Privacy Policy

PRIVACY POLICY

Updated: 03/11/2026, 10:20

1. INTRODUCTION

This Privacy Statement explains how Bartra Property (NH Group) Limited and its operating subsidiaries:

Bartra Opco (Beaumont NH) Limited as operator of Beaumont Lodge Transitional Care Unit, Kilmore Rod, Artane, Dublin 5;

Bartra Opco (Northwood NH) Limited as operator of Northwood Residential Home, Old Ballymun Road, Northwood, Dublin 9;

Bartra Opco (Clondalkin NH) Limited as operator of Clondalkin Lodge Residential Home, New, New Road, Clondalkin Village, Dublin 22;

Bartra Opco No. 1 Limited as operator of Loughshinny Residential Home, Blackland, Ballykea, Skerries, County Dublin

Bartra OpCo Limerick Limited as operator of Raheen Lodge Baunacloka, Mungret Limerick,

(together, the “Group”, “we”, “us” or “our”) collect, use, disclose and otherwise process personal data in connection with the Bartra Healthcare website and related enquiries and interactions.

We are committed to protecting all personal data collected during the resident/patient stays at Group facilities.

This Privacy Notice sets out the types of data we collect and how we capture, use and protect all personal data collected and stored during the course of resident/patient stays. We also want you to be clear as to what rights you can invoke with respect to your information.

To this end, it is important that you read this Privacy Notice and understand our use of your personal data.

Please note, we reserve the right to update this Privacy Notice as required. We may update this Privacy Policy from time to time to reflect changes in our services, systems, legal requirements or data protection practices. Where changes are substantive, we will take appropriate steps to bring them to users’ attention and will publish the updated policy on our website. This is the most recent version of this document.

2. WHO IS RESPONSIBLE FOR YOUR PERSONAL DATA

Depending on the circumstances, one or more Group companies may act as a data controller in respect of your personal data. The Group company with which you interact, or which determines the purposes and means of the relevant processing, will normally be the controller for that processing.

3. COMMITMENT TO PRIVACY

We respect the privacy and data protection rights of individuals. We process personal data fairly, lawfully and transparently and take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, disclosure or destruction.

4. DATA PROTECTION LEGISLATION

All “personal data” we gather will be “processed” in accordance with all applicable data protection laws and principles, including the European Union General Data Protection Regulation (Regulation (EU) 2016/679), the Irish Data Protection Acts and related applicable legislation.

5. WHAT IS PERSONAL DATA

Personal data is any information relating to an identified or identifiable natural person (a “data subject”). A data subject is a natural person who can be identified, directly or indirectly, from personal data such as an online identifier or by reference to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Personal data may include special category data (including health information) where such processing is necessary and permitted by law.

6. WHAT IS A DATA CONTROLLER

A “data controller” means a person who, either alone or with others, controls the contents and use of personal data.

As outlined in paragraph 2 above the Group company with which you interact, or which determines the purposes and means of the relevant processing, will generally act as the data controller for personal data processed in connection with its services.

7. HOW WE COLLECT PERSONAL DATA

We collect personal data in order to improve the quality of the services we provide in our facilities.

This data may be collected directly:

from individuals or their representatives or authorised persons;

from healthcare professionals (such as GPs and medical consultants) who are involved in your treatment;

by our staff; or

through our website and online forms.

For website users, information may be collected through contact forms, technical information about the device or browser used, IP address, pages visited, referring website information, date and time of access and information voluntarily submitted through forms.

Sometimes we may request that other healthcare providers, such as your GP (or previous GP), dentist, social worker, pharmacist or other healthcare provider, provide us with data relating to you in order to improve the quality of our service to you.

In cases of emergency, we may receive your data from emergency services, such as the Gardaí, the ambulance services or the fire brigade services. Once again, we receive this data purely for the purpose of ensuring the care we provide to you is of the highest standard.

8. SHARING PERSONAL DATA WITHIN THE GROUP

Personal data collected by one Group company may be shared with, accessed by and processed by another Group company where this is necessary and lawful for the purposes described in this Statement.

