Privacy and Cookie Policy
Sep 29, 2026
The Condition Management Company Ltd is responsible for the personal information we hold about you. In data protection law, this makes us the "controller" of your information.
This policy explains what information we collect, why we collect it, who we share it with, how long we keep it and what rights you have. It also explains how we use cookies on our website. We follow the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, as amended by the Data (Use and Access) Act 2025.
Company name | The Condition Management Company Ltd |
Company number | 13831409 |
Registered address | Anderson House, Clinton Avenue, Nottingham, NG5 1AW |
ICO registration number | ZB542850 |
Data Protection Officer | Ben Krysiak |
Caldicott Guardian | Jen Moon |
enquiries@conditionmanagement.co.uk | |
Telephone | 03300 436965 |
Our Data Protection Officer makes sure we handle your information lawfully. Our Caldicott Guardian is responsible for protecting the confidentiality of your health information and making sure it is shared appropriately.
We only collect the information we need to provide your care and run our services. Depending on how your care is arranged, this may include:
• Personal details: your name, address, date of birth, contact details, NHS number and GP details.
• Health information: notes and reports about your health, assessments, treatment sessions, outcomes and any referrals to other services.
• Contact records: details of appointments, calls, emails, text messages and video sessions we have had with you.
• Video recordings: a recording of a video session, but only if you have given your specific consent.
• Information from others: relevant details from other health and social care professionals, local authorities, voluntary organisations, relatives or carers.
• Employer details: if your employer funds your care, the name and contact details of your employer and the person arranging your referral.
• Payment details: if you pay for your own care, your billing details and payment records. Card payments are processed securely by our payment provider and we do not store your full card details.
• Next of kin or parent details: for children and young people, the details of a parent, guardian or other person with parental responsibility.
Health information is known as "special category" data. The law gives it extra protection, and we treat it with particular care.
We use your information mainly to plan, deliver and manage your care. The law requires us to have a lawful basis for each use, and an extra condition for health information. These are set out below.
What we use it for | Lawful basis (UK GDPR Article 6) | Condition for health information (Article 9) |
Providing care funded by the NHS or a local authority | 6(1)(e) public task | 9(2)(h) health or social care |
Providing care you or your employer pay for | 6(1)(b) contract, or 6(1)(f) legitimate interests where the contract is with your employer | 9(2)(h) health or social care |
Appointment reminders and service messages by text, email or phone | Same basis as your care | 9(2)(h) health or social care |
Recording video sessions | 6(1)(a) consent | 9(2)(a) explicit consent |
Sharing pseudonymised information with NHS and local authority commissioners | 6(1)(e) public task | 9(2)(h) health or social care |
Taking payments and keeping financial records | 6(1)(b) contract and 6(1)(c) legal obligation | Not applicable |
Protecting children and adults at risk | 6(1)(c) legal obligation, or 6(1)(ea) recognised legitimate interests (safeguarding) | 9(2)(g) substantial public interest (safeguarding) |
Emergencies where someone's life is at risk | 6(1)(d) vital interests | 9(2)(c) vital interests |
Checking and improving the quality of our services, including clinical audit | 6(1)(e) public task or 6(1)(f) legitimate interests | 9(2)(h) health or social care |
Handling complaints and legal claims | 6(1)(c) legal obligation or 6(1)(f) legitimate interests | 9(2)(f) legal claims |
Meeting legal duties, such as court orders and reporting certain infectious diseases | 6(1)(c) legal obligation | 9(2)(i) public health, or 9(2)(f) legal claims |
The Data Protection Act 2018, Schedule 1, sets out the further conditions we rely on for health and safeguarding information.
Confidentiality. Alongside data protection law, we follow the common law duty of confidentiality. When you accept care from us, we rely on your implied consent to share information with those directly involved in your care. For anything else, we will ask for your consent unless the law allows or requires us to share it.
Statistics, training and research. When we produce statistics or use information to train staff, we remove anything that could identify you wherever we can. Anonymous information may be shared with organisations such as universities. We will only use information that identifies you for research with your explicit consent.
