1. Who we are

Patient Support Pathway CIC is a community interest company registered in England and Wales under company number 17248226.

Our registered office is:

Patient Support Pathway CIC
55 Spring Gardens
Manchester
M2 2BY
United Kingdom

For the purposes of UK data protection law, Patient Support Pathway CIC is the data controller responsible for the personal information covered by this Privacy Policy.

You can contact us about privacy or the use of your personal information at:

Email: enquiries@patientsupportpathway.co.uk
Telephone: 0330 441 5493
Website: Our Services – Patient Support Pathway

2. The information we may collect

The personal information we collect will depend on how you interact with us and the support you request. It may include:

• your name, address, telephone number, email address and other contact details;

• your date of birth and basic identification information;

• information about your injury, health, treatment, rehabilitation, care requirements or disability;

• information about how your injury affects you and your family;

• information about your financial circumstances, benefits, care funding or other sources of support;

• details of your family members, representatives, carers or other people involved in supporting you;

• information about services, organisations or activities that may be relevant to you;

• correspondence, call notes, portal messages and records of our contact with you;

• information you provide through forms, questionnaires or the Patient Support Pathway Portal;

• your communication and marketing preferences;

• technical information about your use of our website, such as your IP address, browser, device and cookie identifiers; and

• any other information you choose to provide when contacting us.

Please avoid giving us personal information about another person unless you have their permission to do so or are legally authorised to act on their behalf.

3. Health and other sensitive information

Information concerning your physical or mental health is classed as special-category personal data and receives additional protection under data protection law.

Because our work supports people affected by serious and life-changing injuries, you may choose to give us health, care or disability information so that we can understand your circumstances and identify potentially relevant support.

Where required, we will ask for your explicit consent before collecting, using or sharing this information. We may also process sensitive information where this is necessary:

• to establish, exercise or defend legal claims;

• to protect someone’s vital interests where they are physically or legally unable to give consent;

• for the provision or management of health or social care where the relevant legal requirements are satisfied; or

• for another purpose permitted by the UK GDPR and Data Protection Act 2018.

You can withdraw your consent at any time by contacting us. Withdrawal will not affect processing that took place before your consent was withdrawn. It may, however, affect our ability to continue providing certain forms of support.

4. How we obtain your information

We may obtain personal information:

• directly from you;

• from a relative, carer or representative contacting us on your behalf;

• from a solicitor, healthcare professional, case manager, charity, support organisation or other referral partner, where there is an appropriate basis for sharing it with us;

• through the Patient Support Pathway Portal;

• through website forms, email, telephone, post or live chat;

• when you subscribe to communications or attend an event;

• from organisations providing services to us; and

• automatically when you use our website, through cookies and similar technologies.

If someone refers you to us, we will take reasonable steps to make sure you understand how we will use your information.

5. How we use your information

We may use personal information to:

• respond to enquiries and requests for help;

• understand your circumstances and the support you may need;

• create, maintain and review a personalised support or recovery plan;

• identify and explain potentially relevant services, funding, benefits, care, legal support, rehabilitation, community activities or other sources of assistance;

• introduce or refer you to another organisation, where you have agreed to this;

• communicate with you, your authorised representative and organisations involved in supporting you;

• operate and administer the Patient Support Pathway Portal;

• maintain appropriate records of the support and information provided;

• manage our services and relationships with partner organisations;

• handle feedback, concerns and complaints;

• send newsletters or other communications where you have requested them or where otherwise permitted by law;

• improve our website, portal, communications and services;

• produce anonymised or aggregated statistics about the use and effectiveness of our services;

• keep our systems, users and organisation secure;

• prevent and investigate fraud, misuse or unlawful activity; and

• comply with our legal, regulatory and contractual obligations.

We will not use identifiable health information for marketing without your explicit consent.

6. Our lawful bases

We only use personal information where we have a lawful basis for doing so. Depending on the circumstances, we may rely on:

Consent: where you have given us clear permission to use your information for a particular purpose, such as receiving marketing communications or sharing your details with a third party.

Contract: where processing is necessary to provide a service you have requested or to take steps at your request before providing that service.

Legal obligation: where we need to use information to comply with a legal or regulatory requirement.

Vital interests: where processing is necessary to protect someone’s life and that person is unable to provide consent.

Legitimate interests: where processing is necessary for our legitimate operational interests or those of another organisation, provided those interests are not overridden by your rights and interests. This may include responding to enquiries, administering our services, improving our website, maintaining security and managing our relationships with service providers and referral partners.

Where we rely on legitimate interests, we consider the purpose, necessity and potential effect of the processing before proceeding.

7. Sharing your information

Depending on the support you request, we may share relevant information with:

• organisations providing care, rehabilitation, therapy or case-management services;

• benefits, funding, advocacy and community-support organisations;

• legal advisers or other professional service providers;

• healthcare professionals or services;

• organisations operating local activities or peer-support services;

• a family member, carer or representative authorised by you;

• organisations that provide our website, portal, hosting, communications, IT, security or administrative systems;

• professional advisers, insurers, auditors and regulators; and

• law-enforcement agencies, courts or public authorities where disclosure is required or permitted by law.