In particular, Group companies may share personal data for:

responding to an enquiry and directing it to the appropriate Group company;

providing or administering products, services and business relationships;

centralised management, finance, legal, IT, compliance, risk, governance and other shared corporate services;

maintaining common business systems, records and security arrangements;

preventing fraud, managing disputes and protecting the Group’s legal rights; and/or

complying with legal and regulatory obligations.

Intra-group sharing does not mean that every Group company will automatically receive all personal data. Access will be limited to the personal data reasonably required for the relevant purpose and to authorised personnel who need it.

Each Group company receiving personal data must process it in accordance with applicable data protection law. Depending on the particular processing activity, Group companies may act as separate controllers, joint controllers or, in limited circumstances, processors for another Group company. Where required, the Group will put appropriate arrangements in place governing those roles and responsibilities.

9. WHAT TYPE OF INFORMATION IS COLLECTED

As a healthcare provider we need to collect many categories of personal data about our residents/patients, the majority of which is highly sensitive in nature.

While the type of personal data we process may change occasionally, we believe it is important that you are aware of the types of personal data we gather and use. The following table is a non-exhaustive list of the categories and types of personal data we use to perform our duties.

Please note that the information listed under one category may be used for the performance of a task, or in relation to activities listed under another heading, or as outlined in Section 8 below.

Reason	Type of Data Collected
Create reports/reviews for clinical governance	Medical data, medical record number, date of birth, name, address
Collect KPI’s for resident/patient safety	Medical data, medical record number, date of birth, name, address
Create individual resident/patient safety incident reports	Medical data, medical record number, name
Security	CCTV footage
Admissions	Contact details, date of birth, next of kin details, medical history, reason for admission, family medical history, GP details, health insurance/payment details, nationality and religious beliefs can be volunteered by patient
Referrals	Contact details, date of birth, treatment for which patient is being referred, MRN, GP details/details of referring party, family medical history
During medical diagnosis/treatment	Medical data relating to current and past treatment
Quality Improvement	Resident/patient feedback, enquiries received, log of calls received, log of complaints received, clinical incident forms submitted
Facility Security	CCTV footage, visitor sign-in logs

10. WHAT DO WE USE INFORMATION FOR?

We use your personal data so that we can improve the quality of the healthcare service we provide to ensure that the treatment provided to you is safe and effective, that the right decisions are made about your care, and so that we can coordinate with other organisations that may be involved in your care

We use your personal data to manage our business operations.

Specifically, we may use the personal data we gather for any or all of the following purposes:

(a) to process enquiries, assessments, and admissions;

(b) to deliver personalised care, treatment, and support;

(d) to record, manage and communicate information relating to care, treatment and service delivery using secure digital systems;

(e) to communicate with residents/patients and, where appropriate, with family members, representatives or next of kin;

(f) to support clinical decision making;

(g) to manage medications, referrals, appointments, and ongoing care;

(h) to generate accurate billing, account records, invoices, and related financial administration;

(i) to manage Fair Deal, pension agency, and other funding-related administration where applicable;

(j) to respond to complaints, incidents, safeguarding concerns, and service issues;

(k) for auditing, quality assurance, compliance, governance, and service improvement;

(l) to comply with legal and regulatory obligations;

(m) to protect the safety and security of residents/patients, visitors, staff, and property, including through CCTV where in use;

(n) to verify who is authorised to make decisions, receive information, give instructions or act on behalf of a residents/patients in relation to care, treatment, residence, financial matters or other relevant arrangements; and/or.

(o) to share information about community life, events and organisational activities through communications and digital channels, including social media, where appropriate.

11.LAWFUL BASIS FOR PROCESSING

We will only process personal data where we have a lawful basis under the General Data Protection Regulation.

Depending on the circumstances, this may include consent, performance of a contract, compliance with a legal obligation, protection of vital interests, performance of a task carried out in the public interest or in the exercise of official authority or legitimate interests where the applicable legal requirements are satisfied.

Special categories of data are defined in the General Data Protection Regulation as including information on racial or ethnic origin, religious or philosophical beliefs, genetic data, biometric data and health data. The processing of special categories of data is permitted in the circumstances set out in Article 9 of the General Data Protection Regulation.

