Data Protection, Retention and Information Sharing

1. Purpose

Care Cove Alternative Provision holds very sensitive information about children: safeguarding concerns, health and therapy records, special educational needs, family circumstances and sometimes offending. This policy sets out how we keep that information accurate, secure and properly used, how we share it, and how we delete it when it is no longer needed.

Data protection law is never a reason to hold back information needed to keep a child safe.

The policy meets our duties under data protection law and our contracts with commissioning local authorities.

2. Scope

This policy covers all personal data held by the provision in any form (Care Cove Connect, email, paper, photographs, CCTV, meeting notes) about learners, families, staff, applicants, volunteers, partner staff, visitors and professionals. It applies to everyone who works for or with the provision, including First Class Teachers supply staff, My Solution Wellbeing counsellors, volunteers, sessional tutors and Social Work Management Committee (SWMC) members, and to every AP learner, whoever commissions the place.

Other Care Cove services in the building, such as Short Breaks, keep separate records. AP records are not shared with them, or with Dreams Are Real CIC, unless there is a lawful reason such as safeguarding.

3. Law and guidance

• UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025. The 2025 Act added "recognised legitimate interests" (including safeguarding vulnerable individuals), confirmed that a controller responding to a subject access request need only make reasonable and proportionate searches, and requires controllers to have a process for data protection complaints.

• Keeping Children Safe in Education 2026 (KCSIE), Working Together to Safeguard Children 2023 and the DfE information sharing advice for safeguarding practitioners.

• Freedom of Information Act 2000 and Environmental Information Regulations 2004, which apply to commissioning local authorities and affect us through our contracts with them.

• Human Rights Act 1998 (Article 8) and the common law duty of confidentiality.

• ICO guidance, including the Age Appropriate Design Code, which shapes the Student app.

4. Roles and responsibilities

5. Our status and arrangements

5.1 Controller and registration

Care Cove Limited is the controller of the provision's personal data and is registered with the Information Commissioner's Office; the Director keeps the registration certificate on file. The Director renews the fee each year.

5.2 Independent controllers with the commissioning local authority

Care Cove and the commissioning local authority are independent controllers of data about the children using the service, their families and the staff working with them. Each is responsible for its own compliance. We:

• share with the commissioning local authority only what our contract with it needs, as recorded in the data sharing agreement;

• keep appropriate security measures (section 9);

• keep a record of processing activities and give it to the commissioning local authority on reasonable request;

• forward requests relating to the commissioning local authority's processing within 5 working days (section 13);

• tell the commissioning local authority immediately about any breach affecting data it has given us (section 16);

• use the commissioning local authority's data only for its contract with us.

For placements from schools or other local authorities, we agree the same points in writing before the first admission.

5.3 Data sharing agreements and processors

• We sign data sharing agreements with each commissioning local authority and each referring school before the first admission. Each sets out what is shared, why, how, who can see it, how long it is kept and who handles requests and breaches. The Director reviews them yearly.

• Care Cove Connect is hosted in the UK by our processor under written terms (Article 28 UK GDPR). Every processor is listed in the record of processing activities.

• My Solution Wellbeing and First Class Teachers work under written agreements covering confidentiality, security and return of data. Their staff use Connect only through accounts we issue.

• Food Fusion receives only the dietary and allergen information needed to make each meal safe. Transport operators, the exam centre and placement employers receive only what their task needs.

6. The principles in practice

• Lawful, fair and open: a lawful basis for every purpose (section 7) and clear privacy notices (section 8).

• Purpose limited: placement information is never used for marketing, for Care Cove's other services or for social value reporting.

• Minimised: forms ask only what we need; we do not copy whole school files; email subjects use initials; reports use grouped figures unless names are needed.

• Accurate: records are made the same day, separating fact from opinion. Corrections are new linked entries in Connect, never overwrites.

• Time limited: we follow Appendix A.

• Secure and accountable: we follow section 9 and keep the DPIA, records and logs that show how we keep data secure.

7. What we hold and our lawful basis

The record of processing activities gives the lawful basis for every purpose. Where we rely on a condition in Schedule 1 to the Data Protection Act 2018, we keep the appropriate policy document it requires.

