Policy version: May 2025
This Privacy Policy is provided by Ben Holden Ltd., a company registered in England and Wales under company number: 06891396 with registered office at Office 20, Cp House, Otterspool Way, Watford, Hertfordshire, England, WD25 8HR (‘we’, ‘our’ or ‘us’). We are registered with the Care Quality Commission (CQC) and regulated as a healthcare provider. This policy explains how we handle personal data, including health and medical information, collected through our clinical case management services, website (www.benholden.net) and related services (Services). By using our Services and agreeing to this policy, you consent to our data practices as described herein.
We take your privacy and confidentiality extremely seriously, recognising our position as a clinical case management provider and the sensitive nature of the health information you share with us. Please read this privacy policy carefully as it contains important information on how and why we collect, store, use and share your personal data, including your health and care information, in accordance with medical confidentiality requirements and healthcare information governance standards.
It also explains your rights in relation to your personal data and how to contact us, our Data Protection Officer, or the relevant regulator in the event you have a complaint. Our collection, storage, use and sharing of your personal data is regulated by law, including under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and relevant healthcare regulations including those set by the Care Quality Commission.
We are the controller of personal data obtained via the Services, meaning we are the organisation legally responsible for deciding how and for what purposes it is used.
This privacy policy relates to your use of the Services only.
In providing our services, we may use various digital tools and platforms, and may also refer you to or work with other healthcare providers, specialists, or service providers. These third parties may collect and process your information according to their own privacy policies. For privacy information relating to these third parties, please consult their respective privacy policies. For more information about our data sharing practices, see the section ‘Who we share your personal data with’ below.
The personal data we collect about you depends on the particular activities carried out through the Services. We will collect and use the following personal data about you:
|
Category of data |
In more detail |
|
Personal Data and Special Category Data Processed Through the Services |
|
|
Data collected when you use specific functions in the Services |
Data you store online with us using the Services including your usage history or preferences (while such data may not always be personal data as defined at law in all cases, we will assume it is and treat it in accordance with this policy as if it were) |
|
Other data collected through our digital services |
|
|
Data collected when you make an enquiry with us |
Your name, mobile number and email address |
If you do not provide personal data we ask for where it is required, including health information and medical history necessary for safe and effective case management, it may prevent us from providing clinical services and/or the Services to you. However, we will only request information that is necessary for your care and treatment in line with clinical guidelines and professional standards.
We collect and use this personal data for the purposes described in the section ‘How and why we use your personal data’ below.
As a specialist clinical case management provider, we process special category data (sensitive personal data) which includes information about your health, medical conditions, treatment plans, rehabilitation progress, mental health status, physical disabilities, therapy assessments, social care needs, care coordination records etc. We process this data in accordance with Article 9(2)(h) of the UK GDPR and EU GDPR for the purposes of providing healthcare and treatment, Article 9(2)(c) for protecting vital interests where you are physically or legally incapable of giving consent, and where applicable, Article 9(2)(b) for carrying out obligations under employment and social security law. This processing is subject to additional safeguards and is carried out by qualified healthcare professionals subject to professional confidentiality obligations under UK law, including the Health and Care Professions Council (HCPC) standards, Care Quality Commission (CQC) regulations, and other relevant professional regulatory bodies.
As a healthcare provider, we necessarily collect and process sensitive personal data (special category data) relating to your health, medical conditions, and treatment. This processing is essential for providing our rehabilitation services and is carried out under strict confidentiality protocols and security measures. We may also process information about criminal convictions where relevant to your care and treatment, subject to appropriate safeguards.
We collect personal data from you in several ways: (a) directly through clinical interactions, case management assessments, multidisciplinary team meetings, care planning sessions, when you engage our services, contact us, or make submissions; (b) when you use our digital services, automatically collecting usage data including your IP address, geographical location, browser type and version, operating system, referral source, length of visit, page views and website navigation paths; (c) indirectly through third-party digital services like Google Analytics where applicable; (d) through referrals from other healthcare providers, insurance companies, solicitors, and employers with your consent; and (e) from family members, carers, or legal representatives where they have appropriate authority to provide such information.
