Last updated: September 2026
We look after a lot of sensitive information at EverKind, including information about people's health and care. Looking after that information properly is part of providing safe care.
This privacy statement explains what personal information EverKind Services collects, why we use it, where it may come from, who we may share it with, how long we keep it and the rights you have over your information.
It applies to people we support, people referred to our services, parents, family members and representatives, professionals who work with us, job applicants and people who contact us through our website.
Who we are
EverKind Services is the trading name of EverKind Yorkshire Ltd.
EverKind Yorkshire Ltd is the data controller for the personal information covered by this privacy statement. This means we are responsible for deciding how and why that information is used and for making sure it is handled appropriately.
We are registered with the Care Quality Commission to provide regulated care services.
Data Protection Officer
If you have a question about how we use personal information or would like to exercise one of your data protection rights, please contact:
James Falkingham
Data Protection Officer
EverKind Services
Email: hello@everkind.org.uk
What information do we collect?
The information we collect depends on your relationship with EverKind and why we need it.
For people receiving, or being considered for, care this may include:
We only collect information that is relevant to the reason we are processing it.
Health and other sensitive information
Because we provide complex care, some of the information we need is particularly sensitive.
Under data protection law, information about a person's health and certain other characteristics is known as special category data and receives additional protection.
We may need this information to assess whether we can safely provide care and, where we accept a package, to plan, provide, monitor and review that care.
We process health and social care information only where we have a lawful reason to do so and where the additional requirements for processing special category information are met.
For the provision and management of health and social care, this will commonly include Article 9(2)(h) of the UK GDPR, together with the relevant provisions of the Data Protection Act 2018.
Other conditions may apply where appropriate, for example where processing is necessary for safeguarding, employment obligations, legal claims, vital interests or other substantial public interest reasons.
Health data is special-category data, and the ICO specifically recognises Article 9(2)(h) as covering the provision and management of health and social care, subject to the associated UK-law requirements. ICO
Where does our information come from?
We may receive information directly from the person themselves.
We may also receive information from other people or organisations where it is appropriate and lawful to do so, including:
Sometimes someone else will make an initial referral to EverKind.
If you provide information to us about another person, we expect you to have an appropriate reason and authority to share that information.
Why do we use personal information?
We may use personal information to:
We will not use personal information for purposes that are incompatible with the reason it was collected unless we have a lawful basis for doing so.
Our lawful bases for using personal information
Data protection law requires us to have a lawful basis for processing personal information.
Depending on why we are using the information, we may rely on:
Contract
Where processing is necessary to enter into or perform a contract with you.
Legal obligation
Where we need to process information to comply with a legal or regulatory obligation.
Legitimate interests
Where processing is necessary for a legitimate interest of EverKind or another person and those interests are not overridden by the individual's rights and interests.
This may include appropriate administrative, quality, security and service-management activities.
Vital interests
In limited circumstances, information may be processed where this is necessary to protect someone's life.
Consent
There are circumstances where we may ask for consent to use information for a particular purpose.
However, we do not rely on consent for all health and care information we process. Where we have another lawful basis or are legally required to retain or use information, withdrawing consent will not necessarily require us to stop processing that information.
The ICO confirms that organisations must identify the appropriate Article 6 basis for the particular processing rather than treating consent as a universal basis. ICO
Children's information
EverKind provides care and support to children and young people and therefore processes information about them.
We recognise that children's personal information requires particular care.
We only collect and use information that is necessary for providing, planning, reviewing or managing their care, meeting safeguarding responsibilities, communicating with those involved in their care or fulfilling our legal and regulatory obligations.
Depending on the child's age, understanding and circumstances, information may be provided by or shared appropriately with parents, people with parental responsibility, representatives and professionals involved in their care.
As children mature, their own rights, views, capacity and confidentiality must also be considered.
The same data-protection requirements apply to children's special-category information: there must be an Article 6 lawful basis and an appropriate Article 9 condition. ICO
Family members and representatives
Providing care often means we also need information about people who are important to the person we support.
This may include names and contact details for parents, family members, emergency contacts, advocates, attorneys or other representatives.
We only use this information where it is relevant to the person's care, communication, safety or the management of the service.
Being a family member does not automatically give someone a right to another person's confidential information. We consider consent, capacity, parental responsibility, legal authority, safeguarding and the person's circumstances when deciding what information can appropriately be shared.
Professional referrals
Healthcare, social care and other professionals can make referrals to EverKind.
An initial referral should contain only the information reasonably necessary for us to understand the person's needs and decide whether we may be able to provide the requested care.
We may then request further information where it is necessary to properly assess and plan the package.
