Privacy Statement
We are committed to handling all information safely, lawfully and transparently.
Who We Are
CPGB Ltd provides trauma‑informed consultancy, evaluation, co‑production, and (subject to future registration) regulated healthcare. Most of our work does not involve collecting personal data directly from individuals.
- •Email: england.cpgbltd@nhs.net
- •Phone: 01509 440175
We are the "Data Controller" for the personal information we collect. (For the majority of our work, we do not act as the Data Controller).
When We Collect Personal Data
We only collect or receive personal data in very limited circumstances:
A. Independent Care and Treatment Reviews (ICTRs)
When commissioned by NHS England or local authorities, we may receive full healthcare records and other personal information about an individual. This information is provided to us by the provider organisation — not collected directly from the individual.
B. Direct Enquiries
If you contact us by email, phone or through our website, we will use the information you provide to respond to your enquiry.
C. Private or Wellbeing Appointments (non‑regulated)
If you book a private appointment, we collect only the information needed to provide the service safely and appropriately.
We do not collect identifiable information during:
- •Focus groups
- •Co‑production activities
- •Consultancy
- •Evaluations
- •Stakeholder engagement
- •Community events
These activities use anonymous or non‑identifiable insights only.
What Information We Process
Depending on the context, this may include:
- •Contact details (only if you contact us directly)
- •Information provided during private aesthetic appointments
- •Healthcare records supplied by commissioners for ICTRs
- •Anonymous or aggregated insights from consultancy and evaluation work
We do not collect identifiable information from the public during research, engagement or focus groups (unless specifically asked to do so, and this will be explained at the point of gaining your consent).
How We Use Your Information
We use personal data only to:
- •Carry out Independent Care and Treatment Reviews
- •Provide private aesthetic or wellbeing services
- •Respond to enquiries
- •Meet legal or regulatory requirements
We do not use personal data for marketing.
Lawful Bases for Processing
We rely on the following lawful bases under UK GDPR:
- •Public task – for ICTRs commissioned by NHS England or local authorities
- •Legal obligation – where required by law (e.g., safeguarding)
- •Contract – for private appointments
- •Consent – where you choose to share information with us directly
For special category data (e.g., health information), we rely on:
- •Provision of health or social care
- •Public health purposes
- •Explicit consent
- •Safeguarding obligations
How We Store and Protect Your Information
We use secure, encrypted systems that meet NHS and UK GDPR standards.
- •ICTR records are stored only within approved secure environments
- •We do not store NHS data on personal devices
- •Access is strictly limited to authorised staff
- •All systems use multi‑factor authentication and encryption
Sharing Your Information
We only share information when:
- •Required by the commissioning body (e.g., NHS England) — this will be explained to you at the point of interaction
- •Necessary for your care (private appointments)
- •Legally required (e.g., safeguarding)
- •You have given explicit consent
We never sell your data.
How Long We Keep Your Information
- •ICTR records: retained only for the period required by the commissioning body
- •Private appointment records: kept in line with professional standards
- •Enquiry information: deleted once your enquiry is resolved
- •Anonymous insights: retained without identifiers
Your Rights
You have the right to:
- •Access your information
- •Request corrections
- •Request deletion (in some circumstances)
- •Withdraw consent
- •Object to processing
- •Request a copy of your data
Contact: england.cpgbltd@nhs.net
How to Raise a Concern About Your Data
If you are worried about how your information is being used, please contact us first.
You also have the right to contact:
Information Commissioner's Office (ICO)
www.ico.org.uk
This policy is reviewed annually. Last updated: March 2026.