Privacy notice

Last updated: 9 September 2026

This notice explains how Care Sector Services Ltd ("we", "us") collects and uses personal information. We handle personal data, including health and social-care information about the people we are asked to assess, in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Who we are

Care Sector Services Ltd is the data controller. We are a company registered in England & Wales (company number 17362994) with our registered office at 82a James Carter Road, Mildenhall, Bury St Edmunds IP28 7DE. We are registered with the Information Commissioner's Office (ICO) as a data controller, reference ZC211767. Questions about this notice or about your information should be sent to info@caresectorservices.co.uk or to the registered office address above, marked "Data protection".

Information we collect

• Enquiries. When you contact us by email, phone or the enquiry form we collect your name, organisation (if any), contact details and a brief description of what you need. We ask you not to include health details or the personal details of another person at this stage.
• Instructions. If you instruct us, we collect the information needed to carry out the work agreed with you: details of the instructing party, the person to be assessed or advised, the decision or matter in question, relevant background documents, and what we observe and record during any visit or assessment. This will usually include health and social-care information, which is "special category" data.
• Business records. Correspondence, engagement terms, invoices and payment records.

We collect this information from you, from the instructing solicitor or organisation, from the person being assessed and those who support them, and from records supplied to us for the purpose of the instruction. We do not buy personal information from third parties.

Why we use it and our lawful basis

• To respond to your enquiry — our legitimate interest in running the business and answering people who contact us (Article 6(1)(f)).
• To carry out an instruction — performance of a contract with you, or steps taken at your request before entering one (Article 6(1)(b)); and, where the instruction comes from a solicitor or organisation, our legitimate interests and theirs in providing the service (Article 6(1)(f)).
• Health and social-care information — we rely on one of the following conditions for special category data, depending on the instruction: your explicit consent, or the explicit consent of the person the information is about, where they are able to give it (Article 9(2)(a)); or the information being necessary for the establishment, exercise or defence of legal claims, or whenever a court is acting in its judicial capacity (Article 9(2)(f)), which applies to assessments and reports prepared for Court of Protection proceedings, lasting power of attorney matters and similar. Where consent is the basis, it can be withdrawn at any time, although that may mean we cannot complete the work.
• To keep records, invoice and comply with the law — our legal obligations (Article 6(1)(c)), including tax, accounting and insurance requirements, and our legitimate interest in maintaining professional records that may later be needed to explain or defend our work.

We do not use your information for marketing without asking you first, and we do not make automated decisions about you.

Who we share it with

Only where necessary for the purposes above: the person or organisation instructing us (for example the instructing solicitor); the Court of Protection, the Office of the Public Guardian or another body where the report or assessment is prepared for them or where we are required to provide it; and the suppliers who provide our email, document storage, accounting and IT services under contracts that require them to protect your information. We do not sell personal information, and we do not enter identifiable client information into artificial-intelligence tools.

Where it is stored

Your information is stored on our secure systems and with our IT suppliers. Some suppliers may process data outside the United Kingdom; where they do, we rely on the UK's adequacy regulations or on approved contractual safeguards. This website is hosted by Netlify and loads its typefaces from Google Fonts; when you visit, those services receive your device's IP address in order to deliver the page. We do not set analytics or advertising cookies.

How long we keep it

• Enquiries that do not lead to an instruction: 12 months from our last contact, then deleted.
• Instruction files, assessments and reports: 7 years from completion of the instruction, because reports may need to be explained or relied upon later and our insurers require records to be kept, then securely destroyed.
• Invoices and accounting records: 6 years after the end of the financial year, as required by tax law.

Your rights

You have the right to ask for a copy of the personal information we hold about you, to have inaccurate information corrected, to ask for information to be deleted or its use restricted, to object to processing based on legitimate interests, to receive information you provided to us in a portable format where the basis is consent or contract, and to withdraw consent where consent is the basis. Some rights are limited where information forms part of a report prepared for court or where we are required to keep it. To exercise any right, contact us at the address above; we will respond within one month.

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Changes to this notice

We review this notice at least once a year and whenever our services change. The date at the top shows when it was last updated.