What is data portability?

The right to data portability allows you to obtain and reuse a copy of your personal data for your own purposes or for us to send the information to a new provider on your behalf (where technically feasible). It allows you to move data, copy data and transfer data in a safe and secure way without affecting its usability.

Privacy notice.

Client privacy notice.

Introduction

This Privacy Notice is effective from 01 April 2026 and applies to all companies registered or trading under Oakdale Therapies Ltd, including Oakdale Centre CIC and BUSS®. For the purposes of this Notice, these entities are collectively referred to as "Oakdale".

We will update this Privacy Notice from time to time. When we do change the notice (in a significant way), we will post an update on our website.

Oakdale takes data protection and confidentiality very seriously. This privacy notice covers:

What a Privacy Notice is
What information we will collect and store about you
How we collect your personal information
For what purpose we will use your personal information
What happens if you fail to provide personal information
How changes of purpose will be managed
Why we might share your personal information with third parties
What type of third party service providers process your personal information
How we may share your personal information with third parties
How long we will use your information
How we store your personal information
Protection of your personal information
Accuracy of personal information
When might we transfer your information overseas
Access to personal information
Automated decisions
Data portability
Additional rights
Privacy questions

If you have any questions or concerns about this Privacy Notice or how we process your information, or if you would like to make a complaint about a possible data breach, please contact us:

Email: dpo@oakdalecentre.org

Postal address:
The Governance Team
Oakdale Group
49 Valley Drive
Harrogate
HG2 0JH

We take data security extremely seriously and all such communications are examined and replies issued where appropriate as soon as possible. If you are unsatisfied with the reply you receive, you may refer your complaint to the Information Commissioner's Office (ico.org.uk).

What is a Privacy Notice?

Oakdale is a 'data controller'. This means that we are responsible for deciding how we hold and use personal information about you. We are required under data protection legislation to notify you regarding how we hold and use your personal information.

Privacy Notice for clients receiving assessment, therapy and treatment by Oakdale

This notice applies to our clients receiving assessment, therapy and treatment by Oakdale. We may update this notice at any time but if we do so, we will provide you with an updated version of this notice available on our website as soon as reasonably practical. It is important that you read and retain this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information and what your rights are under data protection legislation.

We may collect, store and use the following categories of personal information about you:

Personal contact details such as:

Name
Title
Address
Telephone numbers
Personal email addresses
Contact preferences
Date of birth
Marital status and dependants
Next of kin and emergency contact details
National insurance number and NHS number
Bank or credit card details or other payment information
Identification information contained within your passport and/or driving licence or proof of address
Online identifiers or social media identifiers
Information about your status, nationality and residency

We may also collect, use and share 'aggregated data' such as statistical data for any purpose. Aggregated data could be derived from your personal information but is not considered personal information in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your 'usage data' to calculate the percentage of users accessing a specific website feature. However, if we combine or connect aggregated data with your personal information so that it can directly or indirectly identify you, we treat the combined data as personal information which will be used in accordance with this Privacy Notice.

We may also handle the following special categories of sensitive personal information:

Information about your race or ethnicity, religious, philosophical and moral beliefs, sexual life, sexual orientation and political opinions
Information about your physical and mental health, including any medical conditions
Identification information containing biometric data, such as a passport

1. How we collect your personal information

We may collect personal information directly provided by you or your legal representative at any time you are in contact with Oakdale and we may collect, store and use your personal information whilst you are engaged with Oakdale. We may also collect your personal information from third parties such as the NHS, commissioning authorities or through your private medical insurer (and for funding and/or payment for services received).

2. For what purpose we will use your personal information

In most cases, we will use your personal information to provide assessment, therapy, treatment or payment purposes. In rare cases, we may need to use your personal information to protect your (or someone else's) interests or if it is in the public interest for us to do so.

Oakdale and its affiliates may share this personal information with each other but will always use it in accordance with this Privacy Notice. We may also combine it with other information to provide and improve our services.

