Privacy notices

This privacy notice explains how the Adult Social Care and Children’s Social Care Services will use your personal information, and how we protect your privacy in compliance with our requirements under the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR). By personal information, we mean information which, by itself or with other data available to Croydon Council, can be used to identify you. 

• Adult Social Care process your personal information to provide care and support services for vulnerable adults, the elderly, those with physical disabilities and carers, either directly or jointly with our partners. 
   
• Children’s Social Care hold personal data to provide a range of services to children and their families within our area to safeguard and promote their welfare. We are committed to protecting your privacy when you use our services.

This notice applies to any activity involving our use of your personal data, for example, collecting, storing, sharing and destroying it.

For more general information about how the Council uses your information and your data rights, please refer to the Corporate Privacy Notice.

Magic Notes and how it is used

Magic Notes is a web app being used by Adult Social Care and Children’s Social Care to record conversations with you when you access their services.

Your information will be processed by the use of Magic Notes.  It is used by Adult Social Care or Children’s Social Care staff to record conversations with your consent.  Artificial Intelligence (AI) is used to create transcripts and summaries from the recordings. These are then reviewed by Adult Social Care or Children’s Social Care staff and then loaded into a case management system.

This then creates a comprehensive record of work carried out by Croydon Adult Care and Children’s Social Care to promote your health and wellbeing, designing services together that both suit you and meet your needs.

AI is not used to make decisions about you nor the services you may be offered. It is only used to record the conversations you have with Adult Social Care or Children’s Social Care staff, to provide a more efficient and accurate method of recording your needs.

Consent

When using Magic Notes, we require your consent in order to record the conversation and process your personal data. Whilst we have a statutory basis for collecting your information, the use of Magic Notes to record this is optional and you retain the right to refuse the recording of conversations. You will be told at the outset of a call if it is being recorded using Magic Notes.  If anyone in the meeting objects to the use of Magic Notes at the start of a meeting then the tool will not be used. If you refuse to provide consent, you will have your data recorded manually for processing within our case management systems.

However, if a recording is in progress when an objection is made, the recording will stop at that point. The recording made up to that point will be used otherwise the meeting will have been ineffective.

If you do not provide your data, it will limit the effectiveness of the services and support that we are able to offer you.

Lawful basis of processing

We consider that the lawful basis for processing the data described within this notice to be the requirement for consent to record conversations prior to Magic Notes use. For the use of Magic Notes as a method of processing the client data, Article 6(1)(a) Consent will apply for any personal data, and Article 9(2)(a) Explicit Consent will apply for any special category data that is processed via Magic Notes. This differs from business-as-usual processing, where the lawful basis is Article 6(1)(e) – Public Task and Article 9(2)(h) – Health or Social Care Purposes.
 

The lawful basis for processing special category data within business-as-usual public task is defined within UK GDPR:

Personal Data, Article 6(1)(e) Public Task; or Special Category Data, Article 9(2)(h) Health or Social Care (with a basis in law) under Schedule 1 Part 1 of the Data Protection Act 2018 "Health or social care purposes, (2) In this paragraph “health or social care purposes” means the purposes of:

(d) the provision of health care or treatment,
(e) the provision of social care, or
(f) the management of health care systems or services or social care systems or services.”

This is required to enable the council to fulfil its statutory duties under the Care Act 2014 and the Children Act 1989.

Croydon Council act as the ‘Data Controller’ ensuring that your data is processed in compliance with the Data Protection Act 2018 and the UK General Data Protection Regulation. 

What information we collect

Adult Social Care or Children’s Social Care may collect some, or all, of the following information about you, when using the Magic Notes tool:

• Personal information, for example, your name, address, telephone number, date of birth
• Contact details for members of your family and support network
• Information about your finances, for example, bank details, income, benefits.

The following types of special category data may also be collected:

• Information about your racial or ethnic origin, religious or philosophical belief and your sexual orientation
• Information about health conditions or disabilities that may apply to you.

Why we collect your information

Croydon Adult Care and Children’s Social Care collect and use your personal information to create a secure and comprehensive record of all the work that we do with and for you. We will work with you to promote your health and wellbeing, designing services together that both suit you and meet your needs.

The information you provide may be shared with some of the third parties that we work with to provide services; to provide joined-up, personalised care and ensure you are receiving the best possible care and support.