We will only process special categories of personal data where it is necessary:

for the purposes of preventative or occupational medicine;

for medical diagnosis;

for the provision of healthcare, treatment or social care;

for the management of health or social care systems and services or contract with a health professional pursuant to a contract with the health professional.

Consent is not the only lawful basis on which personal data may be processed or shared. Where we rely on a lawful basis other than consent, we will assess and document the basis relied upon where required.

12. WHO DO WE SHARE INFORMATION WITH?

In addition to the sharing of personal data between Group companies in the circumstances set out on paragraph 8 above, there are various circumstances in which we may share personal data with other parties where this is necessary and lawful.

We may occasionally disclose your information to the following categories of companies/persons:

(a) any medical consultants, GPs and other healthcare professionals involved in your treatment;

(b) any party which you have given us permission to speak with (family, friends or otherwise);

(d) legal representatives (as necessary);

(e) healthcare specialists whose opinion may aid us in effective medical diagnosis and / or treatment;

(f) healthcare providers engaged to assist with your treatment;

(g) your health insurer (or their representative) or any other third-party provider with whom you have an agreement to cover the cost of your treatment;

(h) billing agencies engaged by your consultant or other healthcare professionals involved in your treatment;

(i) statutory bodies and health boards as required by EU and Irish law;

(j) clinical audit to measure compliance with policies and accreditation standards; and/or

(k) any business partners, suppliers and sub-contractors who operate as a processor on our behalf for the performance of any contract we enter into with them or you – such as our IT system providers, our payment service providers, our recruitment service providers.

Where information is requested or proposed to be shared with a family member, representative or other third party, we will consider the circumstances carefully, including who will receive the information, who may be affected, the risks and benefits of sharing or not sharing, the nature of the information and the applicable lawful basis relating to the sharing of that information.

A person’s loss of capacity does not, in itself, remove their data protection rights. Where an adult is unable to exercise their rights personally, we will consider the circumstances, any applicable lawful authority or representation arrangements and relevant data protection guidance when determining how a request should be handled.

We will not require consent as the sole route to lawful disclosure where another lawful basis applies. Equally, we will not disclose personal data simply because a third-party requests it; the request and proposed disclosure must be assessed against applicable law and relevant data protection guidance.

We take steps to ensure that any third-party partners who handle your information comply with data protection legislation and protect your information to the same extent that we do. We only disclose personal information which is necessary for them to provide the service they are undertaking on our behalf. We will aim to anonymise your information or use aggregated non-specific data sets where possible.

It may be necessary to transfer your personal information to other group companies or service providers located in countries outside of the European Economic Area (EEA). In such circumstances. we will ensure that the data is transferred in a secure manner, in accordance with data protection legislation and with your consent.

If you would like more information about the relevant safeguards in place for the transfer of personal data to countries or companies outside the European Economic Area, please contact us using the details outlined in Section 17 below.

13. TRANSFERRING TO ANOTHER PROVIDER

If you decide at any time and for whatever reason to transfer to another provider, we will facilitate that decision by making available to your new provider a copy of your records on receipt of your signed consent from your new provider. For medico-legal reasons we will also retain a copy of your records for an appropriate period of time which may exceed eight years.

More information on our retention of your information is set out in Section 12 below.

14. DATA MINIMISATION, ACCURACY AND RETENTION

We seek to ensure that personal data is adequate, relevant and limited to what is necessary for the purpose for which it is processed. We take reasonable steps to keep personal data accurate and up to date.

We only keep your information for as long as is necessary for the purpose for which it was originally obtained. As a result, the retention periods will differ depending on the purpose of the processing and the types of data involved. Please note that the medical data we use when it has reached the end of its legal retention period and is no longer required will be disposed of securely in accordance with our Data Retention Policy and HSE guidelines. In some cases, retention periods for medical information will be defined based on the individual circumstance of each patient. We will take all necessary steps to ensure that the privacy of information is maintained upon disposal.

Further details on our Data Retention Policy are available on request.

15. SECURITY

We use appropriate technical and organisational measures to protect personal data. These may include access controls, secure systems, staff training and awareness, confidentiality obligations, physical security, information security controls, monitoring and review of relevant safeguards.

