Privacy policy

This policy is issued by Oria Care Ltd, trading as Oria Care (referred to as "Oria Care", "we", "us" and "our"), a company registered in England and Wales under company number 14754887, with its registered office at 3 Brindley Place, Birmingham, B1 2JB.

We are registered with the Care Quality Commission, including specialist registration for the treatment of disease, disorder or injury, and we deliver complex care and supported living for people who have sustained catastrophic or complex injury.

For the personal data described in this policy, Oria Care is a data controller. We are registered with the Information Commissioner's Office under registration reference ZB624539.

This policy explains how we collect, use, share and protect personal data. It applies to visitors to this website and to people whose personal data we handle in the course of delivering care and support. We are committed to handling personal data lawfully, fairly and transparently, and to the high standards expected when supporting people affected by serious injury.

This policy covers personal data we handle as a controller, including information about: visitors to our website; our care workers and applicants; the people we support (our "service users") and their families, deputies, attorneys and other representatives; and the professionals who refer to us or work with us, including case managers, solicitors, insurers, deputies and NHS bodies.

Delivering care usually involves more than one organisation. Oria Care is the controller for care delivery records. Our care workers, whether employed or engaged on a self-employed basis, handle personal data under our authority and instructions as part of our workforce; they are not independent controllers of care records.

Referrers and funders, such as case managers, insurers, solicitors, deputies and NHS bodies, are separate controllers in their own right, and when we share information with them for their own purposes we do so on a controller to controller basis. Oria CM Ltd, a company in our group, may refer clients to us; that sharing is governed by our intra-group data sharing protocol. Our technology and service suppliers act as our processors and handle personal data only on our written instructions.

• Website visitors and business contacts: contact details, information you give us when you make an enquiry or referral, by email, WhatsApp or through Oria One, and technical information collected through cookies (see section 11).
• Care workers and applicants: identity, contact and right to work information; Disclosure and Barring Service information and other safer recruitment and compliance information; training and e-learning records; rostering, availability and payroll information.
• Service users and their representatives: to deliver safe care we may process the following, including special category data: identity and contact details, and the same for family members, carers, deputies, attorneys and other representatives; health and care information, including diagnoses, assessments, care plans, daily care notes, medication administration records, and progress; incident and safeguarding information; information about mental capacity and about any deputyship, lasting power of attorney or best interests arrangements; information about the referral, instruction or funding arrangement under which care is provided; financial and accommodation information relevant to care planning; photographs, video and voice recordings made for care planning or progress records; and, where relevant, information revealing racial or ethnic origin, religious beliefs, or other special category data needed to provide appropriate and culturally sensitive care.

Health data, and information about how care is delivered, is sensitive. We only collect what we need to provide and assure safe care.

Directly from you; from the referrer or funder who instructs us, including case managers (within our group and external), insurers, solicitors, deputies and NHS bodies, or a self-funding service user or their representative; from healthcare, social care and rehabilitation professionals involved in a person's care; from our care workers in the course of delivering care; and from verification services when confirming a worker's right to work or completing DBS checks.

Where we rely on consent, you can withdraw it at any time and we will explain what that means for the service. Where we rely on legitimate interests, we have weighed our interests against the rights of the people concerned. The recognised legitimate interests we use, such as safeguarding vulnerable individuals, are bases introduced by the Data (Use and Access) Act 2025.

Many of the people we support may, at times, lack the mental capacity to make decisions about their own personal data. Where that is the case, we work with the appropriate decision maker, such as a court appointed deputy, an attorney under a lasting power of attorney, or those making decisions in the person's best interests under the Mental Capacity Act 2005. Where consent is the appropriate basis and the person cannot give it themselves, we look to the proper representative, and we record the basis on which we are acting.

Our website is intended for professionals and other adults. We may deliver care to children and young people, and we handle their information with particular care, including the extended retention protections in section 8.

We share personal data only where necessary and with appropriate safeguards. Recipients can include: the professionals involved in a person's care; the referrer, funder or instructing party, to the extent appropriate to their role; Oria CM Ltd within our group, under our intra-group data sharing protocol; the Care Quality Commission, safeguarding authorities, regulators, courts and legal advisers, where required or permitted by law; our professional advisers, auditors and insurers; and technology and service suppliers who process personal data on our behalf under written contract, including Oria One, the system our group builds and runs to receive referrals and run packages, and our care records system, rostering, workforce compliance, e-signature, communications, website and consent management providers.

We do not sell personal data. Where a supplier processes personal data on our behalf, we put in place a written contract meeting Article 28 of the UK GDPR. Where we share information with another organisation for its own purposes, we do so as separate controllers.

We aim to keep personal data within the United Kingdom. Where a supplier processes personal data outside the UK, we make sure an appropriate safeguard is in place, such as UK adequacy regulations or the International Data Transfer Agreement or Addendum, so that the data remains protected to UK standards.

If you contact us on WhatsApp, that conversation is also subject to WhatsApp's own terms and privacy policy. Please keep detailed health information for a phone call, email or a referral through Oria One.

When personal data is no longer needed, we delete or anonymise it securely.

We use appropriate technical and organisational measures to protect personal data. Care records are held in a purpose-built care records system with role-based access and individual worker logins. Our measures include access controls, staff training, a workforce communications policy that keeps care information out of personal messaging channels, device rules for workers, and contractual controls over our suppliers. We keep these measures under review.

We do not currently use artificial intelligence tools in the delivery of care, and no decision about your care is made by automated means. If we introduce technology that changes this, we will assess it before use, update this policy, and explain your right to ask for human review of any decision with legal or similarly significant effects.

Our website uses cookies and similar technologies, managed through our consent management platform. Some are strictly necessary for the site to work or keep it secure, and for these we do not ask for consent. We use some low risk functional and analytics cookies with clear information and an easy way to opt out, and we ask for consent before using any cookies that are not strictly necessary or low risk. You can manage your preferences at any time through our cookie settings, and our cookie policy explains each cookie we use.

Subject to certain conditions, you have the right to: ask for a copy of the personal data we hold about you; ask us to correct inaccurate or incomplete data; ask us to erase data in certain circumstances; ask us to restrict or object to certain processing; ask us to transfer certain data to another organisation; and withdraw consent at any time, where we rely on consent.

To exercise a right, contact us using the details in section 13. We will respond within the time limits set by law, and we may need to confirm your identity or clarify a complex request, in which case the time limit can be paused until we receive what we need. Where a person lacks capacity, a deputy or attorney can make a request on their behalf.

Oria Care, 3 Brindley Place, Birmingham, B1 2JB. Email: privacy@oria.care. Our group data protection lead, Dejan Kojic, is accountable for how we handle personal data.

If you are unhappy with how we have handled your personal data, you have the right to complain to us directly, and we will acknowledge your complaint within 30 days and respond without undue delay. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, or by post at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. You do not have to complain to us first, but it may help us put things right more quickly.

We may update this policy from time to time. When we make significant changes, we will take reasonable steps to bring them to your attention. The date at the top of this policy shows when it was last updated.