Privacy notice

Who we are

CWS Care Quality Consultancy, London, is the data controller for enquiries and business contact information. Contact: info@cwscarequalityconsultancy.co.uk or 020 7965 7196.

Where we review care records on behalf of a provider, that provider is the controller and we act as processor under a written agreement.

What we collect and why

Enquiries. Name, organisation, email, telephone and what you tell us about your service. Legal basis: legitimate interests, in responding to a request you have made.

Clients. Contact and billing details, engagement records and correspondence. Legal basis: performance of a contract, and legal obligation for accounting records.

Care records shared for review. Information about the people you support, including health data. Legal basis: performance of our contract with you as controller. For special category data, Article 9(2)(h) UK GDPR, the provision of health and social care, and Article 9(2)(b) where safeguarding duties arise.

How records are handled

Care records are transferred only through an access-controlled folder provided to you, encrypted in transit and at rest. Access is restricted to named individuals and withdrawn at the end of the engagement. We do not accept care records as email attachments.

Our systems are protected by two-factor authentication. Data is stored within the United Kingdom or European Economic Area.

Who we share with

We do not sell data or share it for marketing. We use a small number of service providers acting under contract: Google (Workspace and Drive, document storage and email), Stripe (payment processing), and Netlify (website and enquiry forms). Each is bound by its own data processing terms.

We may disclose information where required by law or a regulator, or where safeguarding duties require a referral to a local authority or the Care Quality Commission.

How long we keep it

Enquiries that do not become engagements: twelve months. Client engagement records and reports: six years from the end of the engagement, to meet contractual and insurance requirements. Care records shared for review: returned or securely deleted within thirty days of the engagement ending, unless you ask us to hold them for longer in writing.

Your rights

You may request access to, correction of, or erasure of personal data we hold about you; object to or restrict processing; and request portability where applicable. Where we act as processor for a provider, requests from the people they support should be directed to that provider as controller, and we will assist them in responding.

We aim to respond within one month. If you are unhappy with how we have handled your data you may complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

Cookies

This website does not use tracking or advertising cookies.

Last updated August 2026.