Care Cove makes no decisions about anyone by solely automated means.

8. Privacy notices

We publish privacy notices for learners (plain and age-appropriate, in the Student app and welcome pack, explained by the key mentor at the initial meeting), parents and carers (welcome pack and Family portal), staff, volunteers and applicants (at application and induction), and visitors and website users. Each explains what we collect, why, our lawful basis, who we share with (including the commissioning local authority and main school), how long we keep it, people's rights and how to complain, including to the ICO. The Director reviews them yearly and whenever processing changes.

9. Keeping information secure

9.1 Care Cove Connect controls

• Hosted in the UK; no data held outside the UK.

• Encrypted in transit and at rest.

• Role-based, least-privilege access. Anyone can raise a safeguarding concern but only permitted roles can read one; for everyone else the record is absent, not greyed out.

• Server-side scoping: every query returns only the learners that user may see. A school sees only its own placed learners; a commissioning local authority sees only the learners it has placed.

• Access protected by multi-factor authentication (MFA).

• Automatic timeout, device management and immediate removal of access when a member of staff leaves.

• An append-only audit log of every creation, read of a sensitive record, update and export, and an append-only chronology for each learner.

• Tested backup and restore, with a paper fallback register and safeguarding form for outages.

9.2 What every member of staff must do

• Use only your own login; never share passwords or MFA codes; lock your screen.

• Use only Care Cove managed devices for learner information. No learner data on personal devices: no photographs, notes, messages or downloads. Receiving an MFA code on your own phone is allowed because no personal data is stored.

• Record in Connect, not in notebooks or private messaging apps. Use Connect secure messaging; if email is unavoidable, check the address, use initials and send only what is needed.

• Do not discuss learners where you can be overheard, including outdoor classrooms, public transport and shared areas of 37 Townhead Street.

• Keep paper minimal and locked away. On off-site sessions carry only the emergency contacts and health information needed, and return them the same day.

• Report a lost or stolen device to the Director at once.

9.3 Paper records

During an outage, staff use the paper fallback register and safeguarding form. These are entered into Connect as soon as it is back, marked as copied from paper, and the original is scanned and attached, then shredded. The DSL may keep an original as evidence (for example a handwritten note of a disclosure) in the locked safeguarding cabinet.

9.4 Artificial intelligence tools

KCSIE 2026 and the DfE guidance on generative AI in education highlight the risks. Nobody may put personal data about a learner, family or colleague into any AI tool (chatbots, writing, transcription or translation tools) unless the Director has approved that tool in writing and the DPIA covers that use. AI tools are never used for safeguarding records.

9.5 Photographs and publicity

Photographs of learners are taken only on Care Cove devices and used beyond the learner's record only with written parental consent and the learner's agreement, never revealing that they attend alternative provision without that consent. We do not publicise our contracts or use a commissioning local authority's name or logo without its written consent.

10. DPIA and record of processing activities

The DPIA for Care Cove Connect and AP processing is completed and signed before we start working with learners. The Director reviews it yearly and after any material change (a new system, partner, type of data, sharing arrangement, AI tool or CCTV change), and the SWMC sees each review. The record of processing activities (Article 30 UK GDPR) lists purposes, data, recipients, processors, location, retention and security, and is given to the commissioning local authority on reasonable request.

11. Sharing information to keep children safe

KCSIE and the DfE information sharing advice are clear: data protection law does not prevent or limit sharing information to keep children safe, and fears about sharing must never stand in the way of protecting a child. The safeguarding condition in Schedule 1 allows sharing without consent where consent cannot be given, cannot reasonably be expected, or asking would put the child at risk.

1. Staff record any concern on Connect the same day and tell the DSL immediately. Counsellors tell the DSL within the session.

2. The DSL decides within the hour on contact with the school and family, Early Help or a Sheffield Safeguarding Hub referral, under the Safeguarding and Child Protection policy.

3. What we share is necessary, proportionate, accurate, timely and sent securely.

4. The DSL records on the chronology what was shared, with whom, when and why, including any decision not to share.

5. Parents are told unless that would increase the risk to the child.

The main school's DSL is kept informed throughout. When a learner leaves, the DSL sends the child protection file securely to the main or receiving school's DSL, separately from the education record, within 5 school days (or the first 5 days of a new term), confirms receipt and, where helpful, speaks to the receiving DSL directly, as KCSIE 2026 advises.

