Privacy Policy

For residents and their families and representatives

Elder Homes Limited is a family run business which owns and operates two care residential homes, Cluny Lodge and Chamberlain House, in the Morningside/Bruntsfield area of Edinburgh.

Where we use the term “residents” or “you” in this Privacy Notice, we refer to residents in our care homes.

Elder Homes Limited operates under the “Elder Homes” brand.

In the rest of this Privacy Notice we shall refer to Elder Homes Limited as “Elder Homes” or “we”.

We are the sole controller of the personal information of residents at Cluny Lodge and Chamberlain House care homes.

We recognise the privacy and security of personal information is of great importance to residents, their families and friends, our workers and others such as GPs and all those involved in looking after the welfare of our residents.

We have provided this Privacy Notice to set out why we need to collect personal information relating to residents, families, friends and representatives, how we use it and how we protect it. As appropriate, references to ‘you’ include your next of kin, other family, your visitors and your representatives, such as attorneys you have appointed under a registered Power of Attorney.

“Personal information” (or personal data) is any information relating to an identified or identifiable natural person (i.e. an individual). For example this includes a name, an identification number, location data, an online identifier or any other identifier of that person’s physical, physiological, genetic, mental, economic, cultural or social identity.

We have appointed a Data Protection Officer who is responsible for overseeing questions relating to this Privacy Notice. If you have any questions, please refer to the “How to Contact Us” section below. We confirm that we are registered with the Information Commissioner’s Office. Elder Homes has ICO registration number Z7526425.

Our privacy policy is governed by the overarching principles of collecting and using personal information when it helps us provide a better service and care to residents and to meet legitimate interests including to protect residents and workers, lawfully, fairly and transparently and to comply without contractual and legal obligations.

Changes to our privacy policy

We regularly review our privacy notices and will place any updates on this webpage.
This policy was last updated in August 2026.

Since January 2021 your and our data protection rights and obligations are set out in what is known as the United Kingdom General Data Protection Regulation (UK GDPR), which in all material respects replicates EU data protection laws.

The personal information we refer to in this Privacy Notice includes information that can be used to identify you.

Set out below is the personal information we collect and the reasons why we need it.

How do we collect information from you?

We collect information about you when you enquire about our care homes and services, use our website, and become a resident in one of our care homes. We also collect information when you voluntarily complete customer surveys or provide feedback about our services. As mentioned above this can include information about family, visitors and representatives.

What types of information do we collect from you?

Personal data or personal information can be any information about an individual from which that person can be identified. We may collect, use, store and transfer different types of personal data about you which we have grouped together as follows:

1. When you enquire about our care homes and services

Personal information including your name, address, telephone numbers and email address.

2. When you use the Elder Homes website or interact with our digital communications

Any personal details you knowingly provide us with through calls, forms or email, such as your name, address, telephone numbers and email address. We use the information that you provide so we can respond to your requests and communicate with you.
Your preferences and use of email, recorded by emails we send you.
Other information relating to your enquiry.
Your IP Address: this is a string of numbers unique to your computer that is recorded by our web server when you request any page or component on the website. This information is used to measure your usage of the website.

3. Where you are resident in one of our residential care homes

Personal details including your photograph, title, full name, maiden name, marital status, date of birth, gender, contact details including address (billing address or correspondence address), telephone numbers, email addresses (including contact details for your next of kin and representative), your GP, NHS number, and other allied health professionals.
Financial information including bank account information to enable payment for our services.
Transaction data including details of payments from you for the services we have provided.
Information about your life, including social history, family members and next of kin, health and wellbeing, treatment and care. This may also include information about your marital status, ethnicity, religion, and sexual orientation and details of medical treatments.
Notes and reports about your health and care provision including case assessments and medication provided.
Compliments, complaints, accidents and incidents information.
Contributions to resident questionnaires and surveys.
Images of you on our CCTV systems.

4. Where you are the relative, next of kin, attorney or deputy to one of our residents

Personal details including title, full name, relationship to the resident, contact details including address, telephone numbers, email addresses.

5. When you visit one of our care homes

Name of the visitor, purpose of their visit and car registration details if car parking was used.
Information relating to the prevention and detection of crime and the safety of residents and workers including CCTV recording.

6. What information do we get from or supply other sources?

We work closely with the NHS, other health authorities, medical professionals, local authorities (who may have responsibilities for your care needs) and regulators to deliver our care services. We will receive information from them regarding your health and care including admission details, care records and medical records.
We also work with other companies who provide professional services (including IT service providers), advertising and marketing services.

