Privacy Notice
What personal information Progressive Recovery Care collects, why we use it, who we share it with, and the rights you have over it.
DRAFT — NOT APPROVED. Do not publish to the live domain.
PRC’s organisational details, the categories of information handled, the clinical record system and the confidentiality limits set out below are taken from PRC’s approved Confidentiality Policy (v1.0, effective June 2026). The retention schedule follows the NHS Records Management Code of Practice.
One section is still incomplete: the full list of suppliers who handle information on PRC’s behalf. It is marked below and will be completed before this notice is relied upon.
1. Who we are
Progressive Recovery Care (PRC) Group LTD is the data controller for the personal information described in this notice.
Registered in England and Wales, company number 15768666.
Registered office and appointment address: Unit F28, Moulton Park Business Centre, Redhouse Road, Northampton, NN3 6AQ. In-person appointments take place here, by arrangement only.
Registered with the Care Quality Commission, provider ID 1-24593064011.
PRC is an independent mental health and neurodevelopmental service for people aged 4 to 65 located in England. Appointments are provided online across England and in person at PRC’s Northampton office.
Data protection contact. PRC’s Data Protection Lead is Ben Tabi Ebarebesem, Director and CQC Contact Person, who is responsible for decisions about how PRC uses and protects personal information. Data protection enquiries, including requests to see your information, should be sent to dataprotection@progressiverecoverycare.co.uk.
If you are not satisfied with how PRC has handled your information, you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint (opens in a new tab), or by calling 0303 123 1113. You are not required to raise it with PRC first, though we would rather have the chance to put it right.
2. Information we collect
- Personal details — name, date of birth, contact details, NHS number and GP details.
- Clinical information — assessments, diagnoses, therapy notes, medication records and risk assessments.
- Safeguarding information, where a concern arises.
- Enquiry and booking information you provide through this website or by telephone or email.
- Correspondence between you and PRC.
- For workplace services, information about your role and working arrangements.
Health information is special category data under the UK GDPR and is given additional protection in law.
Please do not send detailed medical information through this website’s forms or by ordinary email. Tell us enough to identify you and your enquiry, and PRC will arrange a secure route for anything sensitive.
3. Why we use it, and our lawful basis
PRC must have a lawful basis under UK GDPR for everything it does with your information, and a further condition for health information specifically. The basis depends on what the information is being used for:
Lawful basis: Article 6(1)(b) — performance of a contract; and for health information, Article 9(2)(h) — provision of health or social care and treatment.
Lawful basis: Article 6(1)(b) — steps taken at your request before entering into a contract.
Including safeguarding duties, Care Quality Commission requirements, and clinical record-keeping obligations.
Lawful basis: Article 6(1)(c) — legal obligation; with Article 9(2)(b) and 9(2)(h) as applicable to health information.
Where there is a safeguarding concern or a risk to life.
Lawful basis: Article 6(1)(d) — vital interests; with Article 9(2)(c) for health information.
PRC will only send marketing communications where you have given separate, specific consent. Consent for service communication about your care is kept separate from marketing consent, marketing consent is never pre-ticked, and you can withdraw it at any time.
Lawful basis: Article 6(1)(a) — consent.
4. Who we share it with
Information is only shared where there is a lawful basis and where sharing is necessary, proportionate and relevant. PRC will seek your consent where appropriate, but information may be shared without consent where required for safeguarding, prevention of serious harm, a legal obligation, your direct care, or a regulatory requirement.
- EMIS — the clinical record system PRC uses to hold your records.
- Your GP, where this is agreed with you or required for your care, including any shared-care proposal.
- A pharmacy, where a prescription is issued.
- Local authority safeguarding teams, the police or emergency services, where there is a safeguarding concern or risk to life.
- The Care Quality Commission, where a notifiable event applies.
- The Information Commissioner's Office, where a reportable data breach occurs.
PRC uses a small number of suppliers to run the service. Each handles information only on PRC’s instructions, under a written data processing agreement.
Confirmed in use: EMIS — the clinical record system holding your records.
[PLACEHOLDER — PRC TO SUPPLY] The remaining suppliers are not yet listed here: the video consultation platform, the email provider, the website and data hosting provider, the booking and CRM tools, and the payment processor. No payment processor is configured at the time of writing. These are identifications of real suppliers, so they are left blank rather than guessed. PRC should also confirm whether any of this data is stored outside the UK.
5. How long we keep it
PRC keeps records for the periods below, which follow the retention standards in the NHS Records Management Code of Practice. Each is a commitment PRC holds itself to.
Adult clinical records — 20 years after the date of last contact, or 8 years after death, reflecting the retention standard applied to mental health records.
Records for children and young people — until the person’s 25th birthday, or their 26th birthday if they were 17 at the last contact, or 8 years after death.
Enquiry and suitability-call information where care does not go ahead — 12 months.
Booking, invoicing and payment records — 7 years, to meet accounting requirements.
Complaint records — 10 years from closure.
Marketing consent records — for as long as consent is held, plus 2 years after withdrawal, as evidence that consent was properly obtained.
When a retention period ends, records are securely deleted or destroyed. The schedule is reviewed by PRC’s Data Protection Lead.
6. Your rights
Under the UK GDPR and the Data Protection Act 2018 you have the right to:
- Be informed about how your information is used — which is the purpose of this notice.
- Request a copy of the information PRC holds about you.
- Ask for inaccurate information to be corrected.
- Ask for information to be erased, in certain circumstances.
- Ask PRC to restrict how your information is used, in certain circumstances.
- Object to certain uses of your information.
- Request your information in a portable format, in certain circumstances.
- Withdraw consent at any time, where consent is the basis we rely on.
Some rights are qualified where PRC has a legal or clinical duty to retain records. To exercise any right, contact dataprotection@progressiverecoverycare.co.uk.
PRC will respond to a request within one month, which is the statutory maximum. Where a request is complex, or where you have made several, PRC may extend this by up to two further months and will tell you within the first month if it needs to. There is normally no charge.
7. Complaints about your information
If you are unhappy with how PRC has handled your information, please raise it with us first through our Complaints Procedure. You also have the right to complain to the Information Commissioner’s Office at any time — www.ico.org.uk, helpline 0303 123 1113.
PRC must supply: its ICO registration number. Organisations processing personal data are generally required to pay the data protection fee and register with the ICO. A registration number cannot be suggested here — it is a factual identifier issued by the ICO, and publishing an invented one would be a false statement about a regulatory relationship.