1. INTRODUCTION
Privacy Notice
Organisation:Cinox Healthcare Ltd
Notice Version: 1.0
Effective Date: January 2026
Review Date: January 2027
Data Protection Officer:dpo@cinoxcare.co.uk
GDPR Compliance: Fully Compliant with UK GDPR and Data Protection Act 2018
- Introduction
Cinox Healthcare Ltd (“the Organisation,” “we,” “us,” or “our”) is committed to upholding the privacy of individuals and ensuring transparent data handling practices. This Privacy Notice articulates the methods by which we collect, utilise, store, and safeguard your personal data in strict compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
This Privacy Notice is applicable to:
- Service users and their appointed representatives
- Current, prospective, and former staff members (employees)
- Volunteers and contracted personnel
- Family members and carers
- Visitors to our premises or digital platforms (website)
- Any other individuals whose personal data we are required to process
The Organisation acts as the Data Controller responsible for determining the purposes and means of processing your personal data, unless explicitly stated otherwise.
- Our Details
Organisation Name:Cinox Healthcare Ltd
Registered Address:39 Rush Green Rd, Romford RM7 0PT
Telephone:01708 982612
Email:info@cinoxcare.co.uk
Website:www.cinoxcare.co.uk
Data Protection Officer:Darlington
Contact: [dpo@cinoxcare.co.uk
Nominated Individual (if applicable):Chinwe Umbah-Uzobude
- Definition of Personal Data
Personal data constitutes any information pertaining to an identified or identifiable natural person. This encompasses, but is not limited to:
- Identification Data: Name, date of birth, gender, residential address, and contact information.
- Health Data: Medical history, clinical diagnoses, treatment information, medication records, and details of health conditions.
- Sensitive Personal Data: Information concerning racial or ethnic origin, religious beliefs, sexual orientation, disability status, and genetic data.
- Location Data: CCTV recordings, GPS tracking data, and records of appointment locations.
- Financial Data: Bank account details, payment transaction information, and invoicing records.
- Communication Data: Electronic mail correspondence, text messages, recordings of telephone calls, and appointment documentation.
- Behavioural Data: Documented care preferences, patterns of service utilisation, and communication patterns.
- Biometric Data: Fingerprints, photographs, and voice recordings (where relevant).
- Special Category Data: Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, and data concerning a person’s sex life or sexual orientation.
The Processing of Special Category Data necessitates the implementation of additional safeguards, as detailed in Section 11.
- Legal Basis for Processing
We shall only process your personal data where a lawful basis exists for doing so, as stipulated under Article 6 of the UK GDPR. The legal bases upon which we rely include:4.1 Consent (Article 6(1)(a))
When Utilised:
- Issuance of marketing communications
- Deployment of non-essential cookies
- Recording of appointments or calls where consent is required
- Execution of research or surveys
- Disclosure to third parties beyond the scope of necessary care provision
Your Rights:
- You retain the absolute right to withdraw consent at any juncture.
- The process for withdrawal shall be straightforward and without charge.
- A decision not to provide consent will not negatively impact the provision of other services.
Contact: The [Data Protection Officer] should be contacted to facilitate the withdrawal of consent.
4.2 Contract (Article 6(1)(b))
When Utilised:
- Provision of health and social care services
- Fulfilment of employment contracts
- Delivery of services and establishment of care plans
- Billing and processing of payments
- Management of appointments
Necessary For: The essential delivery of the services formally requested by you.
4.3 Legal Obligation (Article 6(1)(c))
When Utilised:
- Compliance with safeguarding protocols for adults and children
- Adherence to health and safety regulations
- Fulfilling registration and regulatory requirements (e.g., CQC)
- Compliance with taxation and employment legislation
- Execution of court orders and participation in legal proceedings
- Protection of public health
Examples:
- Reporting obligations to the Care Quality Commission (CQC)
- Maintenance of HM Revenue and Customs (HMRC) tax records
- Reporting to the Health and Safety Executive
- Safeguarding disclosures to relevant local authorities
4.4 Vital Interests (Article 6(1)(d))
When Utilised:
- Provision of emergency medical treatment
- Situations involving an immediate threat to life
- Protection of the life and health of a data subject
Example: The sharing of essential medical history in an emergency scenario where the data subject is incapable of providing consent.4.5 Public Task (Article 6(1)(e))
When Utilised:
- Performance of functions carried out in the public interest
- Exercise of official authority
- Provision of public healthcare and social care services
Example: The delivery of care in accordance with commissioning agreements established by the National Health Service (NHS) or the local authority.
4.6 Legitimate Interests (Article 6(1)(f))
When Utilised:
- Optimisation of organisational operations and efficiency
- Prevention of fraudulent activity and enhancement of security
- Continuous service improvement initiatives
- Maintenance of business continuity
- Administration and management of staff
Balancing Test: We have formally assessed that our legitimate interests do not override your fundamental rights and freedoms.
- Methods of Data Collection
5.1 Data Provided Directly by You
Initial Assessment and Registration:
- Completion of application forms
- Submission of registration documents
- Execution of consent forms
- Provision of needs assessment documentation
- Completion of medical history questionnaires
During Service Delivery:
- Notes from care planning discussions
- Records of appointment notes
- Documentation from therapy sessions
- Medication administration records
- Progress reports
- Submission of feedback and complaint forms
- Records of communication (emails, letters, messages)
Finance and Administration:
- Payment transaction information
- Banking and account details
- Insurance policy information
- Emergency contact particulars
- Employment contracts (for staff)
- CVs and application data (for job applicants)
5.2 Data Collected Automatically
Website and Digital Platforms:
- Internet Protocol (IP) addresses and device identifiers
- Browser specifications
- Information from cookies and tracking technologies
- Website usage and analytics data
- Login credentials
Service Delivery Systems:
- Data generated by appointment booking systems
- Access logs and system timestamps
- Records of system activity
- Security monitoring data
Communications:
- Electronic mail metadata
- Recordings of telephone calls (where consent has been secured)
- Message timestamps and content
- Video call recording data (where consent has been secured)
5.3 Data Acquired from Third Parties
Healthcare Providers:
- Previous medical records
- General Practitioner (GP) referrals and clinical correspondence
- Hospital discharge summaries
- Medication particulars
- Results from medical tests and investigations
Other Service Providers:
- Social care records
- Educational attainment records
- Housing status information
- Information from specialist services
Legal and Official Bodies:
- Records provided by the local authority
- Court orders and decrees
- Police disclosures (specifically in safeguarding contexts)
- Data from regulatory bodies (CQC, professional registration bodies)
Family Members and Carers:
- Information supplied concerning service users
- Emergency contact details
- Details related to representation and advocacy
Publicly Available Sources:
- Publicly accessible records
- Professional directories (if applicable)
- Social media information (use is restricted)
- Purpose of Data Utilisation
6.1 For Service Users
Primary Purpose: Provision of Care and Support
- Assessment of individual health and support requirements
- Development and routine review of care plans
- Delivery of comprehensive care and treatment
- Monitoring of progress and outcomes
- Management of medications and health conditions
- Coordination with external healthcare providers
- Communication regarding appointments and service logistics
- Securing and documenting informed consent
- Implementation of safeguarding measures for your welfare
Administrative Purposes:
- Management of appointments and issuance of reminders
- Processing of billing and generation of invoices
- Execution of payment transactions
- Maintenance of financial records and accounts
- Execution of quality assurance and internal audit procedures
- Initiation of service improvement and collection of feedback
- Handling and investigation of formal complaints
- Management of waiting lists
Legal and Regulatory Compliance:
- Fulfilment of statutory legal obligations
- Compliance with safeguarding requirements for adults and children
- Reporting to the CQC and other relevant regulatory bodies
- Adherence to health and safety regulations
- Maintenance of data protection compliance
- Response to formal court orders
- Public health reporting (e.g., notification of communicable diseases)
Research and Analytics (Subject to Consent):
- Conduct of research for service improvement
- Measurement and analysis of outcomes
- Execution of population health analysis
- Participation in academic research (requiring explicit consent)
Marketing and Communications (Subject to Consent):
- Dissemination of service updates and relevant information
- Delivery of health promotion messages
- Issuance of invitations to organisational events and workshops
- Distribution of newsletters
- Deployment of feedback surveys
6.2 For Staff Members
Employment Purposes:
- Recruitment, vetting, and selection processes
- Administration of payroll and tax compliance
- Management of employment contracts
- Execution of performance management and appraisals
- Provision of training and professional development
- Management of staff rostering and scheduling
- Compliance with health and safety mandates
- Management of occupational health assessments
- Administration of disciplinary and grievance procedures
- Provision and verification of employment references
Organisational Operations:
- Facilitation of internal staff communication
- Management of IT and security access credentials
- Control of physical access to premises
- Operation of CCTV monitoring systems
- Implementation of emergency procedures
- Administration of staff welfare programmes
- Management of pension contributions
- Administration of insurance policies
Compliance and Governance:
- Compliance with CQC registration and reporting
- Adherence to health and safety regulations
- Compliance with safeguarding legislation
- Maintenance of data protection compliance
- Fulfilment of regulatory reporting requirements
- Execution of background checks and Disclosure and Barring Service (DBS) checks
- Verification of professional registration status
6.3 For Other Individuals
Visitors:
- Ensuring safety and physical security
- Controlling access to the premises
- Operation of CCTV monitoring
- Emergency contact notification in the event of an incident
- Maintenance of building access logs
Website Users:
- Provision of service-related information
- Optimisation and enhancement of the website
- Collection of analytics and usage statistics
- Implementation of security and fraud prevention measures
- Management of communication and enquiries
- Data Sharing Disclosures
7.1 Internal Sharing
Within Cinox Healthcare Ltd:
- Care personnel directly engaged in your provision of care
- Clinical managers and supervisory staff
- The Registered Manager and the Nominated Individual
- Finance and administrative personnel (strictly for billing or human resources purposes)
- The Data Protection Officer (for compliance monitoring)
- Board members and directors (utilising anonymised or aggregated data)
Limitation: Disclosure is restricted solely to staff members whose roles necessitate access to the information.
Confidentiality: All personnel are formally bound by strict confidentiality obligations.
7.2 Healthcare and Social Care Providers
Routine Sharing:
- General Practitioners (GPs) and medical practitioners
- Hospital consultants and specialist physicians
- Community health teams
- Mental health service providers
- Learning disability services
- Social care providers and local authorities
- Pharmacy services
- Occupational therapy and physiotherapy services
- Psychotherapy and counselling services
Legal Basis: Necessary for the provision of coordinated and integrated care.
Security: Formal data sharing agreements are in place to govern the exchange of information.
7.3 Safeguarding and Statutory Bodies
Sharing When Legally Mandated or Necessary for Protection:
- Local authority safeguarding teams
- Police services (in instances of suspected criminal activity)
- Care Quality Commission (CQC)
- Health and Safety Executive (HSE)
- Ofsted (if services concerning children are involved)
- Courts of law and legal authorities
- Public health authorities
- Mental health crisis intervention teams
Legal Basis: Legal obligation, vital interests, and public task.
Circumstances: Occurs when there are safeguarding concerns, disclosures of abuse, or an explicit legal requirement to share.
7.4 Finance and Insurance
Sharing for Administrative Functions:
- Banking institutions and payment processors (for transaction processing)
- Insurance providers (for liability coverage)
- Appointed accountants and external auditors
- Legal counsel
- HM Revenue and Customs (HMRC)
- Pension scheme administrators
Legal Basis: Contract, legal obligation, and legitimate interests.
7.5 External Service Providers
Sharing as Deemed Necessary:
- Information Technology (IT) service providers and cloud storage entities
- Professional document destruction services
- Cleaning and facility maintenance contractors
- Catering service providers
- Transportation services
- Interpreters and communication support services
- Counselling and occupational health providers
- External quality assurance auditors
Legal Basis: Contract and legitimate interests.
Data Protection: Formal contracts and agreements are established, mandating strict confidentiality and compliance.
7.6 Third Parties (Subject to Your Consent)
Sharing When Authorised by You:
- Family members and carers (with explicit permission)
- Appointed advocates and representatives
- Solicitors and legal representatives
- Research organisations (with explicit consent)
- Marketing partners (with explicit consent)
Your Control: You reserve the right to request the withdrawal of consent for specific data sharing activities.