We will only use your personal information when the law allows us to. We will use your personal information in the following circumstances:

Where you have provided us with your consent
Where we need to comply with a legal obligation
Where it is necessary for legitimate interests pursued by us or a third party and your interests and fundamental rights do not override those interests

We may also use your personal information in the following situations, which are likely to be rare:

Where we need to protect your interests (or someone else's interests)
Where it is needed in the public interest or for official purposes

Some of the above grounds may overlap and there may be several grounds that justify our use of your information.

The situations in which we will use your personal information include:

Provide services to you
Facilitate settling of any applicable fees
Facilitate communications between your care providers
Helping us develop, operate, deliver, and improve the quality of the care we provide or, more generally, the type of services that we offer
Sending important notices to you or to those acting on your behalf, such as updates to your assessment, therapy & treatment plans or changes to our terms, conditions and policies. (Because this information is important to your interaction with Oakdale, you may not opt out of receiving these communications)
For security and health and safety purposes, such as use of our access systems
For internal purposes such as auditing, data analysis, and research to improve our services and our communication with you
To test our computer systems to improve our services to you, such as the software we use to store your health, social and care records to improve our services.

If you do not wish for your information to be used for these purposes, you can let us know that you wish to opt-out.

We process sensitive personal information for the following purposes:

To provide assessment, therapy, treatment and payment
Safeguarding reasons
For legal reasons, for example, to comply with health and safety obligations or to respond to requests for information from the police

We will not sell, share or give information to third parties for marketing purposes.

3. What happens if you fail to provide personal information

The personal information we collect is stored in a variety of electronic forms. Regardless, we have appropriate and adequate technical and administrative processes in place to make sure that all your information is kept secure.

4. How changes of purpose will be managed

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will publish an updated Privacy Notice on our website.

Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

5. Why might we share your personal information with third parties

We will share your personal information with third parties where required by law, where it is necessary to be able to provide you with assessment, therapy or treatment, to protect your interests (or someone else's interests) or where we have another legitimate interest in doing so.

6. What type of third parties service providers' process your personal information

'Third parties' includes third party service providers (including IT software providers), commissioning authorities (such as your GP, local authorities, provider trusts, local systems or private medical insurances) and other entities within Oakdale.

Third party service providers: Oakdale engages third party service providers to provide certain services to the business. These often support our IT software or systems (including online payment providers). In order for them to provide their services, we need to allow them to process personal data necessary for their tasks. When we use third party service providers to process personal data on our behalf, we require them to commit to compliance with relevant data protection legislation.

Commissioning authorities: If our services are commissioned for you by third parties (your GP, local authorities, provider trusts, local systems, private medical insurers etc.) we may be required to provide some information about you to them including your name and contact details such as: postal address, telephone number, email address and physical or mental health history for the purposes outlined above.

7. How we may share your personal information with third parties

We may also share your personal data with other third parties.

Sale or restructuring: We may need to share your personal information if a sale or restructuring of all or part of Oakdale occurs. In this situation we will, so far as possible, share anonymised data with the other parties before the transaction completes. Once the transaction is completed, we will share your personal data with the other parties if and to the extent required under the terms of the transaction.

Request from a regulator or otherwise to comply with the law. We may also share your personal information: (i) with a regulator; (ii) to comply with the law; or (iii) in other circumstances when we are legally permitted to do so. This may include making returns to HMRC and disclosures to any other regulatory bodies which have authority over Oakdale or our professional advisers (such as lawyers, auditors, regulators etc.), disclosures to shareholders such as directors' remuneration reporting requirements and to such third parties as we reasonably consider necessary in order to prevent crime.

8. How long we will use your information

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Details of retention periods for different aspects of your personal information are available in our retention policy which is available on the Oakdale intranet and can be requested at any point by any Oakdale client.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you. Once you are no longer a client of Oakdale, we will retain and securely destroy your personal information in accordance with our retention policy, applicable laws and regulations.

9. How we store your personal information

10. Protection of your personal information

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those of our employees, workers or contractors and other third parties who need to access it to provide services to you. They will only process your personal information on our instructions, and they are subject to a duty of confidentiality. Details of these measures may be obtained from the governance team at dpo@oakdalecentre.org.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

11. Accuracy of personal information

Oakdale makes it easy for you to keep your personal information accurate, complete, and up to date. If any of your information changes please let us know so that we can update our records.