Under data protection law and healthcare regulations, we process your personal data, including health data and other special category data, as well as information collected through cookies and similar technologies, under the following legal bases, with specific safeguards as required by law for processing medical information:
A legitimate interest is when we have a business or commercial reason to use your information, so long as this is not overridden by your own rights and interests. We will carry out an assessment when relying on legitimate interests, to balance our interests against your own. You can obtain details of this assessment by contacting us (see ‘How to contact us’ below).
The table below explains what we use your personal data for and why.
|
What we use your personal data for |
Our reasons |
|
Create and manage your account with us |
To perform our contract with you or to take steps at your request before entering into a contract |
|
Providing services and/or the functionalities of the Services to you |
Depending on the circumstances, to perform our contract with you or to take steps at your request before entering into a contract for provision of Services. |
|
To enforce legal rights or defend or undertake legal proceedings |
Depending on the circumstances:
|
|
Communications with you not related to marketing, including about changes to our terms or policies or changes to the Services or service or other important notices |
Depending on the circumstances:
|
|
Protect the security of systems and data |
To comply with our legal and regulatory obligations, including NHS Digital Security and Protection standards and clinical information governance requirements, we use your personal data to ensure the security of systems and data to the enhanced standards required for healthcare providers. This includes implementing robust technical and organisational measures to protect sensitive clinical data, maintaining audit trails of access to health records, and preventing unauthorised access that could compromise patient care or confidentiality. Our security measures are regularly reviewed and updated in line with healthcare sector best practices and regulatory requirements. |
|
Operational reasons, such as clinical audit, case management reviews, multidisciplinary team meetings, service evaluation, professional training, quality assurance processes, and healthcare service improvement initiatives, all of which are conducted under strict confidentiality protocols and, where possible, using anonymised or pseudonymised data. |
For our legitimate interests or those of a third party, i.e., to be as efficient as we can so we can deliver the best service to you |
|
Statistical analysis to help us manage our business and improve our services, e.g., in relation to our clinical performance, service delivery, patient outcomes, and other quality and efficiency measures |
For our legitimate interests or those of a third party, i.e. to be as efficient as we can so we can deliver the best service to you manage our clinical services and improve patient care, including clinical outcomes analysis, service evaluation, and quality improvement initiatives. Such analysis is conducted using anonymised or pseudonymised data where possible, in accordance with healthcare research and audit guidelines, and with appropriate ethical oversight where required. |
|
Updating and enhancing user records |
Depending on the circumstances:
|
|
To comply with our legal and regulatory obligations |
Depending on the circumstances:
where neither of the above apply, for our legitimate interests or those of a third party, e.g. making sure that we can keep in touch with our customers about their accounts and new products or functionalities related to the Services and our services |
|
To share your personal data with members of our group and third parties in connection with a significant corporate transaction or restructuring, including a merger, acquisition, asset sale, initial public offering or in the event of our insolvency. In such cases information will be anonymised where possible and only shared where necessary |
Depending on the circumstances:
|
See ‘Who we share your personal data with’ for further information on the steps we will take to protect your personal data where we need to share it with others. Please note that we may disclose your personal data to: (1) other healthcare providers involved in your care as part of the multidisciplinary team approach; (2) our insurers and/or professional advisers as reasonably necessary for insurance coverage, risk management, professional advice, and managing legal disputes; (3) relevant regulatory bodies such as the CQC during inspections or investigations; and (4) commissioners of services where required for quality monitoring and service evaluation. Any other disclosure of your personal data will only occur where necessary for compliance with a legal obligation or to protect vital interests. All data sharing is conducted in accordance with the applicable laws and regulations.
We process information for two distinct purposes: (1) clinical communications about your care, including appointment reminders, treatment updates, care plan changes, multidisciplinary team meeting outcomes, and essential service notifications, which are necessary for providing our case management services and ensuring continuity of care; and (2) optional marketing communications such as newsletters and information about our additional services. Clinical communications are an essential part of your care and cannot be opted out of, while marketing communications will only be sent with your explicit consent.
We will always ask for your explicit consent before sending you marketing communications. We maintain separate consent mechanisms for marketing communications and medical treatment, ensuring that your consent for treatment is never tied to marketing consent. You can withdraw your marketing consent at any time without affecting your healthcare services.
