CP NURSING PRIVACY NOTICE

A trading style of HPD Health Solutions Ltd

September 2026   Version 2.1

This notice explains how CP Nursing collects and uses personal data when you visit our website, contact us or receive healthcare navigation and general information from us. The Service is available only to adults aged 18 and over. It also explains our role where an insurer, employer or other organisation arranges access to the Service, and sets out your data protection rights.

1 Who We Are

CP Nursing is a trading style of HPD HEALTH SOLUTIONS LTD, a company registered in England and Wales under company number 12545489. Our registered office is Westhill House 2b Devonshire Road, Accounting Freedom, Bexleyheath, England, DA6 8DS. Our ICO registration reference is ZA759009.

For data protection questions or requests, email dataprotection@hpdhealthsolutions.com or write to Data Protection at the registered office above.

2 Our Role as Controller or Processor

Our role depends on who decides why and how personal data is used for a particular service.

HPD Health Solutions Ltd is normally a controller for data collected through the CP Nursing website, direct enquiries and complaints, our own service administration, security, legal obligations and professional record-keeping. We may also be a controller for health information used to provide healthcare navigation and general information where we determine why and how that information is processed.

Where an insurer, employer or other business client determines the purpose and essential means of processing and instructs us to provide a defined service, we may act as its processor. In that situation, the client's privacy notice is the primary notice for that processing, and requests about the client's use of your data may need to be referred to it.

We may also act alongside another organisation as an independent or joint controller. Where this applies, we will explain the arrangement and the appropriate point of contact.

3 The Personal Data We Collect

Depending on the service and our role, we may collect:

• identity and contact information, including name, postal address, email address, telephone number, date of birth and gender;
• eligibility, policy and referral information supplied by you or the organisation that arranged the service;
• health and wellbeing information that you choose to provide, including medical history, symptoms, navigation needs, relevant communications and service outcomes;
• appointment, service-use, correspondence, complaint and feedback records;
• information about an authorised representative, family member, carer or healthcare professional relevant to your request;
• website and device information, including IP address, browser and operating system, device identifiers, general location, referring pages, pages visited, downloads, search terms, timestamps, form submissions and error logs; and
• records needed for security, fraud prevention, audit, legal claims and compliance.

Health information is special category data and is subject to additional legal protections.

4 How We Obtain Personal Data

We collect information directly from you when you use our website, complete a form, communicate with us or take part in a service.

We may also receive information from an insurer, employer or other organisation that arranged the service; a referring clinician or healthcare provider; a family member, carer or authorised representative; service providers; and analytics or technical providers. We may receive limited information from public sources where necessary to verify identity, contact details or professional status.

If you provide information about another person, you must have authority to do so and should direct them to this notice where appropriate.

5 How and Why We Use Personal Data

We use personal data only where a lawful basis under Article 6 of the UK GDPR applies. Where we use health or other special category data, an additional condition under Article 9 must also apply.

Where we rely on legitimate interests, we consider whether the processing is necessary and whether your interests or rights override ours or those of the organisation arranging the service. Where we rely on consent, you may withdraw it at any time without affecting earlier lawful processing.

6 Health and Other Special Category Data

The Service is limited to healthcare navigation, advocacy and general information. We do not provide clinical triage, symptom assessment, diagnosis, prescribing or treatment, and we do not recommend or endorse Providers. We do not create or maintain clinical or medical records. Where you choose to provide health information so that we can respond to your navigation request, we generally rely on explicit consent under Article 9(2)(a) of the UK GDPR.

We may use another condition where necessary to protect vital interests, safeguard an individual, comply with a substantial public-interest requirement, or establish, exercise or defend legal claims. We document the condition that applies and limit access to people who need the information for their role.

7 Who We Share Personal Data With

We may share personal data where necessary and proportionate with:

• the insurer, employer or other business client that arranged the service, in accordance with the applicable roles, contract and privacy information;
• healthcare or care providers that you ask us to contact or to which you authorise us to send information;
• IT, hosting, communications, email-distribution, analytics, feedback and system-administration providers;
• professional advisers, auditors, insurers and bankers;
• HM Revenue and Customs, regulators, courts, law-enforcement agencies and other authorities where disclosure is required or permitted by law; and
• a purchaser, investor or successor organisation in connection with a proposed or completed corporate transaction, subject to appropriate safeguards.