12. When might we transfer your information overseas

We may transfer the personal information we collect about you to countries within the European Economic Area (EEA). There are adequacy regulations in respect of these countries. This means that the countries to which we transfer your data are deemed to provide an adequate level of protection for your personal information.

We may transfer personal information we collect about you to the United States of America or other parts of the world outside the UK where there has not been an adequacy decision. This means that these countries are not deemed to provide an adequate level of protection for your personal information. We will transfer your personal data to those countries in limited circumstances that include when a third party supplier (such as IT software supplier) has operations (or provides IT software support for example) in such a country and can only deliver their service to Oakdale by transferring your personal data to that country or because their IT infrastructure is structured in such a way that data is stored in those countries.

To ensure that your personal information does receive an adequate level of protection we put in place the following appropriate measures to ensure that your personal information is treated by those third parties in a way that is consistent with and which respects UK law on data protection: data protection agreements, technical and organisational measures, standard contractual clauses and binding corporate rules (where applicable). If you require further information about this or these protective measures, you can request more information from the data protection team at dpo@oakdalecentre.org.

13. Access to personal information

You are entitled to see what personal information we hold about you at any time. This Privacy Notice outlines the information we hold about you and why. If you wish to access your personal information, please contact us at dpo@oakdalecentre.org.

We are not required to process any request for access which is frivolous or vexatious, jeopardises or otherwise affects the privacy of others, is impractical, or for which access is not otherwise required by law. We will let you know in writing if any of these circumstances apply to your request.

14. Automated decisions

Automated decision making takes place when an electronic system uses personal information to make a decision without human intervention.

You will not be subject to decisions that will have a significant impact on you based solely on automated decision making, unless we have a lawful basis for doing so and we have notified you.

We do not envisage that any decisions will be taken about you using automated means, however, we will notify you in writing if this position changes.

15. Data portability

You may have a right to data portability under the UK General Data Protection Regulation (GDPR).

The right to data portability allows you to obtain and reuse a copy of your personal data for:

Your own purposes
For us to send the information to a new provider on your behalf (where technically feasible)

It allows you to move data, copy data and transfer data.

The right to data portability ensures that it is done in a safe and secure way without affecting its usability. However, it will only apply to information concerning you which you have provided to us and where it is held electronically (so does not include paper records).

You can make a data portability request verbally or in writing when we are processing your information:

By automated means and rely on your consent to use your personal data
When we use your data as part of a contract you have with us

We will ensure that we provide your information in a 'structured', 'commonly used' and 'machine-readable' format.

You can find further information on the Information Commissioner's Office website: https://ico.org.uk/your-data-matters/your-right-to-data-portability/

If you would like to make a data portability request please email dpo@oakdalecentre.org.

Please note that as part of the process we may be required to verify your identity.

We will aim to respond to your request within a month but may respond within a further 2 months if the request is complex or we have received a number of requests from you.

16. Subject Access Requests

You have a right of access under the UK General Data Protection Regulation (GDPR).

The right of access allows you to obtain confirmation that we are processing your personal data and to receive a copy of that personal data, together with certain supplementary information about how and why it is being used. This enables you to:

Understand how and why we use your personal data
Check that we are processing your data lawfully
Be aware of and verify the accuracy of the personal data we hold about you

The right of access applies to personal data relating to you that we hold in both electronic and paper records, subject to certain legal exemptions.

You can make a Subject Access Request verbally or in writing. If you would like to make a Subject Access Request, please email dpo@oakdalecentre.org. Please note that as part of the process we may be required to verify your identity before releasing personal data to you.

We will aim to respond to your request within one month. However, this timeframe may be extended by a further two months if the request is complex or if we have received a number of requests from you. If an extension is required, we will inform you.

You can find further information on Subject Access Requests on the Information Commissioner's Office website: https://ico.org.uk/your-data-matters/your-right-of-access/

17. Additional rights

You may also have the right to:

Object to processing of personal data that is likely to cause, or is causing, damage or distress
Prevent processing for the purposes of direct marketing
Object to decisions being taken by automated means
In certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed
Data portability

If you believe you have any of these additional rights or you wish to exercise them, please let us know.