You will have the right to opt out of receiving marketing communications at any time by:
We will always treat your personal data with the utmost respect and never sell or share it with other organisations for marketing purposes. Clinical data will only be shared with other healthcare providers and relevant parties as necessary for your care and in compliance with healthcare information governance frameworks.
For more information on your right to object at any time to your personal data being used for marketing purposes, see ‘Your rights’ below.
We may process and share your personal data with the following categories of recipients: (1) Healthcare professionals directly involved in your care and treatment; (2) NHS and private healthcare providers where necessary for your ongoing care; (3) Social services and local authorities involved in your care package; (4) Insurance companies and solicitors involved in your case (with your explicit consent); (5) Employers and occupational health services (where relevant to your rehabilitation); (6) Service providers who help us run our business, including secure medical record systems, specialised case management software providers, and cloud storage providers certified for healthcare data processing; (7) Quality assurance and regulatory bodies such as the CQC and HCPC when required; and (8) analytics service providers (including Google Analytics) for service usage analysis and mapping services (including Google Maps) for location functionality where relevant to service delivery. All sharing of data is done under strict confidentiality agreements, in compliance with applicable laws, and only when necessary for your care or with your explicit consent. We maintain detailed records of all data sharing in accordance with clinical audit requirements. We ensure all third-party processors comply with data protection standards and have appropriate technical and organisational measures in place. For information about Google’s data protection practices, please see their privacy policy at https://policies.google.com/privacy?hl=en-US
We only allow service providers to handle your personal data if they meet strict security standards, including NHS Digital’s Data Security and Protection Toolkit requirements for health data processors. For medical data, we require additional safeguards including encryption, access controls, and specific certifications for healthcare data processing. We impose strict contractual obligations on all service providers, with enhanced requirements for those handling medical information, ensuring they can only use your personal data for specified purposes in providing services to us and to you.
We or the third parties mentioned above may occasionally also need to share your personal data with:
If you would like more information about who we share our data with and why, please contact us (see ‘How to contact us’ below).
We will not share your personal data with any other third party except where necessary for your medical care, where required by law, or with your explicit consent. Data collected through cookies and tracking technologies will only be shared with analytics providers or other third-party services in accordance with your cookie preferences and our Cookie Policy. This may include sharing with other healthcare providers, NHS services, or insurance providers involved in your care.
We will retain your personal data in accordance with our data retention policy. Please note that the right to erasure (also known as the ‘right to be forgotten’) does not apply to health and medical records where there is a lawful basis for their continued retention. Under the UK GDPR and the Data Protection Act 2018, exemptions exist which permit the ongoing processing and storage of personal data.
Following the end of the applicable retention period, we will securely archive, delete or anonymise your personal data in accordance with applicable laws and clinical records management best practices. Any anonymised data may be retained for clinical audit, research, and service improvement purposes in compliance with healthcare regulations.
We may transfer your non-clinical personal data (such as email addresses for newsletter communications) outside the UK through our use of service providers like Campaign Monitor. Clinical data, including case management records, treatment plans, and medical assessments, will only be stored and processed within the UK unless exceptional circumstances require international transfer for your direct care. Any transfer of medical data is subject to additional safeguards and requirements as detailed in the medical data transfer section below. Any such transfers are protected by appropriate safeguards, including adequacy decisions by the UK government or Standard Contractual Clauses. We ensure compliance with UK data protection laws to maintain the privacy and security of your data. Any changes to international transfer arrangements will be communicated to you in accordance with the section on ‘Changes to this privacy policy’ below.
Furthermore, under UK data protection laws and healthcare regulations, we can only transfer your medical records and other personal data to a country outside the UK where: the UK government has decided the particular country ensures an adequate level of protection of personal data (known as an ‘adequacy regulation’) further to Article 45 of the UK GDPR; there are appropriate safeguards in place, together with enforceable rights and effective legal remedies for you; or a specific exception applies under relevant data protection law. Any such transfer would require explicit patient consent, except where: (1) appropriate safeguards are already in place through Standard Contractual Clauses or adequacy decisions; (2) the transfer is necessary to protect your vital interests; or (3) the transfer is required for important reasons of public health. Accordingly, if we were to start transferring your personal data from the UK to:
In the event we could not or choose not to continue to rely on either of those mechanisms at any time we would not transfer your personal data outside the UK unless we could do so on the basis of an alternative mechanism or exception provided by UK data protection law.