- International Data Transfers
8.1 UK and EU Data
Transfers Within the UK: No specific restrictions apply (the UK operates under UK GDPR).
Transfers to the EU: These are treated as “restricted transfers,” necessitating formal safeguards, including:
- Implementation of Standard Contractual Clauses (SCCs) within agreements
- Completion of a Transfer Impact Assessment
- Establishment of formal Data Protection guarantees
- Existence of a clear lawful basis for the transfer
Current Transfers:
- Cloud storage providers (if hosted within the EU)
- Human Resources (HR) and payroll systems (if hosted within the EU)
- Email and communication systems (if hosted within the EU)
8.2 Other International Transfers
Outside UK/EU:
- Limited to essential circumstances only
- Requires an explicit legal basis
- Verification of Adequacy Decisions (where applicable)
- Implementation of formal safeguards (SCCs, Binding Corporate Rules)
Examples:
- US-based cloud storage providers (utilising Privacy Shield or Standard Clauses, as appropriate)
- International specialists or consultants
- Medical testing facilities (international laboratories)
Your Control: We do not engage in the sale or routine international transfer of data without a compelling and demonstrable reason.8.3 Your Rights
- Right to be informed regarding any international data transfers
- Right to understand the safeguards implemented
- Right to object to transfers where permissible
- Right to request that data remains solely within the UK
- Data Retention Policy
9.1 Retention Periods by Data Type
Service User Care Records:
- Active service users: For the entire duration of care plus an additional 7 years following discharge.
- Reason: Statutory legal requirements, consideration of potential future care needs, and protection against litigation.
- Special exceptions: Records concerning minors are retained until they reach the age of 25 (allowing for competence to consent).
Health Records (Including Mental Health):
- A minimum of 6 years from the date of last contact (legal minimum requirement).
- Retention may be longer if ongoing treatment or legal proceedings are active.
- Minors: Records are retained until the individual reaches the age of 25.
Safeguarding Records:
- A minimum of 7 years following the formal closure of the incident.
- Retention may be extended if ongoing safeguarding concerns persist.
- Potential for indefinite retention in instances of documented serious abuse.
Employment Records:
- Current staff: For the duration of active employment.
- Former staff: 6 years following termination of employment (to comply with tax and employment law).
- DBS checks: Only the verification record is retained; the original certificate is destroyed.
- Disciplinary records: 6 years from the closure date of the matter.
Financial Records:
- 6 years (to comply with taxation requirements).
- Retention may be extended if a dispute or legal action is ongoing.
CCTV and Security:
- 30 to 90 days (unless footage is required for an incident under investigation).
- Retention is extended if there is a safeguarding or legal necessity.
Website Cookies and Analytics:
- 12 to 24 months (contingent upon the cookie type).
- Consented marketing data: Retained until consent is formally withdrawn.
Marketing and Consent Records:
- 3 years from the last contact (unless active consent is in place).
- Retention is extended if ongoing service is provided.
Appointment and Communication Logs:
- 2 to 3 years (unless care-related, in which case 7 years).
- Retention is extended if a pending complaint or legal action exists.
9.2 Secure Deletion
Upon the expiration of the defined retention period:
- Data shall be securely deleted or formally anonymised.
- Confidential waste shall be disposed of professionally.
- Digital data shall undergo irreversible deletion.
- Paper records shall be securely shredded.
- Cloud storage data shall be permanently removed.
CCTV: Footage shall be overwritten after the expiration of the retention period.
Exceptions: Data subject to pending legal proceedings or a formal court order shall be retained for the required duration.
9.3 Archive and Historical Data
Anonymised Data: May be retained for a longer duration for the purposes of:
- Academic or internal research
- Analysis for service improvement
- Quality assurance reviews
- Statistical reporting
De-identified Data: This data cannot be used to identify you and is maintained separately from your personal records.
- Your Rights Under UK GDPR
10.1 Right to be Informed
You are entitled to:
- Know precisely what personal data we hold about you
- Understand the purpose for which we use this data
- Be informed of our legal basis for processing
- Know the identity of parties with whom we share your data
- Know the duration for which we retain your data
This Privacy Notice serves to provide this required information.
10.2 Right of Access (Subject Access Request – SAR)
You have the right to request:
- Copies of all personal data held about you by the Organisation
- Information detailing how and why we process this data
- Details regarding the third parties with whom data is shared
- Our specific legal basis for data processing
Procedure for Request:
- Submit a written request to: [Data Protection Officer] at [email/address]
- The request must include: Your full name, date of birth, and service dates (if applicable)
- The request must explicitly state: “I am making a Subject Access Request”
Timeline:
- A response shall be provided within 30 calendar days.
- The period may be extended to 60-90 days for exceptionally complex requests.
- No charge is incurred (unless the request is deemed manifestly unfounded or excessive).
Outcome:
- Copies of the data shall be provided in an accessible format
- An explanation of the processing activities
- Information regarding your data subject rights
- Details of third-party disclosures
10.3 Right to Rectification
You have the right to request:
- The correction of any inaccurate personal data
- The completion of any incomplete personal data
- The right to append explanatory statements to your records
Procedure for Request:
- Contact: [Data Protection Officer]
- Specify: Which data element is inaccurate or incomplete
- Provide: The corrected information or required explanation
Timeline:
- Rectification shall be made without undue delay.
- Usually completed within 30 days.
- Formal confirmation shall be sent to you upon completion.
10.4 Right to Erasure (“Right to be Forgotten”)
You may request the deletion of your data if:
- The data is no longer necessary for its original purpose
- You withdraw consent (where processing was based on consent)
- You formally object to the processing (and there are no overriding legitimate interests)
- The data was processed unlawfully
- There is a legal obligation for deletion (under UK GDPR)
Limitations (We may refuse if):
- The data is necessary for the provision of care
- There is a legal obligation to retain (e.g., safeguarding, health records)
- Retention is required for the defence of legal claims
- There is a compelling public interest in retaining the data
- Our legitimate interests demonstrably override your request
Procedure for Request:
- Submit a written request to: [Data Protection Officer]
- State clearly: “I request erasure of my personal data”
- Specify: The particular data elements requested for deletion
Timeline:
- A decision shall be rendered within 30 days.
- Confirmation of erasure or a formal reason for refusal shall be provided.
10.5 Right to Restrict Processing
You may request:
- That processing is halted while the accuracy of the data is verified
- That processing is stopped, but the data is formally retained
- The restriction of marketing or non-essential processing activities
- The limitation of sharing with third parties
Procedure for Request:
- Contact: Darlington Zvionere
- Provide: A clear explanation for the requested restriction
Timeline:
- Processing shall be restricted without undue delay.
- Formal confirmation shall be sent to you.
10.6 Right to Data Portability
You are entitled to request:
- The receipt of your personal data in a structured, commonly used, and machine-readable format
- The transfer of your data to another organisation
- That your data is sent directly to a specified third party
Applicability:
- Applies only to data that you personally provided
- The processing must have been based on consent or contract
- The data must be provided in a machine-readable format (e.g., CSV, XML, PDF)
Procedure for Request:
- Contact: [Data Protection Officer]
- State clearly: “I request my data in portable format”
Timeline:
- A response shall be provided within 30 days.
- Data shall be supplied in the agreed-upon format.
10.7 Right to Object
You have the right to object to processing for the following reasons:
- Processing conducted for marketing purposes
- Processing based upon legitimate interests
- Processing for the purposes of research or statistics
- Processing involving automated decision-making
Procedure for Request:
- Contact: [Data Protection Officer]
- Specify: The particular processing activity to which you object
- Explain: The rationale behind your objection
Timeline:
- A decision shall be rendered within 30 days.
- Processing shall cease if no overriding legitimate interests can be demonstrated.
Note: You cannot object to processing activities that are necessary for:
- The essential provision of care
- Compliance with legal obligations
- The protection of vital interests (health or safety)
10.8 Right to Withdraw Consent
Where processing is based on consent, you may:
- Withdraw that consent at any time
- Incur no penalty for withdrawing consent
- Utilise a simple and cost-free process for withdrawal
- Acknowledge that withdrawal does not invalidate past processing activities
Procedure for Withdrawal:
- Contact: Darlington Zvionere
- State clearly: “I withdraw consent for [specific processing]”
Effect:
- Processing for that specific purpose shall cease.
- Withdrawal does not affect processing under other lawful bases.
10.9 Right to Not be Subject to Automated Decision-Making
You are entitled to:
- Not be subject to decisions based solely on automated processing that produce legal or similarly significant effects
- Request human intervention in significant decisions affecting you
- Receive an explanation of any automated decisions made
Examples of automated decisions include:
- Automated risk assessments
- Algorithmic allocation of support services
- Automated eligibility determinations
- Automated priority scoring
Exceptions:
- Decisions explicitly authorised by law
- Decisions necessary for the performance of a contract
- Decisions based on your explicit consent
- Processing of Special Category Data
11.1 Special Category Data Definition
Special Category Data (Article 9 UK GDPR) comprises:
- Racial or ethnic origin
- Political opinions
- Religious or philosophical beliefs
- Trade union membership
- Genetic data
- Biometric data (e.g., fingerprints, iris scans)
- Health data (e.g., medical history, diagnoses)
- Data concerning a person’s sex life or sexual orientation
11.2 Basis for Processing Special Category Data
Necessary for Health and Social Care:
- Assessment of comprehensive health and support requirements
- Delivery of treatment and therapy services
- Implementation of safeguarding and welfare protocols
- Determination of accessibility needs and adjustments
- Coordination and planning of care
Legal Basis (Article 9 Exceptions):
- Employment Law: Processing of employee health data when necessary for the employment contract.
- Health Care: Processing of health data essential for the provision of health or social care services.
- Safeguarding: Processing necessary to protect the vital interests of the data subject.
- Legal Claims: Processing necessary for the establishment, exercise, or defence of legal claims.
- Public Health: Processing for the protection of public health.
- Legitimate Interests: (Infrequently utilised) When a compelling reason exists and enhanced safeguards are implemented.
11.3 Additional Safeguards
For Special Category Data, we implement the following:
- Collection is limited strictly to essential information
- Sharing is restricted to only those personnel with a definitive need to know
- Enhanced security measures are applied
- Health data is subject to encryption
- Access controls are rigorously restricted
- Staff receive specialised training on data sensitivity
- Data is stored securely and, where appropriate, separately
- Breach monitoring is conducted closely
- Comprehensive records of processing activities are maintained
11.4 Health Data
Specific Safeguards:
- Access is restricted exclusively to clinical personnel involved in care provision
- System audit trails are diligently maintained
- Encryption is applied both in transit and at rest
- Regular backup procedures and disaster recovery plans are in place
- Staff are bound by formal confidentiality agreements
- Training in the sensitivity of health information is mandatory
- Access to information systems is strictly limited
Access Authorisation:
- Clinical staff directly providing your care
- Managers for purposes of supervision or quality assurance
- Administrative staff are excluded unless there is a clinical necessity
Duration: Retention periods are governed by Section 9 (typically 6-7 years following discharge).
