will be held in accordance with data protection law,Northcrest Healthcare Data Protection Policy and Code of Practice on Confidential Personal Information.

We will not usually review information that has been saved (or autosaved) in our online forms but not sent or submitted to us. In certain circumstances, or if required as part of an investigation, we may need to view pending versions of forms.

Signing up to our e-newsletter

We use a third-party supplier to provide our e-newsletter service. If you subscribe to this service, your name and email address will be shared with them.

The third-party supplier handles the data purely to provide this service on our behalf. This supplier observes the requirements of data protection law in how it obtains, handles and processes your information. It will not make your data available to anyone other than Northcrest Healthcare without your permission.

Consultation responses

We carry out consultation exercises to help us develop our plans and policies. We collect responses from people who use services, care professionals and other organisations.

We have a lawful basis to process personal data collected from consultation responses, as processing is necessary to meet our legal obligations and to carry out our role.

We will store personal information securely and use it strictly for analysis only. Once a consultation ends, we store responses according to our retention and destruction schedule.

For some consultations we engage a specialist company to analyse results. Our agreement with such companies covers information security and data protection.

You have the right to withdraw your consultation response from our analysis at any point before we have completed it. To do this, email the address given for that consultation.

How we share information with other organisations

We publish information about how we work with other organisations.

We share information (which may include personal data) with other organisations when necessary to protect people, fulfil our responsibilities, or when it’s in the public interest to help other organisations perform their roles.

We only share personal data with other organisations where it is lawful to do so and in accordance with our Code of Practice on Confidential Personal Information. We do not use personal data for direct marketing (promoting or selling goods or services etc) or share information with anyone else who will use it for direct marketing, unless you have specifically consented to this.

We sometimes use other organisations to process personal data on our behalf. Where we do this, those companies are required to follow the same rules and information security requirements as us, and are not permitted to reuse the data for other purposes.

We sometimes share information with organisations that monitor Northcrest Healthcare to make sure we’re working effectively. This includes the Department of Health and Social Care (DHSC) and the Government Internal Audit Agency (GIAA).

We work with Experts by Experience, Mental Health Act Reviewers and Specialist Advisors who are not employees of Northcrest Healthcare, but who work with our inspection teams. We also co-ordinate the work of second opinion appointed doctors (SOADs) who provide an independent medical opinion for people whose rights are restricted under the Mental Health Act. We sometimes need to share personal data with these people, or with the organisations that support them on our behalf. For example, passing contact details of someone who has contacted Northcrest Healthcare to an Expert by Experience so that they can telephone them to discuss their care. They work to our requirements and standards to ensure that they protect this information properly.

We sometimes have to take part in independent inquiries, investigations and reviews. This can mean we have to securely share information with them.

Statutory public inquiries are governed by the Inquiries Act 2005 (the 2005 Act), and the associated inquiries rules. Under the 2005 Act, an inquiry may require us to provide evidence. This may include personal data relating to the inquiry’s terms of reference. The inquiries rules also set out how information can be shared and disclosed.

Investigations and reviews that are not statutory inquiries do not usually have powers to require us to provide information. We will only release personal data to these investigations and reviews where we are satisfied that:

We are currently participating in and responding to requests from the UK Covid-19 Public Inquiry. The inquiry has been set up under the 2005 Act to examine the UK’s response to and impact of the Covid-19 pandemic. We will need to respond to questions and requests received from the Inquiry.

More information about the UK Covid-19 Public Inquiry, including the terms of reference and scope of activity.

Retention and disposal of personal data

We publish a retention and disposal schedule, which explains how long we keep different types of records and documents, including those containing personal data. Personal data is reviewed at the end of its retention period and is anonymised, deleted or destroyed unless there is a lawful need to keep it longer for a reason that is compatible with the original purpose. For example, public inquiries may expect Northcrest Healthcare to retain records that may be relevant to their work.

The retention and disposal schedule also shows the legal basis under Article 6 of GDPR for processing each type of record and document. Where records and documents contain ‘special category’ personal data (such as health information, or information about a person’s racial or ethnic origin, religious or philosophical beliefs, or sex life or sexuality), the document also shows the legal basis under Article 9 for Northcrest Healthcare processing of that information.

Contacting Northcrest Healthcare about your personal data

If you are unhappy about how CQC processes your own personal data, you wish to exercise your rights in relation to your personal data, or need to contact us about our processing of personal data, please use the contact details below.

For any other complaint about our actions, find out how to make a complaint.

If you feel that we have not met our responsibilities under data protection law, you have a right to request an independent assessment from the Information Commissioner’s Office (ICO).

Our contact details and key roles

The Northcrest Healthcare is data controller for all personal data processed by Northcrest Healthcare or on our behalf. Any issues relating to the processing of personal data by or on behalf of the Northcrest Healthcare may be addressed to:

The Information Rights Manager
Northcrest Healthcare
Citygate
Gallowgate
Newcastle upon Tyne
NE1 4PA

Northcrest Healthcare Data Protection Officer (DPO) under Article 37 of the GDPR is Jessica Franklin, Deputy Director of Legal Services. The DPO’s role is to monitor and advise Northcrest Healthcare on meeting its data protection responsibilities. The DPO can be contacted using the details above.

Northcrest Healthcare Caldicott Guardian is Chris Badger, Chief Inspector of Adult Social Care. He can be contacted using the details above.