How we will you store and transfer your information using Magic Notes

Your information will be processed in Magic Notes by recording, transcribing, and summarising meetings. Magic Notes processes data by the following steps:

1. The Magic Notes user (the trained staff member, such as a social worker) requests for consent to utilise Magic Notes.
2. The user (the trained staff member, such as a social worker) starts the recording
3. The meeting is recorded and the audio file is saved
4. User ends the recording
5. Magic Notes creates a transcription of the audio file
6. Azure’s OpenAI model creates a summary of the transcript
7. The user is sent a notification telling them that their meeting summary is ready, and can be viewed in the secure webapp
8.  The user copies the summary into the case management system and makes 
   any edits required.

The AI is used to create transcripts and summaries from the recordings. Summaries are produced in-line with case note templates. 
We use your personal information to create a secure and comprehensive record of all of the work that we do with and for you. 
Any data shared outside the Council will be transferred in a secure, electronic format. 

Records made using Magic Notes will be retained for period of 30 days, after which they will be securely deleted. Adult Social Care and Children’s Social Care are required to ensure that transcripts created by Magic Notes must be transferred onto 
the internal Council case management systems within 14 days of transcript creation.

Personal data will not be retained for longer than necessary in relation to the purposes for which they were collected. Following which it is reviewed and if it is no longer required, it is then securely disposed of. 

We do not send any information we collect about you outside the United Kingdom

Who we share information with

The information you provide which will be used by Magic Notes will be recorded in our internal case management systems, as a component of the personal records we hold for you.

The case records may be shared with third parties for the purposes of providing assistance with your personalised care plans.  It will also be shared with other Croydon Council Services, where this is considered to be necessary to ensure you are provided with the support you need.

The information that you provide may also be shared with, but not limited to:

• advocates, deputies, legal power of attorney
• Care Quality Commission (CQC)
• external providers
• Department for Work and Pensions (DWP)
• family members and carers
• internal teams, such as case management and finance
• NHS providers, such as GPs and hospitals
• care home and domiciliary care providers
• reablement
• partner agencies, such as volunteer organisations and statutory organisations
• housing associations
• Croydon Safeguarding Children Partnership
• law enforcement or other authorities if required by applicable law

Your information may also be used for the following purposes:

• to assist in the development of policy proposals
• for the prevention or detection of crime or fraud
• to follow up on safeguarding concerns
• for research and statistical purposes, where data will be anonymised

How the law allows us to use your information

We processes your data under different legal bases depending on the method of recording. The use of Magic Notes requires your consent, whereas business-as-usual (BaU) processing, such as manual recording and case management, is carried out under our statutory duties related to health and social care.

When we collect your personal data as a public task to work with you, we rely on the following legal bases:

• UK GDPR Article 6(1)(e) - processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

When we collect your ‘special categories of personal data’ (such as health, race, ethnicity, sexual orientation), we rely on the following legal bases:

• UK GDPR Article 9(2)(g) - substantial public interest conditions.
• Part 2 of Schedule 1 of the DPA 2018, paragraphs:
  • 6 - Statutory and government purposes
  • 16 - Support for individuals with a particular disability or medical condition
  • 18 - Safeguarding of children and individuals at risk

These legal bases are underpinned by acts of legislation that dictate what actions can and should be taken by local authorities, including, but not limited to:

• The Care Act 2014
• Health and Social Care Act 2015
• Children’s Act 1989
• Localism Act 2011
• Data Protection Act 2018
• Human Rights Act 1998
• Mental Health Act 1983 (Amended 2007)
• Mental Capacity Act 2005
• Homelessness Reduction Act 2017

Requesting access to your personal data

Under the UK GDPR and the Data Protection Act 2018, you have the right to request access to information that we hold about you. To make a request for your personal information, please contact our Information Management Team at SAR@croydon.gov.uk.

Further information

The Data Protection Act 2018 and the UK GDPR give you a number of rights to control what personal information is used. Information about your individual data rights is listed in our Corporate Privacy Notice.

If you have any questions or concerns about the way we collect, store or use your personal information, please contact the Data Protection Officer at dpo@croydon.gov.uk.

For independent advice about data protection issues, you can contact the Information Commissioner’s Office at www.ico.org.uk or by writing to: 

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113

We reserve the right to amend this privacy notice at any time and will keep it under review. If we do make any changes, we will post the current version to this web page.