- Data Security
12.1 Security Measures
Physical Security:
- Paper records are stored in locked filing cabinets
- Access control systems are implemented for facilities containing data
- CCTV monitoring is utilised where appropriate and legally permissible
- Secure facilities are maintained for confidential waste disposal
- Fire safety protocols and disaster recovery plans are established
Digital Security:
- Encryption of data in transit (utilising HTTPS/TLS)
- Encryption of data at rest (utilising AES-256 or an equivalent standard)
- Deployment of firewalls and intrusion detection systems
- Regular execution of security patching and system updates
- Implementation of multi-factor authentication for system access
- Enforcement of complex, regularly changed password policies
- Utilisation of antivirus and anti-malware protection
- Encrypted backup systems are maintained
Data Handling:
- A clear desk policy is enforced (no unattended screens)
- Confidentiality agreements are in place with all staff
- Data sharing procedures are formally documented
- Access restrictions are based on the need-to-know principle
- Secure deletion procedures are followed rigorously
- Audit trails and activity logs are maintained
Third-Party Security:
- Contracts explicitly mandate data protection compliance
- Regular security assessments of external providers are performed
- Sub-processor controls are implemented
- Formal Data Processing Agreements are established
- Security certifications are verified (e.g., ISO 27001, SOC 2)
12.2 Data Breach Response
In the Event of a Breach:
- The breach shall be assessed immediately for the risk posed to individuals
- Reporting to the ICO shall occur within 72 hours if a high risk is identified
- You shall be notified if the breach poses a high risk to your rights and freedoms
- A formal investigation shall be conducted
- Corrective and preventative measures shall be implemented
- A comprehensive breach register shall be maintained
Your Notification:
- If the data breach is likely to result in a high risk to you
- Notification shall be provided without undue delay
- Communication will be via email or postal mail
- The notification shall detail: the nature of the incident, the data affected, a contact point, and relevant advice
- Cookies and Tracking
13.1 Cookie Types
Essential Cookies:
- Strictly necessary for fundamental website functionality
- Used for authentication and security purposes
- Placed automatically and do not require consent
- Cannot be refused without impacting site operation
Performance Cookies:
- Used for website analytics and usage statistics
- Help us to understand user interaction with the site
- Require your prior consent
- Utilised for service improvement
Functional Cookies:
- Used to remember user preferences
- Include language selection
- Enhance the overall user experience
- Require consent
Targeting Cookies:
- Used for marketing and advertising purposes
- Track browsing activity across different websites
- Require explicit consent
- May be refused
13.2 Your Cookie Choices
Upon Initial Visit:
- A Cookie Consent Banner shall be prominently displayed
- You may select which categories of cookies to accept
- Options include “Accept All” or “Manage” preferences
- Individual cookie types may be selected or deselected
Amending Choices:
- Cookie preferences may be updated at any time
- Changes can be made via the website settings
- You may contact us to modify your choices
- Changes shall take effect from your next site visit
Third-Party Cookies:
- Google Analytics (utilising anonymised data)
- Social media pixels (if integrated into the site)
- Email tracking technologies (if applicable)
- All such cookies necessitate consent
- Marketing and Communications
14.1 Basis for Marketing Communications
We shall only issue marketing communications when:
- You have provided explicit consent for this purpose
- You have formally opted in to receive such communications
- A pre-existing service relationship exists and a soft opt-in is applicable
- We are fully compliant with the Privacy and Electronic Communications Regulations (PECR)
14.2 Types of Marketing
Email Marketing:
- Dissemination of service updates and information
- Delivery of health promotion and educational content
- Invitations to events
- Distribution of the newsletter or periodic updates
- Requests for participation in surveys and feedback
SMS/Text Marketing:
- Issuance of appointment reminders
- Service updates (where consented)
- Health information
- Invitations to participate in research
Telephone Marketing:
- Service invitations (infrequently used)
- Invitations for research participation (where consented)
- Conducting feedback surveys
14.3 Opting Out
You may unsubscribe from marketing communications by:
- Clicking the “Unsubscribe” link provided in emails
- Replying “STOP” to text messages
- Contacting us by telephone to opt out
- Sending an email to: [contact email]
- Writing to: [address]
Effect:
- Marketing emails and texts shall cease immediately
- Your preference shall be recorded
- No marketing shall be sent without new consent
Service Communications:
- Essential communications pertaining to the provision of your care shall continue
- (These are not classified as marketing)
- You are unable to opt out of service-critical communications
- Children’s Data
15.1 Age of Consent
UK GDPR:
- Children under 13: Parental or guardian consent is required for certain processing activities
- Children 13 and over: Are generally considered capable of giving their own consent
- Digital Services: Consent must be age-appropriate
In the Health Context:
- Children’s capacity to consent shall be assessed
- Assessment shall involve the concept of Gillick competence
- Fraser guidelines shall be applied
- Parental consent is typically required for individuals under the age of 16
15.2 Processing Children’s Data
We shall only process children’s data when:
- A parent or guardian provides consent (for those under 13)
- The child has capacity and provides their own consent (for those 13 and over)
- The processing is necessary for the child’s welfare or safeguarding
- There is a legal obligation to process (safeguarding)
- We demonstrate a legitimate interest with appropriate safeguards in place
15.3 Enhanced Safeguards
For children’s data, we implement:
- Restriction of collection to only essential information
- Limitation of sharing to those with a legitimate need
- Application of enhanced security protocols
- Regular review of access permissions
- Explanations provided in child-friendly language
- Special caution exercised with sensitive information
- Retention periods focused on safeguarding requirements
15.4 Accessing Children’s Data
Children’s Right to Access:
- The child may request their own data (if assessed as having capacity)
- A parent may request data on behalf of a young child
- Both parties may submit requests concurrently
- We shall assess the child’s capacity and best interests
- Data shall be provided in a format suitable for the child
- Complaints and Escalation
16.1 Raising a Complaint
If you believe your data protection rights have been breached:
Step 1: Informal Resolution
- Contact: [Darlington]
- Email: [dpo@cinoxcare.co.uk]
- Phone: [07984391230]
- Write to: [39 Rush Green Rd, Romford RM7 0PT
- Explain: The nature of the issue and the desired resolution
Timeline: A response shall be provided within 30 days.
Step 2: Formal Complaint
If the issue is not satisfactorily resolved informally:
- Submit a formal complaint in writing
- State clearly: “Data Protection Complaint”
- Include: Full details, a timeline of events, and previous attempts at resolution
- Specify: The exact subject matter of the complaint
Timeline: A formal response shall be provided within 30 days (potentially extended to 60-90 days for complex investigations).
16.2 Our Complaints Process
Upon Receipt of Complaint:
- An acknowledgement shall be issued within 5 working days
- A reference number shall be assigned
- An official investigation shall commence
- You shall be kept informed of progress
- A formal written response shall be provided
Outcome:
- Upheld: Corrective action shall be taken, and an apology issued where appropriate
- Not Upheld: A detailed explanation shall be provided
- Partially Upheld: Partial remedial action shall be implemented
- Your rights to appeal shall be explained
16.3 Escalation to the ICO
You retain the right to submit a complaint directly to:
Information Commissioner’s Office (ICO)
- Address: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
- Phone: 0303 123 1113
- Email: casework@ico.org.uk
- Website: www.ico.org.uk
When to Escalate:
- We fail to respond within a reasonable timeframe
- We formally refuse to respond to your request
- You are dissatisfied with the content of our response
- You believe a serious data protection breach has occurred
Your Right: You may complain to the ICO at any time (although the ICO may recommend you attempt to resolve the issue with us first).
- Data Protection Officer Contact Details
Our Designated Data Protection Officer:
Name:Darlington Zvionere
Title: [Mr
Email:dpo@cinoxcare.co.uk
Phone:07984391230
Address: [39 Rush Green Rd, Romford RM7 0PT
Contact For:
- All privacy-related concerns
- Data subject rights requests (Subject Access Requests)
- Queries regarding data breaches
- Formal complaints concerning data handling
- Questions regarding processing activities
Availability:
- Monday to Friday, 9:00 am to 5:00 pm
- Response guaranteed within 5 working days
- Provision of confidential advice is assured
- Updates to This Privacy Notice
18.1 Circumstances for Updating the Notice
This Privacy Notice shall be updated when:
- Legal or regulatory changes are introduced
- Our data processing activities are modified
- Feedback from individuals necessitates an amendment
- New best practice guidance is issued
- Technology or system changes occur
18.2 Notification of Updates
When changes are implemented:
- The updated notice shall be displayed on the Organisation’s website
- Notification shall be sent via email if an email address is held
- A notice shall be posted at the premises
- A copy shall be provided upon request
- A formal change log shall be maintained
Current Version:
- Version 1.0
- Effective from: 5 January 2026
- Last updated: 5 January 2026
- Next formal review: 5 January 2027
18.3 Your Rights Post-Change
- You may request the deletion of your data if new processing activities are unsuitable
- You may withdraw consent for new processing purposes
- You may object to new processing activities
- New significant processing activities will typically necessitate fresh consent
- Glossary of Terms
Consent: Your clear, freely given, specific, and unambiguous indication of agreement for us to process your personal data for a defined purpose.
Data Controller: The entity (Cinox Healthcare Ltd) that determines the purposes and means of the processing of your personal data.
Data Processor: An entity that processes personal data strictly on behalf of the Data Controller.
Data Protection Officer: The independent professional responsible for overseeing the Organisation’s compliance with data protection legislation.
Data Subject: The identified or identifiable natural person whose data is being processed (i.e., you).
GDPR: The General Data Protection Regulation – The UK law that protects your data privacy rights.
ICO: The Information Commissioner’s Office – The UK’s independent regulatory authority for data protection.
Personal Data: Any information relating to you that can identify you, either directly or indirectly.
Processing: Any operation or set of operations performed upon personal data (e.g., collection, storage, use, sharing, deletion).
Special Category Data: Sensitive personal data (e.g., health, racial origin, religion) requiring enhanced protection.
Subject Access Request (SAR): Your formal request to receive copies of the personal data we hold about you.
- Key Documents and Policies
Related documentation that provides further detail on data protection:
- Data Protection Policy (full organisational policy)
- Confidentiality and Data Security Policy
- GDPR Compliance Policy
- Safeguarding Adults and Children Policies (specifically concerning data sharing in safeguarding)
- Staff Data Protection Training materials
- Data Retention Schedule
- Third-Party Data Processing Agreements
- Data Breach Response Plan
- AppendicesAppendix A: Right to Access Request Form
DATA SUBJECT ACCESS REQUEST FORM
Cinox Healthcare Ltd
Your Personal Details:
Full Name: ________________________________________________________________
Date of Birth: ________________________________________________________________
Address: ________________________________________________________________
Email: ________________________________________________________________
Phone: ________________________________________________________________—–Access Request Specifics:
Type of data formally requested:
- [ ] All personal data held
- [ ] Specific type (please detail): ________________________________________________________________
- [ ] Data from specific date range: ________________________________________________________________
- [ ] Data relating to specific event/incident: ________________________________________________________________
Reason for request (optional):
________________________________________________________________________________________________________________________________________________________
Format requested for data provision:
- [ ] Digital copy (via email or USB drive)
- [ ] Paper copy (via postal mail)
- [ ] Both digital and paper formats
Declaration and Confirmation:
I hereby confirm that I am submitting this request in the capacity of:
- [ ] The Data Subject (requesting data about myself)
- [ ] Parent/Guardian (requesting data on behalf of a minor)
- [ ] Authorised Representative
I formally understand that:
- This constitutes a Subject Access Request under UK GDPR Article 15
- I should anticipate a response within 30 calendar days
- No charge shall be levied (unless the request is manifestly unfounded)
- I may be required to verify my identity
Signature: _____________________________________________________________ Date: ________________
Submission Address:
[Data Protection Officer Name]
[Email: dpo@cinoxhealthcare.org.uk]
[Address]
Appendix B: Consent Form
DATA PROCESSING CONSENT FORM
Cinox Healthcare Ltd—–Your Personal Details:
Full Name: ________________________________________________________________
Date of Birth: ________________________________________________________________
Contact Email: ________________________________________________________________
Role (Service User/Staff/Other): [please specify] ________________________________________________________________
Consent for Processing Activities:
I hereby grant consent to Cinox Healthcare Ltd to process my personal data for the following optional purposes:
Optional Processing (Please mark with an X to provide consent):
- [ ]Marketing Communications
I consent to receiving electronic mail and/or messages regarding services, events, and promotions.
Anticipated Frequency: [select] Weekly / Monthly / As needed - [ ]Newsletter and Updates
I consent to receiving periodic updates concerning services and general health information. - [ ]Feedback and Research Participation
I consent to being contacted for the purpose of providing feedback or participating in research studies. - [ ]Telephone Calls for Non-Urgent Matters
I consent to Cinox Healthcare contacting me by telephone for non-urgent administrative matters. - [ ]Sharing with Family/Carers
I consent to my information being shared with [name]: ____________________________
Specific Information Type: [specify what may be shared]: ________________________________________________________________ - [ ]Photography or Recording
I consent to being photographed or recorded for the following purpose: [purpose]: ________________________________________________________________ - [ ]Other Specific Processing:
________________________________________________________________________________________________________________________________________________________
Withdrawal of Consent Acknowledgment:
I formally acknowledge that:
- I may withdraw this consent at any point without incurring any penalty.
- The process for withdrawal is simple and free of charge.
- To withdraw consent, I must contact [DPO email].
- Withdrawal shall only affect future processing activities, and past processing remains lawful.