Police requests are decided by the DSL or the Director, normally in writing except in an emergency, and recorded.

12. Everyday sharing

• Daily attendance goes to the referring school. Schools see progress, reviews and reintegration guidance for their own learners through the Partner portal, and a commissioning local authority has free read-only access for the learners it has placed.

• Information about the learner's time with us goes to the main school during the placement, with a summary and strategy guidance at the end.

• Parents use the Family portal. Before sharing with a parent, check Connect for contact restrictions and parental responsibility; if in doubt, ask the DSL.

• Confirm a caller's identity before giving information by phone, calling back on a known number if unsure.

13. Individual rights and subject access requests

People can ask to see their data, have it corrected, and in some cases erased, restricted or moved, or object to its use. A request can be spoken or written, made to anyone, and need not mention data protection.

1. Pass it to the Director the same day; the Administrator logs it.

2. The Director confirms identity proportionately and clarifies the request if needed. The time limit runs from when we have what we need.

3. The Director decides who responds. We answer for our own records. A request relating to a commissioning local authority's processing is forwarded to it within 5 working days, and the requester told. A request for school records is referred to the school.

4. We make a reasonable and proportionate search, using the Connect audit log.

5. The Director reviews disclosures with the DSL (safeguarding records) or Clinical Advisor (health records), removes other people's information where appropriate, and applies exemptions only where the law allows, for example where disclosure would be likely to cause serious harm to the physical or mental health of the learner or another person.

6. We respond within one month, extendable by two further months for complex or numerous requests, telling the requester within the first month.

7. Requests are free unless manifestly unfounded or excessive.

A learner who understands their rights can make their own request, and many secondary-age learners will. A parent can ask on a child's behalf where the child agrees or cannot decide, and we consider the child's views and best interests. Corrections are linked entries; where someone disagrees with a professional opinion, we add their view. Erasure is limited where records must be kept for safeguarding, legal or contractual reasons.

14. Freedom of Information requests

Care Cove is not a public authority, but commissioning local authorities are. Under our contracts with them:

1. Any request for information about our contracts or the service, other than routine contact about a learner, goes to the Director the same day. It need not mention Freedom of Information.

2. The Director transfers it to the commissioning local authority within 2 working days of receipt and logs it.

3. We never respond directly unless the local authority authorises it in writing. We may tell the requester that the local authority has the request.

4. We supply information the local authority asks for, in the form it requires, within 5 working days of its request or any other period it reasonably sets.

5. The local authority decides what is disclosed. We keep contract information available for disclosure and inspection.

15. Data protection complaints

The Data Protection Act 2018, as amended in 2025, requires us to make complaining easy (including electronically), acknowledge complaints within 30 days, deal with them without undue delay and tell people the outcome.

• Complaints can be made by email to hello@carecove.co.uk, post, phone, in person or through the Family portal, using the form in our Complaints policy if wished. A data protection complaint raised under the Complaints policy moves to this route.

• We acknowledge within 3 working days. The Director investigates (the SWMC Chair if it concerns the Director) and aims to give a written outcome within one month.

• The outcome explains the right to complain to the ICO, which normally expects people to complain to us first.

• Complaints are logged and reported to the SWMC termly.

16. Personal data breaches

A breach is any security failure leading to the loss, destruction, alteration or unauthorised disclosure of, or access to, personal data: for example an email to the wrong person, a lost register, someone seeing a record they should not, a stolen device, a cyber attack or Connect being unavailable.

1. Contain it if you can (for example ask a wrong recipient to delete and confirm) and tell the Director immediately. If anyone could be at risk, tell the DSL too.

2. The Administrator logs every breach the same day, however minor.

3. The Director assesses the risk to the people affected.

4. Where the breach is likely to result in a risk to people's rights and freedoms, the Director reports it to the ICO within 72 hours of Care Cove becoming aware, in stages if needed. Decisions not to report are recorded with reasons.

