# DATA SHARING AGREEMENT
Date: 1 August 2029
Parties: Northshire Community Health CIC and Eastmere Council
## 1. Parties and purpose
Northshire Community Health CIC of 10 Station Road, Harrogate HG1 2DL and Eastmere Council of Civic Offices, Market Square, York YO1 8RS are independent controllers sharing information for the Eastmere falls-prevention pathway.
## 2. Money and rights
The data subjects are approximately 1,200 adults aged 65 or over referred during the year. Data is limited to name, contact details, date of birth, accessibility needs, referral dates and relevant health information; full clinical records and financial data are excluded.
## 3. Duties and operation
Each controller records its lawful basis under UK GDPR Article 6(1)(e) public task and, for health information, Article 9(2)(h) health or social care, with its DPA 2018 Schedule 1 condition and policy document. Data will be used only to assess referrals, arrange support and audit outcomes.
## 4. Consent and management
The parties will minimise fields, verify recipient details, use role-based access and encrypt transfers. They will not sell data, use it for marketing or combine it with unrelated datasets. Each controller remains responsible for its own transparency information and data-subject requests.
## 5. Ending and remedies
Records are retained for seven years after the last intervention unless a longer statutory or safeguarding period applies, then securely deleted. Each party maintains an access log, trains staff and reports a suspected personal-data breach to the other within 24 hours.
## 6. Legal reservations
The parties will co-operate on access, rectification, restriction, complaints and Information Commissioner's Office enquiries. Neither party appoints the other as processor; any later processor or international transfer requires documented assessment and appropriate UK GDPR safeguards.
## 7. Signatures
This agreement is reviewed every 12 months and may be suspended if sharing becomes unlawful or unsafe. It does not override the UK GDPR, Data Protection Act 2018, common-law confidentiality or a person's rights. England and Wales law applies; authorised officers sign.