Optional: Special Category Data Consent
I consent to Cinox Healthcare processing my special category data (including health information) for the purposes explicitly detailed above.
- [ ] Yes, I consent to the processing of special category data
- [ ] No, I do not consent to the processing of my health or special category data for these optional purposes
Signature: _____________________________________________________________ Date: ________________
Print Name: ________________________________________________________________
Instructions for Consent Withdrawal:
Email: [dpo@cinoxhealthcare.co.uk]
Or contact: [Darlington]
Please state clearly: “I withdraw consent for [specific processing]”
Appendix C: Data Sharing Agreement Summary
Summary of Data Disclosures
| Third Party | Type of Data Shared | Legal Basis | Retention Period (Our Policy) |
| GP Surgery | Medical history, medications, clinical diagnoses | Contract, legitimate interests | 6 years post-discharge |
| Hospital/Specialists | Assessment results, referrals, treatment plans | Consent, contract | Their policy + our minimum 6 years |
| Local Authority | Safeguarding concerns, formal needs assessment data | Legal obligation, public task | 7 years |
| CQC | Anonymised service data, critical incident reports | Legal obligation | As stipulated by regulatory mandates |
| Police | Information where safeguarding or criminal activity is suspected | Legal obligation, vital interests | Governed by their retention policy |
| Pharmacy | Prescription details, medication history | Contract, legal obligation | 2 years |
| Mental Health Services | Psychiatric history, diagnoses, ongoing treatment data | Consent, contract | Governed by their retention policy |
| Family Carer | General progress updates, appointment details (subject to consent) | Consent | Until consent is formally withdrawn |
| Finance Companies | Encrypted payment details | Contract | 6 years |
—–Document Control
| Version | Date | Author | Changes |
| 1.0 | Jan 2026 | Data Protection Team | Initial comprehensive privacy notice, fully compliant with UK GDPR |
Document Classification: Public
Approval Authority: Data Protection Officer / Registered Manager Chinwe Umbah-Uzobude
Review Date: 05 January 2027
Regulatory Compliance: UK GDPR Article 13/14, Data Protection Act 2018
CINOX HEALTHCARE LTD
39 Rush Green Road, Romford RM7 OPT
Complaints and Compliments Policy and Procedure
Summary: This policy aims to: To deal with complaints in line with
CQC Regulation 17: Complaints to ensure that the service
users are sure that their comments and complaints are
listened to and acted on effectively, and know that they
will not be discriminated against for making a Complaint
CINOX HEALTHCARE LTD recognises that there will be
times when the service provided does not meet the
expectations of the service users or their
representatives. Therefore, there must be a robust and
consistent process for receiving and handling complaints
appropriately and for ensuring that the information
gained is used as an opportunity for organisational
learning and continuous improvement of services.
Scope: This policy provides a robust framework for all staff
employed, either directly or indirectly (including
non-executive directors, volunteers, governors) in the
investigation of concerns and complaints. The following
people may be affected by this policy: All staff. Whether
temporary or permanent, Local Authorities,
Commissioners. Families, NHS, and Service users.
Document Type Policy and Procedures
Verified By Chinwe Eucheria
Issued Date 06-07-2025
Review Date 06-07-2026
Complaint and Compliments Policy and Procedure
1. Introduction and Policy Statement
This policy sets out our intent and objectives for the complaints handling process, including offering a
clear and approachable system for stakeholders to complain, thoroughly investigating all complaints to
identify the cause, issues and corrective actions required, and implementing measures to prevent
reoccurrences where applicable. The policy aims to deal with complaints in line with CQC Regulation 17:
Complaints to ensure that service users are sure that their comments and complaints are listened to and
acted on effectively and know that they will not be discriminated against for making a Complaint.
1.1. CINOX HEALTHCARE LTD welcomes the views of service users, families, and other stakeholders
regarding the service we provide.
1.2. CINOX HEALTHCARE LTD recognises that there will be times when the service provided does not
meet the expectations of the service users or their representatives. Therefore, there must be a robust
and consistent process for receiving and handling complaints appropriately and for ensuring that the
information gained is used as an opportunity for organisational learning and continuous improvement of
services.
1.3. CINOX HEALTHCARE LTD is committed to delivering a fair, open and clear process for complaints
to ensure a satisfactory outcome for all stakeholders who raise a complaint.
EQUALITY AND HUMAN RIGHTS
CINOX HEALTHCARE LTD recognises that some sections of our society experience prejudice and
discrimination. The Equality Act 2010 specifically recognises the protected characteristics of age, disability,
gender, race, religion or belief, sexual orientation, and transgender.
The Equality Act also requires regard to socio-economic factors including pregnancy /maternity and
marriage/civil partnership. CINOX HEALTHCARE LTD is committed to equality of opportunity and
anti-discriminatory practice both in the provision of services and in our role as an employer. CINOX
HEALTHCARE LTD believes that all people have the right to be treated with dignity and respect and is
committed to the elimination of unfair and unlawful discriminatory practices. CINOX HEALTHCARE LTD
©2023 Ultra Health Care. Only CINOX HEALTHCARE LTD can access this policy. Sharing, copying or
distribution to unregistered entities constitutes a breach of contract. This document cannot be shared or
copied without the prior written approval of Ultra Health Care. Breach of contract subject to prosecution.
Prohibited from unauthorised distribution.
Page 1 of 9
CINOX HEALTHCARE LTD
39 Rush Green Road, Romford RM7 OPT
also is aware of its legal duties under the Human Rights Act 1998. Section 6 of the Human Rights Act
requires organisations to uphold and promote Human Rights in everything they do. It is unlawful for an
organisation to perform any act which contravenes the Human Rights Act. CINOX HEALTHCARE LTD is
committed to carrying out its functions and service delivery in line with the Human Rights based approach
and the FREDA principles of Fairness, Respect, Equality Dignity, and Autonomy.
1.4. This policy sets out our intent and objectives for the complaints handling process, including offering a
clear and approachable system for stakeholders to complain, thoroughly investigating all complaints to
identify the cause, issues and corrective actions required, and implementing measures to prevent
reoccurrences where applicable.
1.5. Compliments received by CINOX HEALTHCARE LTD will be used as an opportunity to share good
practices and to encourage staff to continue to provide a good quality service.
1.6. This policy aims to ensure that:
• Staff recognise the importance of complaints and compliments in providing feedback about the
services provided
• All complaints are well managed and are investigated and resolved quickly, fairly and consistently
and in accordance with company policies and procedures
• Staff are empowered to deal with complaints as they arise in an open and non-defensive way
• Learning from complaints is identified and used for improvement and where action can be taken to
avoid reoccurrence, this is completed
• Faults are acknowledged, remedied and a clear and relevant explanation and apology offered
• The complaints service is accessible, well publicised, open and transparent and that staff know
how to escalate complaints
• The complaints procedure is supportive for those who find it difficult to complain
• There are clear standards of response an individual can expect when they make Complaint
• Good practice identified from compliments is shared across the organisation
1.7. CINOX HEALTHCARE LTD will ensure that all complaints are reviewed at the highest level of the
organisation to identify learning opportunities for those directly involved in the complaint and the
organisation as a whole.
1.8. CINOX HEALTHCARE LTD is committed to promoting equality and diversity. No client or any other
person involved in the investigation and resolution of a concern or complaint will receive unfair treatment
as a result of raising a complaint.
Who to contact internally if you have a complaint or concern?
CINOX HEALTHCARE LTD wherever possible, complaints are best dealt with on a local level between
the complainant and CINOX HEALTHCARE LTD. Point of call internally with our organisation for
complaints if the local process is not satisfactory is:
Registered Manager: Chinwe Eucheria whose details are:
39 Rush Green Road, Romford RM7 OPT
07854280352
Key Lines of Enquiries to meet Complaints Policy and Procedure
Caring C2: How does the service support people to express
their views and actively involved in making decisions
about their care, support and treatment as far as
possible?
Safe S6: Are lessons learned and improvements made when
things go wrong?
Responsive R2: How are people’s concerns and complaints
listened to and responded to and used to improve the
quality of care?
Safe S1: How do systems processes and practices keep
people safe and safeguarded from abuse?
©2023 Ultra Health Care. Only CINOX HEALTHCARE LTD can access this policy. Sharing, copying or
distribution to unregistered entities constitutes a breach of contract. This document cannot be shared or
copied without the prior written approval of Ultra Health Care. Breach of contract subject to prosecution.
Prohibited from unauthorised distribution.
Page 2 of 9
CINOX HEALTHCARE LTD
39 Rush Green Road, Romford RM7 OPT
Well-led W2: Does the governance framework ensure that
responsibilities are clear, and that quality performance,
risks and regulatory requirements are understood and
managed?
2. Openness, Transparency and Duty of Candour
2.1. Following the Francis Report (2013) it is a requirement for clinicians to be candid with clients about
avoidable harm and for safety concerns to be reported openly and truthfully. CINOX HEALTHCARE LTD
must be accurate, candid and must not provide misleading information to service users, their families,
regulators, and commissioners.
2.2Definitions of Openness, Transparency and Candour are as follow:
• Openness – enabling concerns and complaints to be raised freely without fear, with questions asked
being answered.
• Transparency – accurate information about performance and outcomes to be shared with staff, service
users, commissioners, and regulators
• Candour – any client harmed by a healthcare service is informed of the fact and an appropriate remedy
offered, regardless of whether a complaint has been made.
2.3. Being open involves:
• Acknowledging, apologising, and explaining when things go wrong.
• Conducting a thorough investigation into the incident, complaint, or claim.
• Reassuring clients and their families that lessons learnt will help prevent incidents occurring; and
• Providing support for those involved to cope with the physical and psychological consequences of what
happened.
2.4. CINOX HEALTHCARE LTD and everyone working for the organisation must be honest, open, and
truthful in all their dealings with service users and families, and organisational and personal interests must
never be allowed to outweigh the duty, to be honest, open and truthful.
2.5. CINOX HEALTHCARE LTD follows the Parliamentary Health Service Ombudsman (PHSO)
Principles of Good Complaints Handling as set out below:
• Getting it right – quickly acknowledging and putting right issues identified. Considering all the factors
when deciding the remedy with fairness for the complainant and where
appropriate others that have suffered
• Being customer-focused – apologising and explaining, managing expectations, dealing with people
professionally and sensitively and remedies that consider individual circumstances.
• Being open and accountable – clear about how decisions are made, proper accountability, delegation
and keeping clear records
• Acting fairly and proportionately – fair and proportionate remedies, without bias and discrimination
• Putting things right – consider all forms of remedy such as apology, explanation, remedial action or
financial offer
• Seeking continuous improvement – using lessons learned to avoid repeating poor service and recording
outcomes to improve services.
3. Scope
3.1. This policy applies to all, directly and indirectly, employed staff within CINOX HEALTHCARE LTD
and other persons working within the organisation.
3.2. This policy should be read in conjunction with:
• Safeguarding Adults Policies
• Information Governance Policies pertaining to record-keeping
• Duty of Candour Policy
4. Definitions
4.1. A complaint is “an expression of dissatisfaction made to an organisation, either written or spoken,
and whether justified or not, which requires a response. There is no difference between a ‘formal’
complaint and an ‘informal’ complaint. Both are expressions of dissatisfaction”, The Patient’s Association,
2013
4.2. It is, however, important to differentiate between concerns and complaints
©2023 Ultra Health Care. Only CINOX HEALTHCARE LTD can access this policy. Sharing, copying or
distribution to unregistered entities constitutes a breach of contract. This document cannot be shared or
copied without the prior written approval of Ultra Health Care. Breach of contract subject to prosecution.
Prohibited from unauthorised distribution.
Page 3 of 9
CINOX HEALTHCARE LTD
39 Rush Green Road, Romford RM7 OPT
4.3. A concern is an expression of dissatisfaction about an event or service which can usually be
remedied to the individual’s satisfaction within a short period of time if dealt with quickly, openly, and
honestly, through informal discussion with the staff team within the service. The complainant does not
expect a formal response.
. A complaint can also be an expression of dissatisfaction with a service that has personally affected an
individual and which requires a proportionate investigation and a formal response in order to promote
resolution between the parties concerned. It is usually historic (i.e., happened in the past) and cannot be
immediately remedied
4.5. A compliment is an expression of satisfaction made about the service provided by CINOX
HEALTHCARE LTD as a whole, or a staff team or an individual member of staff. Compliments received
by CINOX HEALTHCARE LTD will be used as a chance to share good practices across the organisation
and to encourage staff to continue to provide a good quality service.
