✚For care and social service providers

Anything relating to a person’s state of health. These are special categories under Art. 9 GDPR, and a general prohibition on processing applies to them.

Specifically, the following does not belong in a CRM or a website administration:

• Diagnoses, care levels, medication.
• Remarks such as “has dementia”, “in a wheelchair”, “difficult to deal with”.
• Details of legal guardianship, lasting power of attorney, disability.
• Anything taken from care documentation.

Where it belongs: in your care documentation, which is built and audited for that purpose.

What may go into the CRM: contact details of relatives, cooperation partners, applicants, suppliers — as business contacts, with no reference to the state of health of a person in your care.

The separation has to exist in people’s heads and in the rules. Nothing prevents it technically.

With a simple rule: record the matter, not the person.

Good: - “Called relative back, appointment for advice meeting on 14 March.” - “Enquiry about short-term care, documents sent.”

Not good: - “Son very upset, mother apparently in poor condition.” - “Urgently needs a place, dementia.”

The difference: the second sentences contain health information and judgements — both in a system that several people can look into and that is subject to the right of access.

And the touchstone that applies especially here: write as if the person concerned were reading along. With access requests from relatives, that is exactly the case.

For everything that is not care, and that is more than you might think:

• Recruiting staff. Applications, candidate pool, follow-ups. The most important use in your sector.
• Cooperation partners — hospitals, doctors, social services, legal guardians. Who promised what, and when?
• Enquiries from relatives as a matter, without reference to health.
• Suppliers and service providers.
• Volunteers, if you have any.

What Aurora Hive Sales is not: care documentation, resident management, a billing system. There are specialist applications for that, which have to meet the requirements.

The separation is sharp and should be discussed as such: residents and clients do not belong in this system.

By building up the pool you need when you are looking for someone at short notice — and in your sector, that is the norm.

What pays off:

• Record every application, including rejected ones — with consent for the pool.
• Take speculative applications seriously. They are the most valuable contacts of all.
• Follow up. Someone who declined a year ago may accept today.
• Former employees as a category of their own. Returners are common in care and inexpensive to recruit.

What you must bear in mind:

• Deletion periods. Rejected applications usually after six months, unless there is consent to the pool.
• Do not take over any health information from application documents.

And: speed decides. Anyone who does not get in touch for two weeks has lost the applicant.

What decisions are actually based on, and that is rarely the list of tasks.

What applicants want to know:

• Duty roster and reliability. How far in advance is it fixed, how often do people have to step in?
• Pay. In concrete terms. An advert without it gets fewer replies.
• Team and size. How many on a shift, what is the turnover?
• What you do differently from the other three facilities in town.

What appears in every second advert and achieves nothing: “We are a motivated team” and “varied work”.

Legally: adverts must be gender-neutral (German General Equal Treatment Act, AGG), and requirements must not discriminate indirectly.

Two audiences that could hardly be more different — and therefore two clear entry points:

For relatives: - What you offer, in clear words. Short-term care, day care, home care, residential care. - Reachability. Anyone searching in this situation is looking for a phone number. - What a first step is and what it costs. - What it looks like — real pictures, not stock photos.

For applicants: - A page of its own, not an item in the menu under “About us”. - Open vacancies, up to date. - What makes the workplace special.

And what must not be missing from any care website: clarity about how to reach you in an emergency. Anyone searching at night needs a number, not a form page.

Only with explicit, written consent, and the requirements are higher here than elsewhere.

What needs to be considered:

• Who can give effective consent? If the capacity to consent is limited, the legal guardian or a power of attorney is required, and the scope of the power of attorney must cover it.
• Voluntariness. In a relationship of dependency, voluntariness must be examined particularly carefully. A resident must not have to fear any disadvantage.
• Withdrawal. Possible at any time; the picture must then come down.
• Context. A photo in a care context allows conclusions about the state of health — which makes it a special category itself.

What works in practice: rooms, outdoor areas, meals, hands, views from behind, employees with their consent.

Real pictures work better than stock photos — but not at this price.

Through a clearly separate channel — and with a rule on who may be told what.

What needs to be clarified before an email goes out:

• Who is entitled to information? Not every relative is. That follows from a power of attorney or legal guardianship, not from kinship.
• What may be communicated? Organisational matters, yes; health matters only to those entitled, and then not by unencrypted email.

What is suitable for general announcements — visiting times, events, building work:

• A mailing list with consent.
• Everyone gets their own email. Never an open distribution list.

And keep this strictly separate from advertising: information about the facility is not advertising; a reference to a chargeable additional service is.

Like any other business contact — and this is where the underestimated benefit of a CRM in your sector lies.

What is worth recording:

• Who is the contact person in social services, in discharge planning, in the practice?
• When was the last contact, and about what?
• What has been promised — capacity, call-backs, information.

Why this pays off: occupancy comes about through relationships. A social service that knows you and can reach you will recommend you, and staff changes there are frequent.

A call each quarter to the most important partners, noted and with a follow-up, is the most effective occupancy work there is. And it is legally unproblematic: these are business contacts, not patient data.

As a category of their own in the database — with the same duties of care as for employees.

What is part of it:

• Contact details and availability. Who can do what, and when?
• What has been agreed — area of work, frequency.
• Proof, where required (such as enhanced criminal record certificates in certain areas). But: the certificate itself does not belong in the CRM — only the note that it was presented, and when.
• Insurance status, if that matters for you.

What keeps volunteers on board is the same as for employees: reliability and recognition. A system helps with this by reminding you of birthdays, anniversaries and the last assignment.

And the practical point: anyone who has not been deployed for six months is usually gone — if nobody calls.

In your sector, more than elsewhere — the thresholds are reached more quickly:

• Data protection officer. Practically always required in facilities with extensive processing of health data, regardless of the number of employees.
• Record of processing activities — mandatory as soon as special categories are processed.
• Data protection impact assessment for high-risk processing.
• Data processing agreements with all service providers.
• Obligation of employees to confidentiality.
• A deletion concept that maps the various periods.

In addition, there are professional confidentiality obligations (§ 203 of the German Criminal Code, StGB) and care-home regulations depending on the federal state.

What this means for choosing a system: clarify before introduction which data may be stored where. Correcting this decision afterwards is expensive.

Differently from an office — because everyone is never there at the same time.

What works:

• Introduce it at shift handovers, not in a group training session. Ten minutes per shift over two weeks.
• One person per shift who answers questions.
• Start small. A single use case that saves work — usually recording applications or the cooperation contacts.
• Not for care itself. Anyone who gets the impression that it is meant to replace the documentation will rightly resist.

What does not work: an introduction that means additional documentation. In a sector with a chronic lack of time, every additional entry is rejected — and rightly so.

The touchstone for any introduction here: does it save the shift time, or does it cost them time?