‍Privacy Notice

This Privacy Notice explains how Patient Advocate Ltd processes personal data when acting as a Data Controller in its own right and when acting as a Data Processor on behalf of clients. The applicable role depends on the purpose of the processing.

1. Capacity in Which We Act

The Company acts as a Data Controller when it determines the purposes and means of processing for its own business activities, including administration, client and supplier management, invoicing, compliance, legal matters, recruitment, and internal records. The Company acts as a Data Processor when processing personal data on behalf of clients in accordance with their documented instructions and our contractual commitments to clients.

In practice, the Company will usually act as a controller for its own corporate and commercial records, and as a processor when delivering services on behalf of an employer, insurer, intermediary, client organisation, or other contracted body.

2. Company and Contact Information

Patient Advocate Ltd:
‍Registered address: Thames House, Roman Square, Sittingbourne, Kent ME10 4BJ
Main trading address: 1 Cornhill, London EC3V 3ND.

Data Protection Officer: Julie Yarlett
Email: dataprotectionofficer@patientadvocate.co.uk
‍Telephone: +44(0) 20 7160 9735
Postal Address: 1 Cornhill, London EC3V 3ND

Representative: Michael Brown
Email: michaelb@patientadvocate.co.uk
‍Telephone: +44(0) 20 7160 9735
Postal Address: 1 Cornhill, London EC3V 3ND

3. Scope of this Notice

This Notice applies to personal data processed by the Company in the course of its business. Where the Company acts as a Data Processor, the relevant client or contracting organisation will usually be the Data Controller and will remain responsible for the relevant processing decisions and rights responses.

4. Categories of Personal Data

Personal data means any information relating to an identified or identifiable natural person under the UK GDPR and the Data Protection Act 2018.

This may include names, contact details, business information, referral information, and, where relevant, health or clinical data.

The main categories of personal data processed by the Company are set out below. Where the Company acts as a processor, the relevant controller is responsible for the lawful basis for processing special category data. Where the Company acts as a controller, it identifies the lawful basis itself.

5. Data Subject Rights

Individuals have rights under the Data Protection Legislation. Where the Company acts as Data Controller, those rights may be exercised directly by the Company. Where the Company acts as a Data Processor, rights should usually be exercised by the relevant controller, with the Company's assistance, where required.

The right to be informed about how personal data is collected and used.
The right to access personal data held about you.
The right to have inaccurate or incomplete personal data corrected.
The right to request erasure of personal data in certain circumstances.
The right to request restriction of processing in certain circumstances.
The right to object to processing in certain circumstances.
The right to withdraw consent where processing is based on consent, although this will usually need to be addressed to the relevant data controller.
The right to data portability in certain circumstances.
Rights relating to automated decision-making and profiling, where applicable.

To exercise your rights, contact the Company that acts as the controller. Where it acts only as a processor, you should contact the relevant controller first; the Company may refer to the request accordingly.

If you have concerns about the processing of your personal data, you may contact the Company's Data Protection Officer using the details below and, where relevant, the applicable data controller. You also have the right to complain to the Information Commissioner's Office.

6. Sources of Personal Data

The Company may collect personal data directly from individuals or receive it from clients, employers, referrers, service providers and other authorised third parties, depending on the service and the role in which it is acting.

The Company does not ordinarily collect data on criminal convictions or offences unless there is a clear legal basis and operational need to do so.

Category	Main Source	Typical Role
Identity and contact data	Individuals, clients, employers and forms.	Controller for business administration; processor for client service delivery.
Referral and case data	Clients, referrers, individuals and authorised third parties.	Processor.
Business, billing and account data	Clients, suppliers, organisations and finance records.	Controller.
Health and clinical data	Clients, referrers, individuals and care providers.	Processor.

In connection with case management services, the Company may process the following categories of personal data. In most cases, this processing is carried out on behalf of a data controller.

Data Type	Primary Use	Typical Role
Biographic data	Eligibility, administration and case handling.	Processor.
Clinical data	Assessment and delivery of health-related services.	Processor.
Referral data	Referral management, investigations and service coordination.	Processor.