5. Responsibilities as an employer:
Registered Manager:
The registered person should:
· be familiar with the purpose of a complaints procedure and the outcomes it has for their service
users
· create an atmosphere in which service users feel able to provide various forms of feedback on the
services they receive
· encourage staff to react positively to all forms of service user feedback
· establish procedures to meet the current regulatory requirements for reporting, dealing with and
using service users’ comments on services, including informal and formal complaints.
· promptly and thoroughly investigate any formal complaint made by a service user
· enable the person to have the support of a friend or advocate if needed
· make service users aware of their right to escalate their complaint if they are dissatisfied with the
outcome or the handling of their complaint by the care provider
· co-operate with any other agency appropriately investigating a complaint by a service user
· ensure that the information about service user satisfaction gained from all forms of feedback,
including complaints, is used in the service’s quality assurance system
· ensure that staff observe appropriate professional Codes of Practice in relation to complaints and
other feedback.
5.1. It is the responsibility of the Senior Management Team to ensure that ALL staff are aware of and use
this policy.
5.2. All staff have a responsibility to read this policy and understand its impact on their area of work. Staff
should be able to respond appropriately to a complainant and endeavour to achieve immediate resolution.
If this is not possible, all staff have the responsibility to escalate the concern/complaint in accordance with
this policy.
5.3. The Managing Director is responsible for ensuring that all concerns/complaints are fully investigated
and responded to within the agreed timeframe.
5.4. Responsibility for ensuring compliance with this policy rests with the Managing Director
Complaints against the Registered Manager / Nominated Individual
Where the Registered Manager is also the Nominated Indivudual, and there is a complaint against this
person, the organisation will appoint an independent consulting company that will act as a neutral entity to
deal with any complaints against the Registered Manager/ Nominated Individual. The organisation
appointed will usually be an advisor to our own service. The Current organisation that supports our
service in this area is : Ultra Healthcare Solutions, Unit 23 Basepoint Business Centre, Metcalf Way,
Crawley, RH11 7XX. Phone No: 02080640909. email address: info@ultrahealthcare.co.uk.
6. Procedure
Complaints can arise from a number of issues including:
• A failure to comply with policy, procedure, or standards of service delivery
• A decision which the complainant believes is not fair or clear to them
©2023 Ultra Health Care. Only CINOX HEALTHCARE LTD can access this policy. Sharing, copying or
distribution to unregistered entities constitutes a breach of contract. This document cannot be shared or
copied without the prior written approval of Ultra Health Care. Breach of contract subject to prosecution.
Prohibited from unauthorised distribution.
Page 4 of 9
CINOX HEALTHCARE LTD
39 Rush Green Road, Romford RM7 OPT
• The behaviour of CINOX HEALTHCARE LTD staff, volunteers, associates, or contractors
Complainants can also approach the Care Quality Commission (CQC) to raise their complaints.
Complaints received via the CQC will be treated in the same way as all other complaints. The CQC will be
asked to confirm whether complaint responses should be sent directly to complainants or sent to the CQC
to pass on. All complaints received via the CQC should be reported to the HR department for information
and monitoring.
6.1. Concerns can provide valuable lessons for services within the organisation. Concerns can usually be
resolved quickly and satisfactory by way of an apology, by providing the service required or by providing
an acceptable explanation. Staff who receive a concern should document the concern following this
procedure. If the concern is resolved locally,
this should be indicated.
6.2. Any concern or other comment not made in the form of a formal complaint, but which cause concern
about the quality or safety of services, should be escalated following this
procedure and subject to an investigation and response to the same standard as a formal complaint.
6.3. If the concern cannot be resolved to the satisfaction of the complainant, they should be asked
whether they would like the concern to be formally investigated and responded to. If this is the case, the
concern becomes a stage 1 complaint.
6.4. There are three stages of complaint review:
• Stage 1 (Local Resolution)
• Stage 2 (Complaint Review)
• Stage 3 (Ombudsman)
6.5. At any stage, the complaints handler or the Manager can make a judgement that the complaint
requires review and refer it to the Ombudsman if necessary.
Stage 1
All team members are involved in supporting service users, so they may be involved in handling informal
complaints. The Team members dealing with a complaint should work to the following simple formula:
1. Listen
2. Ask questions
3. AGREE on a solution – check satisfaction
4. Implement the solution – NOW
5. Follow up and check satisfaction
The aim should be to deal with less significant issues in an informal way at the point of service delivery to
ensure a speedy resolution.
6.6. Stage 1 complaints can be either written (including by e-mail) or verbal. Verbal complaints should not
be treated as any less serious than written complaints and should be handled in the same manner. Any
verbal complaint must be logged into the Complaint logbook. Complaints can be made to any member of
staff.
6.7. If a Stage 1 complaint is received, either in writing or verbally, the staff member who receives the
complaint should record it following the organisational procedure. If the complaint was verbal, the member
of staff recording the complaint should confirm with the complainant that the information recorded is
accurate. This can be face to face or over the telephone. The recorded complaint and the original
complaint, if in writing, should be forwarded to the Registered Manager. (Use Complaint Investigation
Form on the forms section below)
6.8. If a complainant was not satisfied with the outcome of their concern, and they would like their
complaint to be formally investigated and responded to, the Managing Director/Nominated Individual
should make sure this is done. The complainant should be informed that their complaint is being
escalated and it should be confirmed with the complainant that the information recorded is accurate.
6.9. Stage 1 complaints will be handled, ensuring the following take place:
• Acknowledgement of stage 1 complaints within 2 working days, informing complainants of the
investigation process and expected timescales for a response.
• Early resolution during a face-to-face meeting if appropriate.
©2023 Ultra Health Care. Only CINOX HEALTHCARE LTD can access this policy. Sharing, copying or
distribution to unregistered entities constitutes a breach of contract. This document cannot be shared or
copied without the prior written approval of Ultra Health Care. Breach of contract subject to prosecution.
Prohibited from unauthorised distribution.
Page 5 of 9
CINOX HEALTHCARE LTD
39 Rush Green Road, Romford RM7 OPT
• Thorough investigation of complaints that cannot be resolved by a face to face meeting, ensuring
investigation methods and findings are documented.
• Formal written response provided to the complainant within 28 days, describing the methods used in
the investigation, findings and any action taken as a result.
• Complainant kept informed of the reason for delay if a response is likely to take longer than 28 days,
with a contact at a minimum of every 28 days.
• A full apology is offered if the complaint is upheld.
• Information sent to the complainant informing them of how to escalate their complaint to stage 2 if they
are not satisfied with the response.
Stage 2
6.10. Not all conclusions will satisfy the complainant and they have the right to request a review of the
initial investigation into their complaint. This must be done within 6 months of the response to their
complaint at stage 1, and usually in writing following this procedure. If the complainant is unable to make
a request in writing, this may be done verbally.
6.11. A request to review the initial investigation into the complaint should be recorded and escalated
following this procedure.
6.12. Stage 2 complaints will be handled following this procedure, ensuring the following take place:
• Acknowledgement of stage 2 complaints within 2 working days informing complainants of the
investigation process and expected timescales for a response.
• Managing Director is informed of the escalation of the complaint and a senior manager not involved in
the initial investigation of the complaint is
assigned to review the investigation.
• Thorough review of the investigation of the initial complaint ensuring methods and findings are
documented.
• Formal written response provided to the complainant within 28 days, describing the methods used in the
investigation, findings and any action taken as a result.
• Complainant kept informed of the reason for delay if a response is likely to take longer than 28 days,
with a contact at a minimum of every 28 days.
• A full apology is offered if the complaint is upheld.
• Information sent to the complainant informing them of how to escalate their complaint to external bodies
for an independent review if they are not satisfied with
the response.
Stage 3
6.13. Should the complainant remain unhappy with the response provided to the complaint at
Stage 2, they are entitled to report the matter to the relevant body.
Compliments
6.14. A service may receive a compliment either in writing or verbally. The member of staff
who receives the compliment should ensure that compliments are forwarded to the Registered Manager
and allow them to be logged?
7. Complaints Investigation and Risk Management
7.1. The procedures for managing complaints, incidents and claims for negligence are dealt with under
separate policies. However, if during the course of investigating an incident, a
complaint is received, the incident procedure should take precedence in terms of investigation. If the
investigation of a complaint reveals the need to take action under the serious incident procedure or the
safeguarding procedures, the investigator should inform the Safeguarding Team or Managing Director
and again the incident procedure should take precedence in terms of investigation. In these
circumstances, the complainant should be informed of the investigation, kept updated on progress and
informed of the outcome.
7.2. If the investigation of a complaint reveals a possibility that there may have been negligence, the
Managing Director must be immediately notified. The existence of negligence does not prevent a full
explanation from being given and if appropriate, an apology. An apology is not an admission of liability.
8. Unreasonably Persistent Complainers
©2023 Ultra Health Care. Only CINOX HEALTHCARE LTD can access this policy. Sharing, copying or
distribution to unregistered entities constitutes a breach of contract. This document cannot be shared or
copied without the prior written approval of Ultra Health Care. Breach of contract subject to prosecution.
Prohibited from unauthorised distribution.
Page 6 of 9
CINOX HEALTHCARE LTD
39 Rush Green Road, Romford RM7 OPT
8.1. Complainants that could be described as unreasonably persistent through either the quantity or
unreasonableness of their complaints require a considered approach. At no time should a complaint be
excluded from consideration under this policy. In cases where the Manager considers that a complainant
is unreasonably persistent, they should consider putting in place a system for managing this that is
appropriate and proportional to the situation. This should be considered in isolation and may involve the
advocates or other relevant people.
If a complainant has made unreasonable complaints in the past, we will not assume that their next
complaint is unreasonable. Each case will be considered on its merits.
All relevant correspondence will be evaluated to consider the circumstances, including:
• whether a complainant has made persistent or unreasonable demands
• whether there is a strong likelihood that complaints are being made to intentionally cause
harassment, divert resources or disrupt the proper workings of CINOX HEALTHCARE LTD
• or threatening to staff or has produced excessive correspondence
• whether the complainant displays vexatious behaviour
8.2. Such systems may include any or all of the following:
• A letter to the complainant setting out responsibilities for the parties involved if CINOX HEALTHCARE
LTD is to continue processing the complaint. If terms are contravened, consideration will then be given to
implementing other actions as indicated below.
• Decline contact with the complaint, either in person, by telephone, by fax, by letter, by email or any
combination of these, provided that one form of contact is maintained.
This may also mean that only one CINOX HEALTHCARE LTD employee will be nominated to maintain
contact (and a named deputy in their absence). The complainant will be notified of this person.
• Notify the complainant, in writing, CINOX HEALTHCARE LTD has responded fully to the points raised
and has tried to resolve the complaint but there is nothing more to add and continuing contact on the
matter will serve no useful purpose. The complainant will also be notified that the correspondence is now
at an end.
Confidentiality
Under the Data Protection Act 2018 and the Human Rights Act 1998, all personal and sensitive
organisational information, however, received, is treated as confidential, including:
• anything of a personal nature that is not a matter of public record about a customer, member of
staff, or volunteer
• sensitive organisational information.
We will ensure that the members of staff managing the complaint only involve other agencies and share
information with the consent of the individual concerned, unless:
CINOX HEALTHCARE LTD is required to share information by law
• The information is necessary for the safeguarding of vulnerable adults or children
9. Complaints that cannot be dealt with under this policy
9.1. A complaint made by an employee about any matter relating to their employment.
9.2. A complaint, the subject of which has previously been investigated under this policy.
9.3. A complaint that is being or has been investigated by the Ombudsman.
9.4. A complaint arising out of an alleged failure to comply with a request for information under the
Freedom of Information Act 2000 or a subject access request under the Data Protection Act 2018.
9.5. A complaint which CINOX HEALTHCARE LTD has been notified that criminal proceedings have
been commenced in relation to the substance of the complaint where it will prejudice the proceedings.
10. Learning from Compliments and Complaints
10.1. CINOX HEALTHCARE LTD views feedback in the form of complaints and compliments to be a
valuable resource in continually monitoring and improving the quality of service provided.