Access to personal data is restricted according to role and business need. Staff are required to respect confidentiality and data protection obligations and misuse of confidential information may result in disciplinary action.

16. AI USE

This website uses a Google reCAPTCHA program which is to protect the forms displayed on the website from spam. This program does not build profiles of users of the website and it is not used by the program developer Google to train AI models.

17. YOUR DATA PROTECTION RIGHTS

You have a number of rights when it comes to your personal data. On receipt of a valid request to invoke one of your rights, we will do our best to adhere to your request as promptly as reasonably possible, however, restrictions may apply in certain situations.

These rights are subject to the requirements, limitations and exemptions contained in applicable data protection law and therefore may not apply in every circumstance.

Right of Access

You have a right to know what personal data we hold on you, why we hold the data, and how we are using the data.

When submitting your request, please provide us with information to help us verify your identity and as much detail as possible to help us identify the information you wish to access (i.e. date range, subject of the request).

Identity verification will require a copy of your photographic ID, as well as the provision of three unique identifying factors from your medical record.

If the request is submitted by a third party (such as a solicitor) on your behalf, the request will be required to include written authorisation from you for the provision of specific data to the third party.

Right of Rectification

You have a right to request that the personal data held in relation to you is up to date and accurate.

Where information is inaccurate or incomplete, we encourage you to contact us to have this information rectified. Upon receipt of your request, we will ensure that the personal data is rectified and as up to date as is reasonably possible.

Right of Erasure

You have the right to seek the erasure of personal data relating to you in the following circumstances:

the personal data is no longer required for the purposes for which it was obtained;

where the use of the data is only lawful based on consent, you withdraw consent to the processing and no other lawful basis exists;

the personal data is being used unlawfully;

you object to the use of your personal data and there are no overriding legitimate grounds for the use of the data; and

your personal data requires deletion in line with legal requirements.

However, we will be unable to fulfil an erasure request if the personal data is required for the treatment of an active resident/patient. We will also not be able to delete data which is being held in the public interest, such as for protecting against cross-border threats or ensuring high standards of quality and safety of healthcare.

Right to Restriction of Processing

You have the right to restrict the extent for which your personal data is being used by us in circumstances where:

you believe the personal data is not accurate (restriction period will exist until we update your information);

the processing of the personal data is unlawful but you wish to restrict the use of the data rather than erase it.

where the personal data is no longer required by us, but you require the retention of the data for the establishment, exercise, or defence of a legal claim; or

you have a pending objection to the future use of your personal data.

When the use of your data has been restricted, your personal data will only be further used:

with your consent;

for the establishment, exercise or defence of legal claims;

for the protection of the rights of other people; or

for reasons important to public interest, such as for the protecting against cross-border threats or ensuring high standards of quality and safety of health care.

We will contact you to confirm where the request for restriction is fulfilled and will only lift the restriction after we have informed you that we are doing so.

Right to Data Portability

You have the right to the provision of all personal data, which you provided to us, provided to you in a structured, commonly used and machine-readable format where:

the lawfulness of the use of your personal data by us is reliant on the basis of a contract;

the lawfulness of the use of your personal data by us is reliant on the provision of your consent; or

the data is being utilised by fully automated means.

You may also request that we send this personal data to another legal entity where technically feasible.

We will only refuse such a request if the data being requested may adversely affect the rights and freedoms of others.

Right to Object to Certain Processing

You have the right to object to the further use of your personal data where:

the lawfulness of the use of your personal data by us is reliant on the basis of our legitimate interests;

where the data is non-sensitive and being used for reasons in the public interest; and

where the data is being used for direct marketing purposes.

If you wish to object to the use of your data, please contact us with your request. We will then stop using the data or personal data unless it is required for legal proceedings.

Right Not to be Subject to Automated Decision-Making Profiling

You have a right not to be subject to a decision based solely on automated processing or profiling, where such decisions would have a legal effect or significant impact on you.

Currently, we do not employ any systems which use automated decision making or profiling on data relating to our residents/patients.

Where we (or one of our third-party processors) use profiling, which produces legal effects for you or otherwise significantly affects you, you will have the right to object to such processing.