You generally have the following rights regarding your personal data, which you can usually exercise free of charge. However, please note that these rights are modified in the context of healthcare services in accordance with the UK Data Protection Act 2018 and healthcare regulations. Specifically, some rights may be limited when your data is being processed for healthcare purposes or to comply with legal obligations. For example, the right to erasure may not apply to medical records that need to be retained for legal and healthcare purposes, and access requests for clinical records may require review by healthcare professionals before release. For more information regarding these rights, please visit the ICO website here.
|
Access to a copy of your personal data |
The right to be provided with a copy of your personal data. |
|
Correction (also known as rectification) |
The right to require us to correct any mistakes in your personal data. |
|
Erasure (also known as the right to be forgotten) |
The right to require us to delete your personal data in certain situations, though this right is limited for medical records which we may be legally required to retain for specified periods under healthcare regulations and professional guidelines. |
|
Restriction of use |
The right to require us to restrict use of your personal data in certain circumstances, e.g. if you contest the accuracy of the data. |
|
Data portability |
The right to receive the personal data you provided to us, in a structured, commonly used and machine-readable format and/or transmit that data to a third party—in certain situations. |
|
To object to use |
The right to object:
|
|
Not to be subject to decisions without human involvement |
The right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you. We do not make any such decisions based on data collected by the Services. |
For further information on each of those rights, including the circumstances in which they do and do not apply, please contact us (see ‘How to contact us’ below). For guidance specific to healthcare data rights, you may consult NHS Digital’s information governance resources. You may also find it helpful to refer to the guidance from the UK’s Information Commissioner on your rights under the UK GDPR and the Caldicott Principles regarding healthcare data.
If you would like to exercise any of those rights, or manage your cookie preferences beyond browser settings, please contact our Data Protection Officer through our secure request form—available on our website at [insert link] or via secure email, phone, or mail—see below: ‘How to contact us’. For protection of your sensitive medical information, when contacting us please:
We process your personal data (whether collected online or offline) primarily for the provision of clinical case management services and direct patient care, and additionally for our legitimate interests and those of third parties, specifically: (a) to protect systems and clinical data; (b) to prevent and detect unauthorised access or criminal activity that could compromise patient care; (c) to ensure compliance with our legal obligations under healthcare regulations; and (d) to maintain accurate clinical records for continuity of care. The legal basis for this processing is our legitimate interests and compliance with legal obligations. We implement enhanced security measures including encryption, access controls, and audit trails specifically designed for protecting sensitive medical data in accordance with NHS Digital Security and Protection standards and the Data Security and Protection Toolkit requirements.
We maintain a comprehensive Clinical Information Security Incident Response Plan to deal with any suspected data security breach. We will notify you, the Information Commissioner’s Office (ICO), relevant healthcare authorities including NHS Digital, the Care Quality Commission (CQC), and where applicable, your referring healthcare provider of any suspected data security breach within 72 hours of discovery. Our incident response includes a clinical risk assessment to evaluate any potential impact on patient care. For breaches involving medical data, we will also notify any other healthcare providers involved in your care who may be affected. Our incident response team includes clinical professionals to assess any potential impact on patient care.
If you want detailed information on how to protect your health information online, please refer to NHS Digital’s guidance on keeping your healthcare data secure. For general online security, visit www.getsafeonline.org, supported by HM Government. We also recommend following the NHS Digital’s guidelines for securing devices used to access healthcare services.
A cookie is a small text file which is placed onto your device (e.g. your smartphone or other electronic device) when you use the Website. When we use cookies on the Website, you will be presented with a cookie banner that allows you to make informed choices about which cookies you accept.
Cookies help us to recognise you and your device and allow us to store some information about your preferences or past actions, and remember your preferences next time you visit the Website.
For example, we may monitor how you interact with our online services, including which features you access and how frequently you use different parts of our digital platforms. For our offline services, we maintain separate records of your in-person visits, consultations, and treatment sessions. This information helps us to understand use of the Website by our users. Some of this data will be aggregated or statistical, which means that we will not be able to identify you individually. However, some cookies may collect personal data, as detailed in the cookie table below and our Privacy Policy.
For further information on our use of cookies, including a detailed list of organisational and workforce-related information which we and our authorised partners may collect through cookies to facilitate collective labour relations processes, please see below.