10.2. All compliments received will be reviewed by the Quality and Governance Team to identify if any
good practices can be shared across the organisation.
10.3. Complaint trends, lessons learned, and any action taken as a result will be reviewed within the
quality and governance structures of CINOX HEALTHCARE LTD at all levels of the organisation.
©2023 Ultra Health Care. Only CINOX HEALTHCARE LTD can access this policy. Sharing, copying or
distribution to unregistered entities constitutes a breach of contract. This document cannot be shared or
copied without the prior written approval of Ultra Health Care. Breach of contract subject to prosecution.
Prohibited from unauthorised distribution.
Page 7 of 9
CINOX HEALTHCARE LTD
39 Rush Green Road, Romford RM7 OPT
If it is identified that the actions implemented are applicable to other services, the action will be added to
the action plans of those services. The implementation of actions will be monitored.
11. Records and Retention
11.1. A comprehensive record of all documentation related to a complaint will be retained following this
procedure, including all internal correspondence, such as emails and file notes, investigation records and
statements from staff which should be timed and dated where possible.
11.2. Copies of concern or complaint correspondence must not be kept in the service user’s medical
records, subject to the need to record any information which is strictly relevant to their health. Concern or
complaint correspondence must be kept and stored separately whether in paper or electronic format, with
access only given were strictly required according to the job role.
11.3. In line with the Data Protection Act 2018, complaints documentation is classified as personal data.
Clients are able to request copies of complaints files in the same way as they do for their health records.
12. Training Requirements
12.1. All staff required to complete a complaints form will be shown how to do this as part of their
induction training program. Further training will be provided for staff in specialised roles where relevant.
13. Policy Review Statement
13.1. This document may be reviewed at any time at the request of either staff or management but will
automatically be reviewed every year from initial approval and thereafter on an annual basis unless
organisational changes, legislation, guidance, or non-compliance prompt an earlier review.
Contacting External Organisations:
Complainants have the right to refer their complaint to the Local Government Ombudsman (LGO) if they
are unhappy with the outcome of the investigation. Once a complaint has been fully dealt with by CINOX
HEALTHCARE LTD and the Complainant remains unsatisfied with the outcome, they can complain to the
Local Government Ombudsman (LGO).
The LGO provides a free, independent service.
Complainants can contact the LGO Advice Team for information and advice, or register one’s complaint:
Telephone: 0300 061 0614
Email: advice@lgo.org.uk
Website: www.lgo.org.uk
The LGO will not usually investigate a complaint until the provider has had an opportunity to respond and
resolve matters.
Care Quality Commission (CQC)
National Correspondence
Citygate,
Gallowgate
Newcastle upon Tyne
NE1 4PA
Tel: 03000 616161 Fax: 03000 616171
https://www.cqc.org.uk
14. Associated Documents and References
• Consent to Care
• Consent to Share
• Data Protection Act 2018
• Freedom of Information Act 2000
• Freedom of Information Act the Social Care and Social Work Improvement Scotland
• Health and Social Care Act 2008 (regulated activities) Regulations 2014
• Human Rights Act 1998
• Mental Capacity Act 2005
• National Care Standards at Home 2005
• Health and Social Care Act 2008 (Regulated Activities) Regulations 2014: Regulation 20- Duty of
Candour
• Risk Management
©2023 Ultra Health Care. Only CINOX HEALTHCARE LTD can access this policy. Sharing, copying or
distribution to unregistered entities constitutes a breach of contract. This document cannot be shared or
copied without the prior written approval of Ultra Health Care. Breach of contract subject to prosecution.
Prohibited from unauthorised distribution.
Page 8 of 9
CINOX HEALTHCARE LTD
39 Rush Green Road, Romford RM7 OPT
• Safeguarding Policies
• Serious Incidents Requiring Investigation
• The Care Act 2014
• Local Authority Social Services and National Health Service Complaints (England) Regulations
2009. Online Accessed on 26/10/2022
Getting Help
If you require any help with any matters relating to this policy and procedure, please speak to
your line manager or senior manager.
It is the responsibility of every member of staff to ensure that they are working within this policy
and keep up to date with changes in policy that may affect their practise at work.
Forms associated with this policy:
1) Complaint investigation form
2)Complaint acknowledgement letter
©2023 Ultra Health Care. Only CINOX HEALTHCARE LTD can access this policy. Sharing, copying or
distribution to unregistered entities constitutes a breach of contract. This document cannot be shared or
copied without the prior written approval of Ultra Health Care. Breach of contract subject to prosecution.
Prohibited from unauthorised distribution.
Page 9 of 9
Safeguarding Policy for Adults and Children
Cinox Healthcare Service
39 Rush Green Road, Romford, RM7 0PT
Telephone: (01708) 982612
Email: info@cinoxcare.co.uk
Safeguarding Policy for Adults and Children
(Regulation 13 – Safeguarding Service Users from Abuse and Improper Treatment)
Document Control and Authorisation
Field Detail
Version
1.0
Date Created 05 January 2026
Next Review Date 05 January 2027
Approved by Chinwe Eucheria Mbah-Uzobude –
Registered Manager / Nominated
Individual
Distribution All staff, volunteers, contractors, and
available to all service users and
stakeholders upon request.
1. Purpose, Scope, and Guiding Principles of Safeguarding
1.1. Core Commitment and Legislative Foundation
Cinox Healthcare Service holds an absolute and unwavering commitment to safeguarding
the welfare, rights, and safety of every child, young person, and adult at risk who utilises its
services. This commitment is deeply embedded in the service’s operations and is mandated
by key statutory frameworks, including:
● The Care Act 2014, which sets out the legal duties for adult safeguarding.
● The Children Act 1989 and 2004, establishing the paramountcy of child welfare.
● Working Together to Safeguard Children 2023, defining multi-agency child
protection arrangements.
● The Health and Social Care Act 2008 (Regulated Activities) Regulations 2014,
specifically Regulation 13 on freedom from abuse and improper treatment.
1.2. Applicability and Scope of the Policy
This comprehensive policy is mandatory and applies universally across the entire service,
encompassing:
● Personnel: All individuals working for Cinox Healthcare Service, including
permanent employees, bank staff, volunteers, agency workers, external contractors,
and students on placement.
● Service Users: All individuals receiving regulated activities, specifically personal
care or the treatment of disease, disorder, or injury (TDDI), within their own homes or
community settings, covering all age groups (0–65 and 65+).
● Specialisms: The policy is tailored to address specific safeguarding vulnerabilities
across all specialisms provided by the service, including autism and learning
disabilities, dementia, physical disabilities, sensory impairment, and mental health
needs.
1.3. Fundamental Safeguarding Principles
Safeguarding practice within Cinox is underpinned by established national principles:
● Adult Safeguarding Principles (Care Act 2014):
○ Empowerment: Supporting people to make their own decisions and informed
consent.
○ Prevention: Taking action before harm occurs.
○ Proportionality: The least intrusive response appropriate to the risk
presented.
○ Protection: Providing support and representation for those in greatest need.
○ Partnership: Working with local communities and professionals for joined-up
solutions.
○ Accountability: Clear roles and responsibilities and transparent processes.
● Child Safeguarding Principle: The “paramountcy of welfare” principle, meaning
the child’s welfare must be the primary consideration in all decisions and actions
taken in relation to their safety.
2. Legal and Regulatory Framework
Cinox Healthcare Service operates in full compliance with the following statutory and
regulatory landscape:
● Health and Social Care Act 2008 (Regulated Activities) Regulations 2014:
○ Regulation 13: Ensuring service users are safeguarded from abuse and
improper treatment.
○ Regulation 17: Maintaining good governance, including effective systems for
managing risks and quality.
○ Regulation 18: Ensuring sufficient and appropriately skilled staffing to
provide safe care.
● Care Act 2014 and Statutory Guidance: Establishing the duties of local authorities
and partners in adult safeguarding.
● Children Act 1989 and 2004, and Working Together to Safeguard Children 2023:
Mandating multi-agency working for child protection.
● Mental Capacity Act 2005 and Code of Practice: Governing decisions made on
behalf of individuals who lack capacity.
● Human Rights Act 1998 and Equality Act 2010: Ensuring all safeguarding
responses respect the human rights and protect against discrimination of service
users.
This policy is integral to demonstrating compliance with the Care Quality Commission (CQC)
fundamental standards, ensuring the service is judged to be Safe, Effective, Caring,
Responsive, and Well-led.3. Key Definitions in Safeguarding
3.1. Abuse and Neglect
Abuse and neglect are broad concepts and are not limited to:
● Physical Abuse: Including hitting, slapping, pushing, misuse of restraint, or
inappropriate sanctions.
● Emotional/Psychological Abuse: Including threats, intimidation, humiliation,
isolation, or harassment.
● Sexual Abuse: Including sexual assault, sexual exploitation, or non-consensual
sexual acts.
● Financial or Material Abuse: Including theft, fraud, pressure in connection with
wills, property or inheritance, or misuse of property, possessions, or benefits.
● Discriminatory Abuse: Including racist, sexist, homophobic, transphobic, or ageist
abuse, or abuse based on a person’s disability, faith, or background.
● Organisational/Institutional Abuse: Including neglect and poor practice within an
institution or specific care setting, such as repeated instances of poor care, rigid
routines, or lack of choice.
● Domestic Abuse: Any incident or pattern of incidents of controlling, coercive,
threatening behaviour, violence or abuse between those aged 16 or over who are, or
have been, intimate partners or family members.
● Modern Slavery: Including human trafficking, forced labour, and domestic servitude.
● Self-Neglect: Where a person neglects their personal hygiene, health, or
environment and refuses necessary care, which may place them at risk of harm.
● Neglect or Acts of Omission: Including failing to provide basic needs such as
medication, food, heating, or medical care.
3.2. Terminology
● Child: Anyone under the age of 18 years.
● Adult at Risk: A person aged 18 or over who:
1. Has needs for care and support (whether or not the local authority is meeting
any of those needs).
2. Is experiencing, or is at risk of, abuse or neglect.
3. As a result of those care and support needs, is unable to protect themselves
from either the risk of, or the actual experience of, abuse or neglect.
3.3. Specific Risks for Children and Young People
The service specifically recognises and trains staff to be aware of elevated risks for children
and young people, including: domestic abuse, criminal and sexual exploitation (including
county lines), grooming, online abuse, forced marriage, and female genital mutilation (FGM).
4. Service User Groups and Vulnerabilities
Cinox acknowledges that the diverse needs of its service users create varying levels of
vulnerability to abuse or neglect. Staff must be highly attuned to these risk factors:
Service User Group
Autism and Learning
Disabilities
Key Vulnerabilities and
Increased Risks
Mitigating Actions for
Staff
Communication
differences, reliance on
others for
decision-making and
personal care, difficulties
in understanding risk or
complex consent,
isolation, and
susceptibility to
Use accessible
information, establish
clear boundaries, use
preferred communication
methods (e.g., visual
aids, Makaton), and
work with independent
advocates.
exploitation.
Dementia Impaired memory,
orientation, and
judgement, increased
dependency on
caregivers, potential for
misinterpreting care
interventions as assault,
and vulnerability to
financial abuse.
Provide person-centred
care, ensure clear
identification of staff,
manage transitions
carefully, and involve
family/advocates in
financial management.
Physical Disabilities Significant need for
personal care and
intimate assistance,
dependence on
equipment, barriers to
mobility, reduced ability
to communicate
concerns quickly, and
isolation.
Ensure all equipment is
safe, maintain dignity
during personal care,
facilitate independent
communication (e.g.,
communication boards),
and respect privacy.
Sensory Impairments Reduced ability to see,
hear, or interpret
environmental cues or
warning signs of danger,
increased isolation, and
difficulty accessing
crucial safety
information.
Ensure staff are trained
in sensory-specific
communication, use
clear verbal and
non-verbal cues, and
make sure
documentation is
available in accessible
formats.
Mental Health Needs Stigma, potential for
coercion or
manipulation,
dependency on services,
impaired perception of
risk due to symptoms,
and possible exploitation
Promote empowerment
and recovery, ensure
transparent information
sharing, respect
confidentiality, and
conduct thorough,
decision-specific
due to instability or
homelessness.
capacity assessments.