Video recordings. We only record a video session if you give your specific consent beforehand. A recording may be shared with you, or used to train our staff and audit the quality of our care, and we will tell you which before you agree. You can withdraw your consent at any time. Recordings are kept in line with our recordings retention policy, which we will share with you on request.
National data opt out. If your care is funded by the NHS, you can choose to stop your confidential information being used for research and planning. This does not affect your care. You can find out more at nhs.uk/your-nhs-data-matters.
Marketing. We do not send marketing newsletters. If this changes, we will only send them with your consent, and you will be able to unsubscribe at any time.
We provide care to people under the age of 18. Their information has the same protection as an adult's, and we take extra care when deciding who can see it.
A young person who is mature enough to understand their care can make their own decisions about their information. This includes whether it is shared with a parent or guardian, and whether they want to request a copy of their records. For younger children, a parent or guardian with parental responsibility can usually act on their behalf, as long as this is in the child's best interests.
We will always share information when we need to protect a child from harm, even if the child or their family does not agree.
If you are a young person and have questions about your information, you can speak to your clinician or contact us using the details above.
We only share your information when someone has a genuine need for it as part of your care, when you have agreed, or when the law requires it. Anyone who receives information from us has a legal duty to keep it confidential and secure.
Organisations involved in your care. We may share information with:
• your GP
• social care services
• education services
• local authorities
• voluntary and private sector care providers
We share information for your care in line with the Health and Social Care Act 2012, as amended by the Health and Social Care (Safety and Quality) Act 2015.
Your employer. If your employer funds your care, they may receive updates on your progress. The level of detail is agreed with your employer in a written information sharing agreement and explained to you before your care begins. Many employers only receive overall figures for everyone they have referred, with nothing that identifies you. We will not share your clinical notes with your employer without your consent.
NHS and local authority commissioners. If your care is funded by the NHS or a local authority, we share information with the organisation that commissions the service, as required by our contract with them. This information is pseudonymised, which means details that directly identify you, such as your name and address, are removed or replaced with a code.
Legal representatives. A solicitor or other representative can request your records on your behalf. We will only release them with your signed authority.
When the law requires it. We must pass on certain information, even without your consent. Examples include:
• where there is a risk of serious harm to a child or an adult at risk
• where a court orders us to
• where we come across certain infectious diseases that may put others at risk, such as meningitis or measles
• where it is needed to prevent or detect a serious crime
A senior clinician or our Caldicott Guardian will review each of these decisions, and we will only share what is necessary.
We use a small number of trusted suppliers to run our systems. They can only use your information on our instructions and must keep it secure. Each has a written contract with us that meets the requirements of UK GDPR.
Supplier | What they do for us | Where data is stored |
eClinic | Our patient management system, holding your records, appointments and invoices | UK |
ClearAccept | Processing card payments made through eClinic | UK |
CallSwitch | Our telephone system | UK |
Xero | Bookkeeping and financial records | EU |
Microsoft | Email, secure cloud storage and our computer systems | EU |
Zoom | Video sessions and, with your consent, session recordings | EU |
Website statistics (see our cookies section) | EU |
Where your information is stored. All of our suppliers store your information in the UK or the European Union. The UK government recognises the EU as having an adequate level of data protection, so your information has the same protection as it would in the UK. If a supplier ever needs to transfer information anywhere else, we make sure approved safeguards, such as the International Data Transfer Agreement, are in place.
Everyone who works for us has a legal duty to keep your information confidential. Staff receive regular data protection training, and they can only see the information they need to do their job.
We hold the NHS Data Security and Protection Toolkit and Cyber Essentials accreditation, which show that we meet national standards for keeping information safe. Our systems are protected by secure logins and access controls, and we check that our suppliers meet appropriate security standards before we use them.
If something goes wrong and your information is put at risk, we will investigate straight away. Where the law requires it, we will report it to the Information Commissioner's Office and tell you.
If you are ever unsure whether a text, email or call has really come from us, please contact us using the details at the top of this policy.
We keep your records for eight years after your last contact with us. After this, we securely destroy them.
We may keep some records for longer where the law or our contracts require it. For example, records for children and young people are kept for longer, because the time limit for legal claims does not start until they turn 18. Records for NHS funded care may also need to be kept in line with NHS requirements.