5. Where the risk is high, we tell the people affected without undue delay.

6. We tell the commissioning local authority immediately where its placed learners or data are involved, through its contract manager and Data Protection Officer, and work with it on notifications. Other commissioners and schools are told as our agreements require.

7. If the breach creates a safeguarding risk, the DSL acts at once.

8. The SWMC reviews every breach at its next meeting, or sooner if serious, and checks actions are completed.

Honest mistakes reported promptly are a learning matter. Deliberate misuse of data, or hiding a breach, is a disciplinary matter.

17. Confidentiality

We keep each commissioning local authority's confidential information, including personal data, confidential, use it only for its contract and share it only with people who need it and know it is confidential. This lasts for 6 years after the contract ends. Staff, partners and volunteers sign a confidentiality undertaking that continues after they leave. Confidentiality never overrides the duty to share information to protect a child or a legal duty to disclose.

18. Retention and secure disposal

• Appendix A sets retention periods, and Connect retention rules match it.

• Each summer term the Administrator lists records due for deletion; the Director authorises; the deletion log records type, reference, date, method and authoriser, without content.

• Deletion is paused for anything relevant to an open complaint, claim, investigation, LADO or police enquiry, Ombudsman case, audit or subject access request. Records possibly relevant to an allegation of abuse are never destroyed without the Director taking advice.

• Paper is cross-cut shredded or removed by a certified confidential waste service. Devices are wiped or destroyed with a certificate. Data deleted from Connect leaves backups at the end of the backup cycle.

19. End of contract

A commissioning local authority may expect child and family information to be deleted irrevocably at the end of the contract, and its data to be delivered to it with a director certifying compliance. We will agree a written end-of-contract data plan with each commissioning local authority in advance. It will cover:

1. transferring every child protection file to the main or receiving school's DSL, or to the commissioning local authority where there is no school, with receipt confirmed, before any deletion;

2. final summaries and strategy guidance to schools;

3. which records we must keep for financial and audit purposes, reduced to minimum identifying information;

4. 18-month destination follow-ups falling after the contract ends, and therapy records;

5. the date and method of deletion, including backups, and the director's certificate.

The same principles apply to other commissioners under their own agreements.

20. Training

Everyone completes GDPR and Care Cove Connect training before any contact with learners, refreshed every year. It covers this policy, recording standards, safeguarding information sharing, recognising requests for information, reporting breaches, device rules and the AI rule. Completion is tracked on the Connect training matrix.

21. Monitoring and review

• Monthly, the Director checks that leavers' access is removed, MFA is in place and roles are correct.

• Termly, the SWMC audit samples record quality, access to safeguarding records and the breach, request and complaints logs.

• Yearly, the Director reviews the DPIA, record of processing, privacy notices, data sharing agreements, retention schedule and ICO registration.

• Breaches and Freedom of Information requests are reported to commissioning local authorities.

• This policy is reviewed yearly, or sooner after a breach, a change in law or guidance, or a contract change.

22. Related policies

• 01 Safeguarding and Child Protection
• 02 Safer Recruitment
• 03 Managing Allegations Against Staff and Low-Level Concerns
• 06 Online Safety and Acceptable Use
• 10 Mobile Phones and Digital Devices
• 14 Therapeutic Practice and Clinical Governance
• 19 Complaints
• 20 Business Continuity and Emergency Closure
• 21 Staff Code of Conduct
• 28 Site Security, Visitors and CCTV
• 30 Referrals, Admissions and Ending Placements
• 34 Privacy Notices for Learners, Families and Staff
• 35 Photography, Images and Social Media

Appendix A: Records retention schedule

"Care Cove default" marks our standard where law or our contracts set no period. For learners placed by a commissioning local authority, any child or family record kept beyond the end of the contract is kept only if the local authority agrees it in the end-of-contract data plan or the law requires it; otherwise it is transferred or deleted (section 19). At the end of each period, records are securely deleted unless a hold applies.

Appendix B: Key contacts

Document control and ratification

This policy is signed off by the Designated Safeguarding Lead and the Head of Alternative Provision, and ratified by the Social Work Management Committee. It is reviewed every year, or sooner after an incident or a change in law, statutory guidance or contract requirements, and it is available to any commissioning local authority on request.