Staff Obligation: Staff must proactively adapt their communication styles, ensure all
information is accessible, and work closely and collaboratively with families, advocates,
and multi-disciplinary professionals to actively mitigate these inherent risks.
5. Roles and Responsibilities in Safeguarding
Safeguarding is the responsibility of every individual associated with Cinox Healthcare
Service, but specific roles carry mandated duties:
5.1. Registered Manager / Nominated Individual / Director / Clinical & Safeguarding
Lead (Chinwe Eucheria Mbah-Uzobude)
This role holds the highest level of accountability and is responsible for:
● Overall Leadership: Providing effective leadership for safeguarding children and
adults, fostering a culture of safety, and ensuring governance systems are robust.
● Policy Compliance: Ensuring all staff are aware of, trained on, and consistently
adhere to this policy, and that all concerns are acted upon with due diligence,
promptness, and appropriateness.
● Culture: Promoting an open, transparent, and learning culture where abuse is not
tolerated and staff can raise concerns, including whistleblowing, without fear of
reprisal.
● External Cooperation: Ensuring full and active cooperation with statutory partners,
including the Local Safeguarding Adults Board (LSAB) and Local Safeguarding
Children Partnership (LSCP), and participating in all relevant safeguarding reviews
(SARs/SCRs).
● Systemic Safeguards: Establishing and maintaining robust systems for safer
recruitment, mandatory safeguarding training, effective supervision, and critical
incident analysis.
5.2. Deputy Manager
The Deputy Manager provides essential support and cover, with responsibility for:
● Safeguarding Deputy: Acting as the primary Safeguarding Deputy in the absence of
the Registered Manager, including making necessary decisions regarding external
referrals to the local authority and other agencies.
● Staff Supervision: Providing hands-on, day-to-day supervision of care staff,
verifying their understanding of, and adherence to, safeguarding procedures.
● Immediate Action: Ensuring immediate safety actions are correctly implemented
when a concern arises during their shift.
● Investigating any Safeguarding concerns raised against the manager
5.3. Care Coordinator
The Care Coordinator is crucial for the effective, practical management of safeguarding
risks at the point of care delivery:
● Documentation: Ensuring all relevant safeguarding information, risk assessments,
and vulnerability details are clearly and accurately recorded within service user care
plans.
● Monitoring and Flagging: Systematically monitoring patterns of incidents, missed
visits, or unusual observations across service user care packages and immediately
flagging potential concerns to the Registered Manager or Deputy.
● Information Sharing: Ensuring information sharing with other professionals and
agencies is timely, accurate, lawful, and proportionate to the concern.
5.4. All Staff, Volunteers, and Contractors
All individuals working for Cinox are required to:
● Personal Duty: Treat safeguarding as everyone’s personal responsibility and
actively intervene or report to protect service users from harm, abuse, or neglect.
● Recognise, Respond, Record, Report (4Rs):
○ Recognise the signs and indicators of abuse.
○ Respond appropriately and immediately ensure safety.
○ Record all concerns accurately, factually, and contemporaneously.
○ Report the concern immediately to the Registered Manager/Deputy or
directly to external agencies if the concern is urgent or the Registered
Manager is implicated.
● Training Compliance: Attend and fully participate in mandatory safeguarding
training and ensure their professional knowledge remains current and up-to-date.
Non-Compliance: Failure to adhere to the duties outlined in this policy will be addressed
seriously through the service’s performance management or disciplinary procedures. Severe
breaches may result in referral to professional regulators (e.g., NMC, Social Work England)
or the Disclosure and Barring Service (DBS) where criteria are met.
6. Safeguarding Procedures – Adults and Children
6.1. Recognising Abuse and Neglect: Indicators
Staff must be trained to recognise potential indicators of abuse and neglect, which may
manifest as:
● Physical: Unexplained injuries (bruises, cuts, burns), frequent falls, or reluctance to
discuss injuries.
● Behavioural/Emotional: Sudden, significant changes in behaviour or mood, unusual
fearfulness, avoidance of certain people, withdrawal, or low self-esteem.
● Neglect/Self-Neglect: Poor personal hygiene, malnutrition, dehydration, untreated or
recurring medical problems, or unsuitable/hazardous living conditions.
● Financial: Unexplained loss of money or possessions, inability to account for
finances, or sudden changes in financial arrangements (e.g., changes to wills).
For children and young people, staff must also be acutely aware of specific indicators
relating to exploitation, radicalisation, online abuse, and the impact of domestic abuse within
the home.
6.2. Immediate Response to Safeguarding Concerns (The First 5 Steps)
If a staff member becomes aware of, or suspects, abuse or neglect involving a child,
young person, or adult:
1. Ensure Immediate Safety: The absolute priority is the safety of the person at risk.
Call emergency services (999 or 111) immediately if the person is in immediate
danger, requires urgent medical attention, or a crime is in progress.
2. No Promise of Confidentiality: Explain clearly to the person that you cannot
promise confidentiality, as the information must be shared with people and agencies
who have the authority and duty to help keep them safe.
3. Listen and Avoid Leading: Listen carefully, calmly, and non-judgementally. Do not
interrogate the person. Avoid asking leading questions (e.g., “Did [name] hurt you?”).
Use open questions (e.g., “Tell me what happened next”).
4. Record Factual Detail: Document the concern as soon as physically possible. The
record must be factual, include the person’s exact words where possible, and clearly
note the date, time, place, people present, and the staff member’s factual
observations.
5. Report Internally Immediately: Report the concern immediately to the Registered
Manager or, if they are absent, the Deputy Manager.
External Escalation: If a staff member believes that reporting internally would delay the
necessary protective action, or would put the person at further risk (e.g., if the manager is
implicated), they must bypass the internal route and contact the local authority, police, or
other relevant agency directly.
6.3. Reporting to External Statutory Agencies
The Registered Manager/Deputy is responsible for submitting formal statutory referrals:
● For Adults: The concern must be reported to the Local Authority Adult
Safeguarding Team in the area where the adult usually resides, strictly following
local Safeguarding Adults Board (LSAB) procedures.
● For Children and Young People: The concern must be reported to Children’s
Social Care or the Multi-Agency Safeguarding Hub (MASH), in line with Local
Safeguarding Children Partnership (LSCP) procedures.
● Police Involvement: Where a crime is suspected, or there is an immediate risk of
serious harm, the Police must be contacted immediately via 999 or 101.
● CQC Notification: The Registered Manager/Deputy must also consider notifying the
Care Quality Commission (CQC) of safeguarding incidents under statutory
notification requirements (Regulation 18 and associated guidance).
6.4. Multi-Agency Working and Review
Cinox is committed to robust multi-agency collaboration by:
● Participation: Actively participating in strategy meetings, case conferences, core
groups, and review meetings as requested by statutory partners.
● Information Sharing: Sharing relevant information lawfully, proportionately, and in a
timely manner with social care, health services, police, and other mandated partners.
● Learning and Implementation: Contributing to Safeguarding Adults Reviews
(SARs) and Child Safeguarding Practice Reviews (CSPR) where required, and
diligently implementing all mandated learning points from these reviews into service
practice.
7. Allegations and Concerns about Staff
Any allegation or serious concern regarding the conduct or competence of a member of
staff, volunteer, contractor, or anyone working on behalf of Cinox must be treated as a
priority safeguarding concern. This applies if the person has:
● Behaved in a way that has harmed, or may have harmed, a child or adult at risk.
● Possibly committed a criminal offence against, or related to, a child or adult at risk.
● Behaved in a way that indicates they may pose a risk of harm to children or adults at
risk.
Management of Allegations:
The Registered Manager/Deputy will:
● Immediate Risk Management: Ensure the person against whom the allegation has
been made is immediately removed from direct contact with service users while
inquiries are ongoing (suspension, redeployment, or change of duties), where
necessary.
● Statutory Referral: Report the matter to the local authority safeguarding team
(Dorset Council 01305 221016and Out of Hours on 01305 221000). For concerns
about a child, the matter must also be reported to the Local Authority Designated
Officer (LADO) as required by local LSCP procedures.S
● Referral to Barring Service: Consider and, where criteria are met, make referrals to
the Disclosure and Barring Service (DBS) and relevant professional regulators
(e.g., NMC).
8. Raising Safeguarding Concerns about the Registered Manager
Cinox recognises that the multiple roles held by the Registered Manager (Nominated
Individual, Director/Owner, Clinical Lead, and Safeguarding Lead) create a potential conflict
of interest if an allegation or serious concern involves this role holder.
To ensure transparency, independence, and the absolute safety of service users, all
stakeholders are encouraged to escalate concerns through the following designated routes
without fear of victimisation:
Route
Internal Route
Description and Procedure
Report directly to the Deputy
Manager, who is formally designated to
act as the internal safeguarding lead for
all concerns involving the Registered
Manager. This must be the first internal
step.
External Statutory Routes
Local Authority: Contact the Dorset
Adult Safeguarding Team (for adults)
on 01305 221016: Out of Hours on
01305 221000 or Children’s Social
Care/MASH and LADO (for children/
allegations against staff). CQC:
Contact the Care Quality Commission,
referencing Regulation 13 and
Regulation 17 failures. Police: Contact
999/101 where a crime is suspected.
Whistleblowing Routes
Stakeholders may use recognised
whistleblowing channels where they
consider there is a wider public interest
in the concern, including prescribed
bodies set out in Public Interest
Disclosure Act guidance (PIDA 1998).
Cinox Guarantee: No person raising a safeguarding concern or making a whistleblowing
disclosure in good faith about the Registered Manager will be victimised, treated unfairly, or
obstructed. All concerns will be fully documented, investigated by appropriate external
bodies, and Cinox will provide full cooperation.
9. Whistleblowing Policy Summary
Cinox maintains a separate, comprehensive Whistleblowing Policy, aligned with the Public
Interest Disclosure Act 1998 (PIDA) and CQC expectations for raising concerns about
malpractice, risk, or wrongdoing.
● Staff Duty: All staff have the fundamental right and professional duty to raise
concerns about any wrongdoing, risk, or malpractice that affects service users, staff,
or the organisation.
● Reporting Channels: Concerns can be raised internally (Registered Manager or
Deputy Manager) or externally with the CQC, local authority, or other prescribed
bodies if internal reporting is deemed inappropriate or ineffective.
● Protection: Whistleblowers who act in good faith are protected by law from
dismissal, detriment, or victimisation.
10. Information Sharing, Confidentiality, and Record-Keeping
10.1. Information Sharing
Information will be shared:
● Lawfully: In line with data protection legislation (GDPR) and the principles of
confidentiality.
● Principle: On a strict ‘need-to-know’ basis.
● Caldicott Principles: Guided by the Caldicott principles, ensuring information is only
used when necessary, with minimum identifiable information, and shared only with
authorised individuals.
● Overriding Duty: Where there is a safeguarding concern, the duty to safeguard and
promote welfare overrides the duty of confidentiality. However, information sharing
will always remain proportionate and lawful.
10.2. Record-Keeping
Records of safeguarding concerns will:
● Be factual, clear, complete, contemporaneous, and signed/dated by the person
making the record.
● Include what was said or observed, all immediate actions taken, who was
informed, and any decisions made.
● Be stored securely and retained in accordance with Cinox’s records management
and GDPR policies.
11. Mental Capacity, Consent, and Safeguarding
Staff must apply the principles of the Mental Capacity Act 2005 (MCA) diligently:
● Assumption of Capacity: Capacity must always be assumed unless it is proven
otherwise on a decision-specific and time-specific basis.
● Support: Individuals must be supported to make their own decisions wherever
possible.
● Best Interests: Where an adult lacks capacity for a specific decision, a best interests
decision must be made, involving the individual, family, advocates, and professionals
as appropriate.
● Abuse and MCA: A lack of capacity must never be used as a justification for abuse,
neglect, or poor-quality care.
Refusal of Consent: Where a person with capacity refuses consent to share information,
Cinox will respect this, unless there is an identified risk of serious harm to them or others, or
a wider public interest that justifies sharing without their consent.12. Safer Recruitment and
Staff Checks
Cinox operates a robust safer recruitment process to prevent unsuitable people from working
with children or adults at risk, including:
● Vetting: Comprehensive verification of identity, references, full employment history,
and right to work.
● DBS Checks: Mandatory Enhanced DBS checks (including barred list checks
relevant to the role) before any unsupervised work with children or adults at risk
commences.
