Privacy Policy.

Privacy Policy For Peach Care Services.

Last Updated: 1 April 2026

At Peach Care Services (“we”, “us”, “our”), we are committed to protecting and respecting your privacy. As a regulated health and social care provider, we understand that the personal and health information entrusted to us is highly sensitive.

This Privacy Policy explains how we collect, use, store, and share your personal data in strict accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the guidelines set out by the Information Commissioner’s Office (ICO).

1. Who We Are (The Data Controller)

Peach Care Services operates as the “Data Controller” for the personal information we gather. This means we are legally responsible for deciding how and why your data is used. We are registered with the Information Commissioner’s Office (ICO), the UK’s independent authority set up to uphold information rights.

2. The Information We Collect

We collect and process various categories of personal data depending on your relationship with us (e.g., as a client, family member, employee, or website visitor). This includes:

  • Standard Personal Data: Names, addresses, dates of birth, telephone numbers, and email addresses.

  • Financial Data: Bank details for billing purposes or staff payroll.

  • Employment Data: CVs, DBS check results, right-to-work documentation, and training records (managed via our Peach Pro platform) for staff and applicants.

  • Special Category Data (Highly Sensitive): Health records, medical history, medication requirements, care plans, and safeguarding information necessary to provide safe and effective care.

  • Technical Data: IP addresses, browser types, and cookie data when you interact with our website (peachcareservices.com).

3. Our Lawful Basis for Processing Your Data

Under UK GDPR, we must have a valid lawful basis to process your information. We rely on the following:

  • Contractual Necessity: To fulfil our contract to provide care services to you, or an employment contract with our staff.

  • Legal Obligation: To comply with statutory requirements, such as HMRC reporting, employment laws, and health and safety regulations.

  • Vital Interests: In emergency situations, we may need to share your medical data with emergency responders to protect your life.

  • Legitimate Interests: To run our business effectively, improve our website, and send relevant service updates.

  • Consent: For specific activities, such as sending marketing newsletters via Mailchimp, which you can opt out of at any time.

Processing Special Category (Health) Data: When we process your sensitive health or safeguarding data, we do so under the additional UK GDPR condition that it is strictly necessary for the provision of health or social care and the management of health or social care systems.

4. Data Sharing and Regulators (CQC & Ofsted)

We treat your data with the utmost confidentiality. We will never sell your personal data. However, to ensure the highest standards of care and to comply with the law, we may share your data with:

  • The Care Quality Commission (CQC): As our adult social care regulator, the CQC has statutory powers to access our records (including care plans and staff files) during inspections to ensure we are meeting fundamental standards of quality and safety.

  • Ofsted: For services relating to younger individuals, Ofsted may require access to our records to ensure compliance with safeguarding and childcare regulations.

  • Local Authorities and the NHS: We frequently collaborate with commissioning Local Authorities, GPs, district nurses, and social workers to coordinate your care and report safeguarding concerns.

  • Trusted Third-Party Processors: Secure IT providers, secure cloud storage hosts, and communication platforms (like Mailchimp) that are legally bound by Data Processing Agreements to protect your data.

5. Data Security and Retention

We have implemented strict physical, electronic, and managerial security measures to prevent your personal data from being accidentally lost, used, altered, or accessed without authorisation.

We only retain your personal data for as long as necessary to fulfil the purposes for which it was collected. Statutory retention periods apply in the care sector; for example, adult care records are typically retained for 8 years after the conclusion of care, while records relating to children and young people may be retained significantly longer, in line with legal and Ofsted requirements.

6. Your Rights Under UK GDPR

You have robust rights regarding your personal information, including:

  • The Right of Access: You can request a copy of the data we hold about you (a Subject Access Request).

  • The Right to Rectification: You can ask us to correct inaccurate or incomplete data.

  • The Right to Erasure (“Right to be Forgotten”): You can request that we delete your data, provided there is no overriding legal or regulatory requirement to retain it.

  • The Right to Restrict Processing: You can ask us to pause the processing of your data in certain scenarios.

  • The Right to Object: You can object to us processing your data for direct marketing purposes.

7. Contact Us and the ICO

If you have any questions about this Privacy Policy, wish to exercise your rights, or want to update your communication preferences, please contact our Data Protection Officer:

  • Email: info@peachcareservices.com

  • Address: Suite 621, Milton Keynes Business Centre, Foxhunter Drive, Linford Wood, Milton Keynes, MK14 6GD

  • Phone: 01908 686 869

How to Complain to the ICO: We hope we can resolve any concerns you may have directly. However, if you are unhappy with how we have handled your personal data, you have the right to lodge a formal complaint with the Information Commissioner’s Office (ICO).