18. SUBJECT ACCESS REQUESTS

You may request access to personal data held about you by the Group. A Subject Access Request (SAR) does not have to be made by post. Requests may be made through appropriate channels, including electronically, subject to our need to verify the identity and authority of the requester where appropriate.

Please send all requests to the contact details provided in Section 17 below, with as much detail as possible regarding your requirements to enable us to identify the relevant records and understand and deal with your request efficiently. To answer your request, we may ask you to provide appropriate information to verify identity or authority before releasing personal data.

We will normally respond to a valid access request without undue delay and, in any event, within thirty (30) days of receipt of a valid access request. This period may be extended by up to two (2) further months where permitted by law and taking account of the complexity and number of requests.

If we require more time to deal with your request, we will notify you of the delay, and of the factors responsible for the delay, within thirty (30) days of the receipt of your request. If we refuse your request, we will notify you within thirty (30) days of the receipt of the request accompanied by the reason for refusal.

There are circumstances in which access may be restricted or refused under applicable law. Where this applies, we will explain the position to the extent permitted by law.

You are entitled to contact the Office of the Data Protection Commissioner if we refuse your request.

We will not charge a fee for any requests, provided we do not consider them to be unjustified or excessive. If we do consider these to be unjustified or excessive, we may charge a reasonable fee (also applicable for multiple copies) or refuse the request.

19. CCTV

Where CCTV is operated at any of our facilities, it is used for specified purposes such as the safety and security of residents, patients, staff and visitors, protection of property, and prevention or investigation of incidents, subject to applicable law.

CCTV processing is governed by appropriate policies, procedures and technical and organisational measures. Access to CCTV footage is restricted to authorised roles and legitimate purposes. Remote access, where provided, is subject to access controls and security measures.

CCTV footage is retained for the period specified in the applicable CCTV Policy and in accordance with the purpose for which it is collected, unless a longer period is necessary for an identified incident, investigation, legal requirement or other lawful purpose.

Further information about CCTV, including access, retention, authorised access roles, monitoring arrangements and technical and organisational measures, is set out in CCTV Policy for each Group company which is specific to the facility it operates. Further details on the CCTV Policy for a particular facility are available on request

20. COMPLAINTS AND CONCERNS

For questions concerning this Statement or the processing of your personal data or if you have concerns about how any Group company processes your personal data, you should contact the Bartra Healthcare Group Data Protection Officer in the first instance at the address below so that we can investigate and respond.

The Data Protection Officer

Northwood Residential Home

Old Ballymun Road

Northwood

Dublin 9

or by e-mail to DPO@bartrahealthcare.ie. This mailbox is managed by the DPO function and all correspondence received will be addressed accordingly, including support from the designated Data Protection Office.

You also have the right to lodge a complaint with the Data Protection Commission (DPC), Ireland’s supervisory authority for data protection.

Data Protection Commission
6 Pembroke Row
Dublin 2
D02 X963

Telephone: (01) 765 0100

Telephone: 1800 437 737

Email: info@dataprotection.ie

21.COOKIES

Cookies are small pieces of information, stored in simple text files, placed on your computer by a website. Some cookies can be read by the website on your subsequent visits. The information stored in a cookie may relate to your browsing habits on the webpage, or a unique identification number so that the website can “remember” you on your return visit. Other cookies are deleted when you close your browser and only relate to the working of the website. Generally speaking, cookies do not contain personal information from which you can be identified, unless you have furnished such information to the website.

Cookies may be set in a number of places on this website:

Cookies are created to capture information for use with website analytics. They help to provide us with accurate statistics to provide a better service.

Most browsers allow you to turn off Cookies or to customise your settings for cookies. To find out how to do this, see the “Help” menu on your browser. Please note that if you turn off cookies or change your settings, some features on this website may not work correctly.

More information on how this website uses cookies can be found in our Cookie Policy which can be accessed via the link here.

22. LINKS TO OTHER WEBSITES

Our website may contain links to other websites. We are not responsible for the privacy practices, content or security of external websites. Browsing and interaction on any other website, including websites which have a link to our website, is subject to that website’s own terms and policies. Users should review the privacy information applicable to those websites.