● Assessment: Thorough assessment of character, values, professional boundaries,
and understanding of safeguarding during the interview process and probation
period.
DBS Referral: Any staff member who is dismissed or removed from regulated activity
because they have harmed, or posed a risk of harm, to a child or adult at risk will be
referred to the DBS.13. Training, Supervision, and Safeguarding Culture13.1. Training
and Supervision
● Mandatory Training: All staff must receive safeguarding adults and children
induction training before unsupervised practice, with refreshers mandated at least
every 2 years, or sooner if required by policy changes or identified learning needs.
● Role-Specific Training: Additional, specialised training is provided for the
Registered Manager, Deputy Manager, and staff with specific lead responsibilities,
aligned with LSAB/LSCP requirements and NHS safeguarding frameworks.
● Supervision: Staff receive regular professional supervision and annual appraisals.
These forums must include mandatory discussion of safeguarding concerns,
professional boundaries, and reflective learning from incidents.
13.2. Promoting a Safety-First Culture
Cinox is dedicated to fostering a safety-first culture by:
● Empowerment: Actively encouraging staff to challenge poor practice, speak up, and
report concerns without fear of reprisal.
● Learning and Review: Systematically reviewing all safeguarding incidents,
complaints, and feedback to identify underlying patterns, implement corrective
actions, and share learning across the organisation.
● External Learning: Sharing learning from local and national safeguarding reviews
(SARs, CSPRs) within team meetings and training sessions to continuously improve
practice.
14. Audit, Monitoring, and Review
The Registered Manager/Deputy is responsible for the continuous quality assurance of
safeguarding practices:
● Safeguarding Log: Maintaining a detailed and accurate safeguarding log that
records all concerns, referrals, outcomes, and identified learning points.
● Annual Audit: Auditing safeguarding records at least annually to verify the
timeliness and quality of documentation, effectiveness of risk management plans,
and completion of follow-up actions.
● Governance Reporting: Reporting safeguarding themes, trends, and remedial
actions to internal governance meetings and responding transparently to external
scrutiny from the CQC and local safeguarding partners.
Policy Review: This policy will be reviewed at a minimum annually, or sooner if:
● Significant changes occur in legislation, statutory guidance (e.g., Working Together to
Safeguard Children).
● Learning from serious incidents, SARs, CSPRs, or CQC inspections indicates a need
for immediate changes in policy or procedure.
15. Policy Access and Implementation
● Accessibility: This policy will be made available to all staff, service users, and
stakeholders upon request and will be a mandatory component of all staff induction
packs.
● Supporting Materials: The policy is supported by detailed procedures, flowcharts,
and forms that outline the precise practical steps staff must follow when a concern
arises.
● Service User Information: The policy and procedures will be explained to service
users and their families in accessible formats, ensuring that language, literacy levels,
communication needs, and mental capacity are appropriately considered.
Implementation of and adherence to this policy are mandatory for everyone working for or
on behalf of Cinox Healthcare Service. Any failure to adhere to this policy may be treated as
misconduct and may also be reported to external regulatory bodies where required.
POLICY &
PROCEDURE
CONTACT INFORMATION
07854280352
asabuku06@gmail.com
39 Rush Green Road, Romford RM7 OPT
Accessible Information Standards Policy and Procedure
Summary Cinox Healthcare Ltd recognises the importance of effective
communication with service users, their relatives and carers, and
the importance of providing information that enables them to receive
appropriate person-centred care and support. It also recognises that
people must receive safe care and are not put at risk of harm
because of lack of or ineffective communication with their service
provider.
Scope The following people may be affected by this policy: All staff.
Whether temporary or permanent, Local Authorities,
Commissioners. Families, NHS, and Service users.
Docume
nt Type
Policy & Procedure
Verified By Chinwe Eucheria
Issued
Date
01-03-2023
Last
Review
06-07-2025 to be reviewed on 06-07-2026
Accessible Information Policy
The document sets out the values, principles and policies underpinning Cinox
Healthcare Ltd’s approach to providing accessible information for services users, their
©2024 Care Quality
Support. Only Cinox
Healthcare Ltd can access
this policy. Sharing, copying or distribution to
unregistered entities constitutes a breach of
contract. This policy cannot be shared or
copied without the prior written approval of
Care Quality Support. Breach of contract
subject to prosecution. Prohibited from
unauthorised distribution.
PAGE 1 of 6
V.1001
POLICY &
PROCEDURE
CONTACT INFORMATION
07854280352
asabuku06@gmail.com
39 Rush Green Road, Romford RM7 OPT
relatives, and carers. It should be used in relation to the Service Users with
Communication Difficulties Policy.
Policy Statement
Cinox Healthcare Ltd recognises the importance of effective communication with
service users, their relatives and carers, and the importance of providing information that
enables them to receive appropriate person-centred care and support. It also recognises
that people must receive safe care and are not put at risk of harm because of lack of or
ineffective communication with their service provider.
Cinox Healthcare Ltd understands that communication and the provision of information
is a fundamental part of treating people with dignity and respect and in providing good,
compassionate care. Furthermore, the service recognises that effective communication
can be affected by conditions such as dementia, stroke, hearing conditions, sight loss or
cases where the service user lacks capacity to make decisions.
Cinox Healthcare Ltd recognises its legal and ethical duties relating to effective
communication and the provision of information which includes the following.
1. A duty under s.250 of the Health and Social Care Act 2012 which requires all
organisations that provide NHS services or publicly funded adult social care to
follow the Accessible Information Standard.
2. A duty under the Equality Act 2010 to eliminate discrimination and make
reasonable adjustments for disabled people, such as those with hearing or visual
impairments, including taking steps to put information into accessible formats if a
disabled person is at a substantial disadvantage if this is not done.
3. Requirements under the Health and Social Care Act 2008 (Regulated Activities)
Regulations 2014, particularly Regulation 9: Person-centred Care, which states that
the care and treatment of service users must be appropriate, meet their needs and
reflect their preferences.
4. Regulation 10: Dignity and Respect, Regulation 11: Need for Consent, Regulation
12: Safe Care and Treatment, and Regulation 13: Safeguarding Service Users from
Abuse and Improper Treatment all require effective communication between
Healthcare Ltd can access this policy. Sharing,
copying or distribution to unregistered entities
constitutes a breach of contract. This policy
cannot be shared or copied without the prior
written approval of Care Quality Support.
Breach of contract subject to prosecution.
Prohibited from unauthorised distribution.
©2024 Care Quality
Support. Only Cinox
PAGE 2 of 6
V.1001
POLICY &
PROCEDURE service provider and user.
Key lines of enquiry
CONTACT INFORMATION 07854280352
asabuku06@gmail.com
39 Rush Green Road, Romford RM7 OPT
Caring C2: How does the service support people express their views and
be actively involved in making decisions about their care, support,
and treatment as far as possible?
Effective E4: How well do staff, teams, and services within and across
organisations work together to deliver effective care, support,
and treatment?
Responsive R1: How do people receive personalised care that is responsive
to their needs?
Safe S1: How do systems, processes and practices safeguard people
from abuse?
Well-Led W4: How does the service continuously learn to improve, learn
and ensure sustainability
Policy
To comply with the above requirements, the care service has adopted the following
policy.
©2024 Care Quality Support. Only Cinox
Healthcare Ltd can access this policy. Sharing,
copying or distribution to unregistered entities
constitutes a breach of contract. This policy
cannot be shared or copied without the prior
written approval of Care Quality Support.
Breach of contract subject to prosecution.
Prohibited from unauthorised distribution.
PAGE 3 of 6
V.1001
POLICY &
PROCEDURE
CONTACT INFORMATION
07854280352
asabuku06@gmail.com
39 Rush Green Road, Romford RM7 OPT
1. The service will implement the NHS Accessible Information Standard to achieve
excellent levels of support for service users with defined communication needs, and
to help their relatives and carers to address communication issues.
2. Service users have the right to be communicated with and receive sufficient
information about their care and treatment so that they make a balanced judgment
whether or not to give their consent.
3. The information and communication needs of service users will be identified as part
of their initial needs assessment and kept under review — this should include any
sensory problems affecting a person’s hearing or sight.
4. It is likely that prospective service communication needs will already have been
identified by other health and care agencies involved but we will always check that
these needs have been accurately assessed and addressed so that we can
communicate effectively with the person about their care needs and deliver the
appropriate care. (See step 1 of the Accessible Information Standard.)
5. We will clearly record the relevant information in the service users’ records in line
with step 2 of the Accessible Information Standard so that everyone involved in the
person’s care and support will know how to communicate effectively with that
person.
6. Cinox Healthcare Ltd will discuss with the service user as part of the care
planning process (and, if necessary, in consultation with other professionals and
agencies) what adjustments and interventions are needed to improve
communication with that person.
7. Agreed methods of communication and interventions will be recorded in the
person’s care plan in a prominent and consistent way so that all care staff know
exactly what has been agreed to meet the needs of service users, their relatives
and carers. (See step 3 of the Accessible Information Standard.)
8. Where a service user is transferred to another service, or receives care from
another service, we will, with the service users’ permission, share information that
we are requested to provide about their communication and information needs
(along with other information sharing) with the receiving service. (See step 4 of the
Accessible Information Standard.)
9. Where it is suspected that a service user does not have the mental capacity to
communicate, or in any other way has no ability to communicate, then the
provisions of the Mental Capacity Act 2005 will be implemented and best interests’
©2024 Care Quality
Support. Only Cinox
Healthcare Ltd can access
this policy. Sharing, copying or distribution to
unregistered entities constitutes a breach of
contract. This policy cannot be shared or
copied without the prior written approval of
Care Quality Support. Breach of contract
subject to prosecution. Prohibited from
unauthorised distribution.
PAGE 4 of 6
V.1001
CONTACT INFORMATION
07854280352
POLICY &
PROCEDURE
asabuku06@gmail.com
39 Rush Green Road, Romford RM7 OPT
decisions made, with the involvement of people close to the service user, such as
relatives, carers or advocates.
10. All reasonable adjustments will be made to meet the communication needs of
people with sensory difficulties, including people with visual and hearing difficulties. 11.
Where required and appropriate to the role of the care service, we will provide or
facilitate the sourcing and provision of resources and assistive technology such as
braille books and magazines, large print/easy read copies of literature, British Sign
Language interpreters for deaf people, braille or talking telephones and mobile phones,
hearing aids, text phones, loop hearing systems, etc.
12. For any service user, family member or carer who might require it, advocacy will be
provided or sought to help meet their communication and information needs. 13. All
staff are responsible for helping to deliver this policy by communicating in a way that is
accessible to every user of this service. (Points 9–13 all reflect step 5 of the Accessible
Information Standard.)
Training
At induction new care staff will receive training in line with the Care Certificate Standards
Framework with an emphasis in this policy context on Standard 6: Communication.
All care staff will receive training as relevant to their roles and responsibilities in the care
of people with hearing and sight problems and disabilities, which will include learning
about communication techniques and providing accessible information.
Review
This policy will be reviewed annually or more frequently in line with changes to the
national guidance and strategies on the provision of accessible information.
Associated Documents and References
Service Users with Communication Difficulties Policy.
Getting Help
©2024 Care Quality
Support. Only Cinox Healthcare Ltd can access
this policy. Sharing, copying or distribution to
unregistered entities constitutes a breach of
contract. This policy cannot be shared or
copied without the prior written approval of
Care Quality Support. Breach of contract
subject to prosecution. Prohibited from
unauthorised distribution.
PAGE 5 of 6
V.1001
POLICY &
PROCEDURE
CONTACT INFORMATION
07854280352
asabuku06@gmail.com
39 Rush Green Road, Romford RM7 OPT
If you require any help with any matters relating to this policy and procedure,
please speak to your line manager or Senior manager.
It is the responsibility of every member of staff to ensure that they are working
within this policy and keep up to date with changes in policy that may affect their
practice at work.
©2024 Care Quality Support. Only Cinox
Healthcare Ltd can access this policy. Sharing,
copying or distribution to unregistered entities
constitutes a breach of contract. This policy
cannot be shared or copied without the prior
written approval of Care Quality Support.
Breach of contract subject to prosecution.
Prohibited from unauthorised distribution.
PAGE 6 of 6
V.1001