For further information on cookies generally, including how to control and manage them, visit the guidance on cookies published by the UK Information Commissioner’s Office, www.aboutcookies.org or www.allaboutcookies.org.
We will ask for your permission through a clear and prominent notice before placing any cookies or other similar technologies on your device, except for strictly necessary cookies that are essential for us to provide you with clinical services (e.g. to maintain secure access to your medical records, enable emergency access protocols, track treatment progress, and ensure appropriate clinical access controls).
You can withdraw any previously given consent or manage your cookie preferences at any time by using our cookie management tool available within the Website itself. Your choices will be respected and implemented immediately upon selection. You can then adjust sliders or untick boxes as appropriate to reflect your choice. It may be necessary to refresh or restart the Website for the updated settings to take effect.
We use the following cookies:
The table below provides more information about the individual cookies we use and why:
|
The cookies we use |
Name |
Purpose |
Whether cookie is essential for us to provide you with a service that you have requested and whether we will seek your consent before we place the cookie |
|
[Describe the type of cookie, including its owner e.g. ‘Universal Analytics (Google)’] |
[Insert cookie name(s) e.g. _ga, _gali, _gat, _gid] |
[Insert a general description, eg: This is a web analytics service provided by Google Inc which uses cookies to show us how visitors use our Website, and how we can enhance their experience. It provides us with information about the behaviour of our visitors (eg how long they stayed on the Website) and also tells us how many users we have had.] This cookie collects information in an anonymous form including: [insert] OR personal information including: [insert]. [Insert details of how long the cookie will remain—this should be no more than 13 months before consent has to be refreshed.] Read [insert link to third party guidance on how the third party (eg Google or YouTube) uses the cookies and the data generated by them where relevant]. |
[Insert, eg Yes, essential (we will therefore not request your consent before placing this cookie) OR No, will therefore request your consent before placing this cookie] |
|
[Insert details of other cookies] |
[Insert cookie name(s) eg _ga, _gali, _gat, _gid] [Insert details of other cookies] |
[Insert details of other cookies] |
[Insert details of other cookies] |
If you do not want to accept cookies, you can either use our cookie management tool to reject non-essential cookies, or change your browser settings to block cookies. Please note that blocking all cookies (including essential cookies) will significantly impact your ability to use the platform. Critical features such as secure access to your medical records, appointment scheduling, treatment plan tracking, and secure communications with your healthcare providers may become unavailable. For further information about cookies and how to disable them please go to the guidance on cookies published by the UK Information Commissioner’s Office, www.aboutcookies.org or www.allaboutcookies.org.
Please contact us if you have any queries or concerns about our use of your medical information or other personal data (see below ‘How to contact us’). Our Data Protection Officer and clinical governance team, which includes senior healthcare professionals specialising in neurological and rehabilitation care, will work to resolve any issues you may have, while ensuring your healthcare needs continue to be met appropriately. For concerns related to your treatment records or care plan data, your case manager or treating clinician can be involved in the discussion if you wish.
You also have the right to lodge a complaint with the Information Commissioner.
The Information Commissioner can be contacted at https://ico.org.uk/make-a-complaint or telephone: 0303 123 1113.
We may update this privacy policy from time to time by publishing a new version on our website. When we make significant changes, we will notify you via email or through our services and may require your explicit consent where required by law. For changes that do not require explicit consent, your continued use of our website following the posting of changes to this policy will be deemed your acceptance of those changes. For changes affecting medical information or requiring consent, we will seek your explicit approval before implementing such changes.
You can contact us by post, email, or telephone for any matters relating to this privacy policy, your personal information, or to exercise your rights under data protection law. For urgent clinical data matters or immediate access requirements to your medical records, please contact our dedicated Clinical Data Protection Team available 24/7. For routine queries about your clinical records or case management data, your assigned case manager will be your first point of contact.
Our contact details are shown below:
We are proud to be an official supporter of the Institute of Registered Case Managers
Useful links
What do our clients & referrers say?
© 2025 Ben Holden Ltd Registered in England & Wales - Company No. 6891396. ICO Registration no. Z1810108
Privacy Policy | Terms and Conditions | Vacancies | Website Design and Development Capsule Marketing