We review what we hold regularly and do not keep information for longer than we need it.
You have the following rights over your information. Some only apply in certain situations, and we will explain if one does not apply to your request.
Your right | What it means |
Access | You can ask for a copy of the information we hold about you. This is known as a subject access request. |
Correction | You can ask us to correct information that is wrong or incomplete. |
Erasure | You can ask us to delete your information. We usually cannot delete health records while we still need to keep them. |
Restriction | You can ask us to limit how we use your information while a concern is looked into. |
Objection | You can object to us using your information where we rely on public task or legitimate interests. |
Portability | You can ask for information you gave us to be sent to you or another organisation in a common digital format, where we rely on your consent or a contract. |
Withdrawing consent | Where we rely on your consent, you can withdraw it at any time. |
We do not make any decisions about you using automated systems without a person being involved.
How to make a request. Email enquiries@conditionmanagement.co.uk, marked for the attention of our Data Protection Officer, or write to us at the address above. You can also ask any member of our team, who will pass your request on. We may need to check your identity before we respond.
There is usually no charge. We will respond within one month. If your request is complex, we may extend this by up to two further months, and we will tell you if we need to. We will make a reasonable and proportionate search for the information you ask for.
Requests made on your behalf. A solicitor, relative or other person can make a request for you, as long as they provide your signed authority.
If you are unhappy with how we have handled your information, please tell us. Our Data Protection Officer deals with all data protection complaints.
1. Email enquiries@conditionmanagement.co.uk, marked for the attention of our Data Protection Officer, or write to us at the address above. Please tell us what happened and what you would like us to do.
2. We will acknowledge your complaint within 30 days.
3. We will look into it and tell you the outcome without undue delay. We will keep you updated if it takes longer than expected.
If you are still unhappy after we have responded, you can complain to the Information Commissioner's Office (ICO), the UK's data protection regulator. The ICO will usually expect you to have raised your complaint with us first.
• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, 4th Floor, No. 3 Circle Square, 5 Hawkshaw Street, Manchester, M1 7BL
Cookies are small text files saved on your device when you visit a website. They help the site work and tell us how people use it. We do not use cookies for advertising.
Types of cookie we use.
Type | What it does | Do we need your consent? |
Strictly necessary | Makes the site work, including our online booking and remembering your cookie choices | No |
Statistics | Tells us how many people visit and which pages they use, so we can improve the site | No, but you can opt out at any time |
Social media | Lets you share our pages on social media. The social media company sets and controls these cookies | Yes. These are only set if you accept them |
Embedded content | If we add videos or other content from another website in future, that website may set its own cookies | Yes. This content will only load if you accept it |
Cookies on our site.
Cookie | Set by | Purpose | How long it lasts |
_ga | Google Analytics | Tells visitors apart for our visitor statistics | 2 years |
ga followed by a code | Google Analytics | Keeps track of a single visit for our statistics | 2 years |
Booking cookies | eClinic | Makes the online booking form work | Varies, see the eClinic privacy policy |
Consent cookie | Our cookie banner | Remembers your cookie choices | Up to 12 months |
We use Google Analytics only to produce statistics about how our website is used, and not for advertising. Google stores this information on servers in the European Union.
If you share our content on a social media site, or if we embed content from sites such as YouTube in future, those companies control their own cookies. Please check their privacy policies for details. Where we embed videos, we will use privacy enhanced settings where these are available.
Managing your cookies. When you first visit our site, you can choose which cookies to allow. You can opt out of statistics cookies, and social media and embedded content cookies are only set if you accept them. You can change your choices at any time by selecting "Cookie settings" at the bottom of any page. You can also block or delete cookies in your browser settings, although parts of the site, such as online booking, may not work properly. To stop Google Analytics on all websites, you can install the Google Analytics opt out add on.
We review this policy regularly and will update it when our services, systems or the law change. The date at the top shows when it was last updated. If we make a significant change, we will let you know.
If you have any questions about this policy or your information, please contact us.
The Condition Management Company Ltd Anderson House Clinton Avenue Nottingham NG5 1AW
Email: enquiries@conditionmanagement.co.uk Telephone: 03300 436965
Please choose which cookies you want to consent to.
.svg)
Back