7. Purposes and Lawful Processing

The lawful basis for processing depends on the capacity in which the Company is acting. As controller, the Company determines and records the lawful basis for its own processing. As a processor, it acts on the documented instructions of the relevant controller.

Activity	Data Category	Typical Role
Client, supplier and service administration	Business, contact and billing data.	Controller.
Referrals and service enquiries	Contact, referral and correspondence data.	Controller at the initial enquiry stage, a processor for client service delivery.
Case management and health-related services	Identity, referral, health and clinical data.	Processor.
Compliance, audit and legal claims	Relevant records, correspondence and financial data.	Controller.

The Company processes personal data only for lawful and proportionate purposes. Where it acts as a controller, it processes data for specified and legitimate business purposes. Where it acts as a processor, it acts only on the controller's instructions, unless otherwise required by law.

Where the Company's role changes or more than one purpose applies, it will assess the capacity in which it is acting and apply the corresponding legal obligations.

The Company does not ordinarily carry out automated decision-making or profiling with legal or similarly significant effects.

Where the Company is required by law to process personal data beyond a controller's instructions or beyond its own stated purposes, it will do so only to the extent required by law.

8. Retention of Personal Data

Personal data will not be retained for longer than necessary. Retention depends on the purpose of processing, the Company's role, contractual requirements, legal obligations and regulatory expectations.

Data Type	Retention Approach
Health, clinical and referral data	Usually retained in line with client instructions, contracts and legal requirements.
General contact and identity data	Retained according to business need, service delivery requirements and legal obligations.
Business, billing and account data	Usually retained in line with finance, audit, tax and regulatory requirements.

9. Security, Storage and International Transfers

The Company stores and transfers personal data in accordance with the Data Protection Legislation and the role it is acting in. International transfers will take place only where appropriate safeguards apply, or the transfer is otherwise lawful.

The Company implements appropriate technical and organisational measures to protect personal data, including the following:

Limiting access to personal data to those employees, agents, contractors and other third parties who have a legitimate need to know and ensuring that they are subject to appropriate duties of confidentiality.
Maintaining procedures for dealing with personal data breaches, including notification to the relevant data controller and, where the Company acts as a controller or is otherwise legally required to do so, notification to the Information Commissioner's Office and affected individuals.

10. Disclosure of Personal Data

The Company may disclose personal data to service providers, referral partners, professional advisers, sub-processors and public authorities where necessary for service delivery, business administration, legal compliance or legal claims, subject to appropriate safeguards.

If the Company sells, transfers or reorganises all or part of its business, personal data may be transferred where this is lawful and appropriate safeguards are maintained.
In some limited circumstances, the Company may be legally required to share personal data, including where this is necessary to comply with legal obligations, court orders or requests from public authorities.

11. Access Requests and Other Rights Requests

Where the Company acts as controller, you may contact it directly to make an access request or exercise other rights. Where it acts only as a processor, you should usually contact the relevant controller first.

If a request is sent to the Company, it will assess the capacity in which it is acting and respond or redirect the request as appropriate.

Requests are usually free of charge, although a reasonable fee may be charged where permitted by law.

Responsibility and timescales depend on whether the Company is acting as a controller or a processor in relation to the relevant processing.

12. Contact Details

Questions about this Notice or the processing of your personal data may be directed to the Company using the details below, for the attention of Julie Yarlett.

Email address: dataprotectionofficer@patientadvocate.co.uk

Telephone number: +44(0) 20 7160 9735.

Postal Address: 1 Cornhill, London EC3V 3ND.

13. Complaints to the Information Commissioner's Office

If you are dissatisfied with the way your personal data has been processed, you may complain to the Information Commissioner's Office.

Address:
‍Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113

14. Changes to this Notice

The Company may amend this Notice from time to time to reflect changes in law, guidance, services or business operations.

Updates to this Notice will be made available on the Company website.

Last updated: July 2026.