7. How do we use the information about you?

We process your personal data to manage the services we provide you, to carry out our obligations arising from any contracts entered into between us and you, to provide you with information or services you have requested and to process payments and refunds.
Your care record will contain detailed information about your health and well-being including illnesses, medical appointments and treatments. This information is critical to ensure that on your admission your needs are assessed and set out in your care record, and so that we can adjust your care plan as and when your needs change. We will share these with medical and allied health professionals who have a legal and legitimate need to use the information to support the care provided to you.
We also collect details of your attorney, deputies, family and your visitors, as aside all else we need to ensure we best safequard the welfare and security of you, other residents, their families and visitors and our staff.
We share information within Elder Homes to provide necessary administrative and managerial support and to suppliers who help deliver products or services on our behalf.
To the extent that you (or a representative on your behalf) have requested access and use of their services and only to the extent necessary for the purpose of delivery of their services, we share personal information with third party service providers such as hairdressers, opticians, chiropodists and others who attend our sites.
We use either personal or anonymised data to review the performance of our care services as part of our continuing work to improve our services and meet the needs of our residents.
We may use details obtained to contact you (and your representative and family) about any changes to your needs and our care services.
We may use your personal data to send you, your representatives and family marketing information describing services that may be of interest where we have prior consent to do so. You and they may opt out of receiving this information at any time.
We share information with the NHS, other health and local authorities, medical professionals and regulators regarding your health and care including admission details, care records and medical records.
We use cookies on our website to collect information to enable us to better present and improve our services. A cookie is a small file which asks permission to be placed on your computer's hard drive. Once you agree, the file is added and the cookie helps analyse web traffic or lets you know when you visit a particular site. Cookies allow web applications to respond to you as an individual. The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences.
We use traffic log cookies to identify which pages are being used. This helps us analyse data about web page traffic and improve our website in order to tailor it to customer needs. We only use this information for statistical analysis purposes and then the data is removed from the system.
Overall, cookies help us provide you with a better website, by enabling us to monitor which pages you find useful and which you do not. A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us.
You can choose to accept or decline cookies. This may prevent you from taking full advantage of our website.

Circumstances which override data protection obligations we might otherwise apply and which compel us to provide specific information include:

Reporting health or safety issues including infectious diseases;
Where there is a legal or statutory requirement, court order or public authority instructs us to do so;
Supporting police investigations, professional conduct hearings and safeguarding investigations in the public interest; where a serious crime or fraud has been committed; if there is a serious risk to the public, resident or employees;
Where there is a need to protect children or vulnerable adults who are not able to decide if their personal data should be shared.

In exceptional circumstances, we may be required to share information without your or your representative’s consent. Circumstances may include:

Where a serious crime or fraud has been committed.
If there is a serious risk to the public, resident or employees.
Where there is a need to protect children or vulnerable adults who are not able to decide if their personal data should be shared.

Standard personal information and Special Category information

Much of the above information is called standard personal information, such as names, addresses, contact details (for you, family, friends and your GP), identification paperwork, financial details and information, and how you use our website and other IT technologies.

There is also what is called special category information, which tends to be more sensitive and results in additional protection being afforded to it.

Special category information comprises information relating to your race, ethnic origin, political opinions, sex life or sexual orientation, religious or philosophical beliefs, trade union membership, biometric data where used for identification purposes, and health.

Healthcare information covers both physical and mental aspects and includes genetic and biometric information, medical history and records including of disabilities or special requirements, our care plans, risk assessments and records of the care and support we provide for you.

Lawful basis for processing

At Elder Homes, we care for vulnerable elderly adults in our care homes. This is a heavily regulated activity that requires collection, processing and storage of a considerable large amount of data about the residents, visitors, contractors and in general any person we come into contact that is relevant to the regulated activity we perform.

Article 6 of the UK GDPR sets out the bases for our processing standard personal information, and article 9 likewise for special category information. Different stages and aspects of our relationship with you gives different bases. For example, when assessing whether we can meet your needs if you are admitted into one of our care homes and how we should communicate with you, there will be bases of considering your healthcare requirements, to meet legal and regulatory requirements, and to enable to us contract with you. To quote the UK GDPR, "processing is necessary":

"For the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;”
"For compliance with a legal obligation to which the controller is subject;"
"For the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;”
“For the purposes of preventive or occupational medicine… medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of domestic law …” For example we are subject to The Regulation of Care (Scotland) Act 2001 as well as other statutes and regulations.

Other bases include the necessity to protect your vital interests and our legitimate interests, including in safeguarding vulnerable adults, dealing with emergencies and crime, national and public security and defence, and sharing information with public authorities in their public tasks, and in managing our relationship with you, and your having provided us with your unambiguous consent, but all bases are prescribed by and confined to the specific purposes for the lawful processing of the particular information.

When we process special category of data under article 9 of the UK GDPR, we will do so with your express consent. In addition there are a limited number of statutory exceptions which will allow us to process your special category of data without your express consent, for example where the processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of employees, defending legal claims and court proceedings brought against us, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of domestic law or pursuant to a contract with a health professional.