Processors may use personal data only on documented instructions and must protect it. Other healthcare providers and professional advisers may act as separate controllers for their own professional services. We do not sell personal data.

8 International Transfers

Some technology or professional-service providers may store personal data outside the United Kingdom or permit access from another country. Before making a restricted transfer, we use a lawful transfer mechanism such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses or another permitted safeguard. We assess transfer risks and apply additional safeguards where appropriate.

Contact us if you want further information about an applicable transfer mechanism or how to obtain a copy of the relevant safeguard.

9 How Long We Keep Personal Data

We apply the retention periods below in accordance with our Data Retention and Disposal Policy. A period runs from case closure, account closure or the other event stated. We review records when the applicable period ends and securely delete or anonymise personal data that is no longer required.

We may retain a record for longer where this is required by law or is necessary for safeguarding, a regulatory investigation, a complaint, insurance or legal proceedings. Any extension is documented and limited to what is necessary. Electronic records are securely deleted or overwritten, paper records are cross-cut shredded or destroyed by an approved confidential-waste contractor, and backup copies expire through normal backup rotation. Genuinely anonymous information may be retained indefinitely because it can no longer identify an individual.

10 Security

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures include role-based access, authentication, system monitoring, confidentiality requirements, supplier due diligence, staff training and incident-management procedures appropriate to the risk.

No online system is completely secure. Please use appropriate device protection and notify us promptly if you suspect that information or account credentials have been compromised.

11 Cookies and Website Analytics

Our website and its service providers may use cookies and similar technologies. Strictly necessary technologies support security, network management, forms and other functions requested by the user. They may be used without consent where the law permits.

We will ask for consent before using Google Analytics or other non-essential analytics, advertising or tracking technologies. The website's cookie controls should allow you to accept, reject or change non-essential choices. Our Cookie Policy should identify the technologies, providers, purposes and durations in use.

12 External Links

Our website may contain links, plug-ins or connections to services operated by other organisations. Those organisations control their own services and privacy practices. Review their privacy notices before providing personal data. We are not responsible for the content or privacy practices of an external website merely because we link to it.

13 Your Data Protection Rights

Depending on the circumstances and our role, you may have the right to:

• be informed about how personal data is used;
• request access to your personal data and supporting information;
• ask us to correct inaccurate or incomplete data;
• ask us to erase data in certain circumstances;
• ask us to restrict processing in certain circumstances;
• object to processing based on legitimate interests and object at any time to direct marketing;
• receive certain data in a structured, commonly used and machine-readable format and ask for it to be transmitted to another controller;
• withdraw consent where processing relies on consent; and
• rights relating to decisions based solely on automated processing that produce legal or similarly significant effects.

These rights are not absolute and exemptions may apply. If we act only as a processor, we may refer the request to the relevant controller or assist it in responding.

We may request information needed to verify your identity and protect personal data from unauthorised disclosure. We normally respond within one month. The law permits more time for complex or numerous requests, in which case we will explain the extension. We do not usually charge a fee.

We do not currently make decisions about you based solely on automated processing that produce legal or similarly significant effects. We will provide the information required by law if this changes.

14 Adults and Authorised Representatives

The Service is available only to adults aged 18 and over. We do not knowingly provide the Service to, or collect personal data through the Service about, anyone under 18. An adult may use an attorney, carer or other authorised representative where appropriate. We will verify that person's authority and continue to respect the adult's own data protection rights, wishes and capacity.

15 Contact and Complaints

To exercise a right, update your information or raise a concern, email dataprotection@hpdhealthsolutions.com or write to Data Protection, CP Nursing, HPD Health Solutions Ltd at the address in section 1. Please provide enough information for us to identify the relevant records and understand your request.

You may complain to the Information Commissioner's Office at https://ico.org.uk/make-a-complaint/ or by calling 0303 123 1113. We would appreciate the opportunity to address your concern first, but you are not required to contact us before approaching the ICO.

16 Changes to This Notice

We may update this notice when our services, business-client arrangements, suppliers or legal obligations change. The current version will be made available with its effective date. We will provide additional notice where a change materially affects how we use personal data or your rights.