We will not normally send your personal information to an external support provider or professional without explaining the proposed referral and obtaining your permission.

We only share information that is reasonably necessary for the relevant purpose. Where another organisation receives your information as an independent data controller, its own privacy policy will explain how it uses that information.

We do not sell personal information.

8. Service providers

We use trusted organisations to operate aspects of our website, portal and services. These organisations may process personal information on our behalf.

Our providers may include organisations supplying:

• website and portal hosting;

• cloud storage and business software;

• email and telecommunications;

• website analytics;

• online forms and live-chat facilities;

• IT support and cybersecurity; and

• professional and administrative services.

Where an organisation acts as our data processor, it is only permitted to use personal information in accordance with our instructions and must protect it appropriately.

9. International transfers

Some service providers may store or process information outside the United Kingdom.

Where personal information is transferred internationally, we will make sure an appropriate safeguard is in place. This may include an adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses or another safeguard permitted by data protection law.

You can contact us for more information about the safeguards applied to a particular transfer.

10. How long we keep your information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including the provision of support and the satisfaction of legal, regulatory, insurance, accounting and reporting requirements.

Retention periods depend on:

• the nature and sensitivity of the information;

• the support or service provided;

• how long we remain in contact with you;

• any applicable legal limitation period;

• our legal and regulatory obligations; and

• whether the information may be needed to establish, exercise or defend a legal claim.

When information is no longer required, we will securely delete or anonymise it.

You can contact us if you would like further information about the retention period that applies to your records.

11. Marketing communications

We may send you newsletters, updates or information about our work where you have asked to receive them or where we are otherwise permitted to do so.

You can unsubscribe at any time by:

• using the unsubscribe link in the communication;

• emailing enquiries@patientsupportpathway.co.uk; or

• contacting us on 0330 441 5493.

Withdrawing from marketing communications will not prevent us from contacting you about support you have requested or another non-marketing matter.

12. Cookies and website analytics

Our website uses cookies and similar technologies. These may be necessary for the website to operate or may help us understand how visitors use the site and improve its performance.

Where required, we will ask for your consent before placing non-essential cookies on your device.

Further information about the cookies we use, their purposes and how you can change your preferences is available in our Cookie Policy.

13. Security

We use appropriate technical and organisational measures to protect personal information against loss, misuse, unauthorised access, alteration or disclosure.

These measures may include access controls, secure systems, staff training, encryption, backups and regular reviews of our security arrangements. Access to personal information is limited to people who reasonably need it for their work.

Although we take reasonable precautions, no website, portal or electronic communication system can be guaranteed to be completely secure.

14. Your data protection rights

Depending on the circumstances, you may have the right to:

• ask for confirmation that we process your personal information;

• obtain a copy of the personal information we hold about you;

• have inaccurate information corrected and incomplete information completed;

• ask us to delete your personal information;

• ask us to restrict how we use your information;

• object to processing based on legitimate interests;

• object at any time to the use of your information for direct marketing;

• receive certain information in a portable, machine-readable format;

• ask for information to be transferred to another organisation;

• withdraw consent where we rely on consent; and

• challenge certain decisions made solely through automated processing.

These rights are not absolute and may not apply in every situation. For example, we may need to retain certain information to comply with a legal obligation or deal with a legal claim.

We may ask you for information to confirm your identity before responding to a request. We will normally respond within one month, although data protection law permits additional time in certain circumstances.

You will not normally have to pay a fee to exercise your rights. We may, however, charge a reasonable fee or decline a request where it is manifestly unfounded or excessive.

To exercise any of these rights, contact us using the details in section 1.

15. Automated decision-making

We do not make decisions about you based solely on automated processing where those decisions would have a legal or similarly significant effect.

16. Information about children

Our services may support children and their families following a serious injury. Where we process information about a child, we will take particular care to protect it and will consider the child’s age, understanding, best interests and the authority of the person providing information on their behalf.

Our website and portal are not intended to invite children to submit personal information without the involvement of a parent, guardian or appropriately authorised adult.

17. Other websites

Our website may contain links to websites operated by other organisations. We are not responsible for the privacy, security or content of those websites.

We recommend reading the privacy policy of any third-party website before providing it with personal information.

18. Changes to this policy

We may amend this Privacy Policy when our services, systems or legal responsibilities change.

The latest version will be published on our website with its updated date. Where a change materially affects how we use personal information, we will take reasonable steps to bring it to the attention of the people affected.

19. Complaints

If you have a concern about how we use your personal information, please contact us first so that we have an opportunity to address it.

You also have the right to complain to the Information Commissioner’s Office:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113
Website: Make a complaint

If you live outside the United Kingdom, you may also be entitled to contact the data-protection authority in the country where you live.