Equilibrium Healthcare Privacy Notice for Employees, Workers, Volunteers and Contractors

Document Purpose

Equilibrium Healthcare has a legal responsibility to protect the privacy and security of your personal information. We are responsible for the way in which we hold and use your personal information. Our
commitment to protecting such information is applicable both during and after a period of
employment with us.

This document details our compliance with the General Data Protection Regulation (GDPR). There may be other occasions when we will provide privacy notifications in relation to specific circumstances so you are fully informed of how your personal data will be used.

Equilibrium Healthcare has a Data Protection Officer (DPO) who will oversee our compliance with GDPR.

Outlining the principles of General Data Protection

Equilibrium Healthcare has a duty to comply with the most recent data protection laws in place. We will regularly review our existing practices in relation to data protection to ensure we are compliant with any changes to the law.

There are several principles by which we work to ensure compliance with data protection. The principles listed below show that personal information shall be:

1. Processed in a fair lawful and transparent manner.
2. Collected for specified, explicit and legitimate purposes, and not for any purposes incompatible with those stated.
3. Relevant, adequate and not excessive in relation to the purpose for which they are being processed
4. Accurate and kept up to date
5. Kept for no longer than is necessary
6. Kept securely.

What information do we hold about you?

Equilibrium Healthcare will collect a variety of personal information about you. There may also be occasions where more sensitive information will be collected. All information will be collected, stored
and used in line with the above principles.

During the application and recruitment process we will collect information directly from applicants,
through employment agencies and from background check providers where appropriate. There may be occasions where we collect additional information from third parties such as the Disclosure and
Barring Service, former employers or other relevant parties. We may collect additional information as
and when necessary throughout your employment with us.

We will comply with legislation in any circumstance which requires us to use or collect your personal information.

Should you fail to provide the information we request, we may be unable to fulfil our contractual requirements or organisational duties.

Providing that the purpose for using your information is compatible with the purpose it was originally collected for, we may reasonably use the information for a different reason. We will always inform you if we need to use your information for an unrelated purpose and state the legal foundation which would allow the company to do so.

Personal information we hold about you may include your application form, references, contract of employment, correspondence with or about you, payroll details, records of sickness/absence/disciplinary/grievance and information for monitoring equal opportunities. These are just some examples and not an exhaustive list.

When do we need your consent to use information?

There may be occasions where we can process your information without your consent or knowledge.

Please be advised that this action will be carried out in compliance with the principles outlined above.

Instances which relate to written policy, legal obligation or areas of employment law may not require our organisation to obtain consent. In the event that we request or share information that requires
your consent, you will be provided with the necessary information to ensure you are able to make an
informed decision.

Please be advised that you are able to withdraw your consent for any processing, collection or transfer of personal data. This request will be granted unless there is a legitimate reason as defined in law. This will not affect the lawfulness of the processing before your consent was withdrawn.

Information sharing

Equilibrium Healthcare may need to share data about you with third parties. Any third party must also comply with legislation in maintaining the security of your information. We will only share your
information where we are required to do so by law, to manage our working relationship with you or
for any other legitimate reason.

Please be advised that the information we hold will be shared within the company on a need to know basis and that employees will have restricted access to certain information.

There may be occasions where we will anonymise your information so that you cannot be identified.

In these circumstances we are not required to provide you with notification of this.

Data Retention

We will only hold your information for as long as necessary. Again there are legal guidelines for this which the company will adhere to.

What if your details change?

It is your duty to inform your employer of any change to your personal information during your employment. This is to ensure we have accurate and up to date information and to ensure you meet the requirements of your contractual agreement.

What are your rights?

The law allows you specific rights, although these rights may be limited or restricted in certain circumstances. Outlined below is a summary of your rights:

1. Data subject access request – you are able to request a copy of any personal information we
   hold about you and to check this is being processed in line with legislation.
2. Correction – you are able to have any incomplete or inaccurate personal information we hold
   about you corrected.
3. Erasure – you are able to request that we delete or remove personal information where there
   is no justifiable reason for us to retain it.
4. Objection to processing of personal information – you have the right to object to the
   processing of certain aspects of your personal information where your circumstances may
   warrant this objection. This may also relate to your right to request the removal or deletion
   of information as stated above.
5. Restriction of processing – you have the right to request that the processing of your personal information is suspended. An example of this may be if wish to obtain more information of how or why we wish to process the information.
6. Transfer of information – you have the right to request the transfer of your personal
   information to another party.

Is there a fee?

There would not usually be a fee associated with your request to exercise your above rights.

However, there may be certain circumstances where a charge may be necessary such as if your request is unfounded or excessive. Please note that we have the right to refuse a request in these situations.

Requests, complaints and queries

If you would like to exercise your rights in relation to any of the above points, if you wish to make a complaint or have any questions you should contact EHC’s Data Protection Officer.

We reserve the right to amend and update this privacy notice at any time and will provide you with the amended version should the changes be substantial. You can also access this privacy notice on our intranet.