How we store, process and protect your data

We take the privacy and security of your personal data very seriously. We ensure we handle your data with the highest level of care by having clear internal policies and procedures, physical security to our premises and IT security technologies to prevent the unauthorised access, damage and loss of your data.
We use third-party providers to assist with the delivery of our care services and the management of our business. These include CareVision (care management and care records), Microsoft 365 (communications and document management), Xero (finance and accounting) and Access HR (human resources and payroll administration). We may share personal information with these providers where this is necessary for the provision of their services. We take reasonable steps to ensure appropriate technical, organisational and contractual measures are in place to protect your personal information. Information may be processed by these providers on our behalf and, in some cases, outside the United Kingdom, in which case appropriate safeguards will be applied where required by law.

How long will we hold your personal data

We will only keep your information for as long as necessary to fulfil the purposes we collected it for, including satisfying any legal, contractual or reporting requirements. How long we keep the data for is determined by law and is largely determined by necessity and prescribed statutory retention periods. Generally most health and care records are kept for eight years after your last treatment, but currently records kept by GPs are kept for much longer, as are some ascribed as having valuable research qualities, but be assured that for our part once your information is no longer required we will look to see that it is securely destroyed.

Your right to have your data deleted

This is known as the ‘right to erasure’ or the ‘right to be forgotten’.
You can ask us to delete your data where retaining it is no longer necessary.
Whilst at all times compliant with legislation and acting reasonably, we reserve the right to judge what information we must continue to hold to be able to fulfil our legal and contractual obligations to you and others.
We may anonymise your personal data (so that you can no longer be identified) for research and analysis purposes in which case we may use this information indefinitely without further notice to you.
Where we process data based solely on your consent, it will only be processed for the purposes prescribed in your consent, and you have the right to withdraw that consent at any time.

Marketing

We would like to send you (including your representatives and family) information about the services we provide which may be of interest.
You and they have a right at any time to request that we stop contacting you and them for marketing purposes.
If you have recently contacted us regarding our services or are an existing customer or resident, we may contact you to ask for your consent to continue sending you marketing information. If you no longer wish to be contacted for marketing purposes, please contact us at or 0131 447 3411.

Access to your information and correction

You have the right to request a copy of the information that we hold about you. If you would like a copy of some or all of your personal information, please email or write to us at the address set out in the “How to Contact Us” section below.
We try to respond to all legitimate requests within one month. It may take us longer if your request is particularly complex or you have made a number of requests, in which case, we will notify you and keep you updated.
You will not have to pay a fee to access your personal data and you are entitled to receive a copy of your personal data within one calendar month of receipt of your request and once we have verified your identity.
It may take us longer if your request is particularly complex or you have made a number of requests. In which case, we will notify you and keep you updated.
You have the right to receive the personal data you provided to us in a structured, commonly used and machine-readable format or to request from us to transmit this data directly to another controller. This portability right only applies when our lawful basis for processing your information is consent, or for the performance of a contract and we are carrying out the processing by automated means (i.e. excluding paper files). We want to make sure that your personal information is accurate and up to date. You may ask us to correct or remove information you think is inaccurate.
We may ask for proof of identity before we share your personal data with you or your representative.

Request restriction of processing

You have the right to request us to suspend the processing of your personal data where:

You want us to establish the data’s accuracy,
Where you consider our use might be unlawful but you do not want us to erase it,
You need us to hold the data even if we no longer require it as you need it returned to establish and exercise any legal claims or;
You have objected to our use of your data but you need to verify whether we can lawfully use it. We are entitled to retain sufficient records and information to meet our legitimate business interests and statutory and regulatory requirements.

If possible we will inform any third parties to whom your data has been disclosed of your requirement.

Other websites

Our website contains links to other websites, including the Care Inspectorate. This privacy policy only applies to our Elder Homes website so when you link to other sites, please read their own Privacy Notices.

Changes to our privacy policy

We regularly review our privacy policy and will place any updates on this webpage.
This policy was last updated in September 2026.

How to contact us or make a complaint

If you have any questions or concerns about this privacy notice or how we handle your personal information, or if you wish to exercise any of the rights it refers to, contact our Data Protection Officer who has been appointed to oversee compliance with this privacy notice and whose contact details are below.

You also have the right to complain to us if you consider that there has been an infringement of your rights in relation to your personal data.

Making a complaint

You can submit a complaint using the following channels:

Email to: The Data Protection Officer c/o:

Post to: Elder Homes Limited
Attn: Data Protection Officer
Cluny Lodge,
10-16 Cluny Drive,
Edinburgh
EH10 6DP

What happens next

When we receive a data protection complaint, we will:

Acknowledge receipt no later than 30 days from receiving it.
Take appropriate steps to respond without undue delay, which may include making enquiries into the subject matter of the complaint and, where appropriate, keeping you informed about the progress of our handling of the complaint.
Inform you of the outcome without undue delay.

Complaining to the ICO

You also have the right to make a complaint at any time to the Information Commissioner’s Office (ICO). The ICO’s contact details are:

Address: Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

Helpline number: 0303 123 1113

ICO website:

We would, however, like to have the opportunity to deal with your concerns before you approach the ICO so please contact us in the first instance.