Please do not send full medical records or unnecessary personal information through our website referral forms.
Where detailed clinical records are required, we will advise how these should be shared securely.
Safeguarding
There may be circumstances where we need to share personal information to protect a child or adult from abuse, neglect or other serious harm.
Where appropriate and lawful, this may include sharing information with safeguarding teams, health and social care professionals, local authorities, regulators or the police.
We will not always need consent to share information for safeguarding purposes.
We will only share information that is relevant and necessary in the circumstances.
Who might we share information with?
Where necessary and lawful, information may be shared with organisations or professionals involved in someone's care or with organisations to whom we have legal or regulatory responsibilities.
These may include:
Where another organisation processes information on our behalf, we require appropriate data-protection and confidentiality arrangements to be in place.
We do not sell personal information.
Keeping information secure
We take appropriate technical and organisational measures to protect personal information against loss, misuse, unauthorised access, alteration or disclosure.
This includes controls around access to care records and business systems, staff confidentiality requirements, information governance processes, secure systems and staff training.
Access to information is limited to people who need it for their role.
How long do we keep information?
We keep personal information only for as long as it is required for the purpose for which it was collected and to meet applicable legal, regulatory, contractual and professional requirements.
Different types of records have different retention requirements.
Care records, children's records, employment information, recruitment records, financial information, safeguarding records and other business records may therefore be retained for different periods.
We follow our records retention arrangements and applicable health and social care guidance when determining how long information should be kept.
When information no longer needs to be retained, it is securely deleted or destroyed.
Website enquiries and forms
When you contact EverKind through our website, we may collect information such as your name, email address, telephone number and the information you choose to provide in your message or form.
We use this information to respond to your enquiry, consider a referral or process an application.
Please only provide information that is relevant to your enquiry.
Our website may also collect limited technical information necessary for its operation, security and performance.
Where cookies or similar technologies require consent, these are dealt with through our cookie settings and Cookie Policy.
Job applications
If you apply to work with EverKind, we will use the information you provide to manage your application and recruitment process.
This may include:
Where relevant to the role and permitted by law, recruitment may also involve DBS checks, health information and other safer-recruitment checks.
If you become employed or engaged by EverKind, relevant information will become part of your workforce record.
International transfers
Some organisations that provide technology or other services to EverKind may process or store information outside the United Kingdom.
Where personal information is transferred internationally, we take steps to ensure that an appropriate lawful transfer mechanism and safeguards are in place as required by UK data protection law.
Automated decision-making
EverKind does not make decisions about a person's care or employment that have legal or similarly significant effects solely through automated decision-making.
Care and recruitment decisions involve human consideration.
Your rights
Depending on the circumstances and the lawful basis being relied upon, data protection law gives you a number of rights over your personal information.
These can include:
The right to be informed
You have the right to know how your personal information is being used.
The right of access
You can ask us for a copy of personal information we hold about you.
The right to rectification
You can ask us to correct information that is inaccurate or complete information that is incomplete.
The right to erasure
In some circumstances, you can ask us to delete your personal information.
This right is not absolute. For example, we may need to retain information to meet legal, regulatory or care-record requirements.
The right to restrict processing
In certain circumstances, you can ask us to restrict how your information is used.
The right to data portability
In certain circumstances, you may have the right to receive information you have provided to us in a portable format.
The right to object
In certain circumstances, you can object to the way we process your personal information.
Rights relating to automated decision-making
You have rights relating to decisions made solely through automated processing where those decisions have legal or similarly significant effects.
Not every right applies in every situation. The right that applies will depend on the information concerned, why it is being processed and the lawful basis we are relying upon.
How to make a data protection request
If you would like to exercise a data protection right or have a question about information EverKind holds about you, contact:
Data Protection Officer
EverKind Services
Email: hello@everkind.org.uk
We may need to confirm your identity before releasing personal information.
We will respond within the timescales required by data protection law.
If you're unhappy with how we've used your information
If you have concerns about how EverKind has handled your personal information, please contact our Data Protection Officer so that we can look into the matter.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data protection regulator.
Information Commissioner's Office
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Changes to this Privacy Statement
We may update this Privacy Statement when our services, systems or legal requirements change.
The latest version will always be published on our website with the date it was last updated.
EverKind Services
The Elms Oakwood Park Business Centre, Fountains Road, Harrogate, North Yorkshire, HG3 3BF
Tel: 0330 223 7123
Copyright © 2026 EverKind Services - All Rights Reserved.
We use essential cookies to help our website work properly. With your permission, we also use analytics cookies to understand how people use our website and help us improve it. You can accept or decline analytics cookies.
You can find out more in our Cookies Policy.