This Privacy Notice is effective from 01 April 2026 and applies to all companies registered or trading under Oakdale Therapies Ltd, including Oakdale Centre CIC and BUSS® For the purposes of this Notice, these entities are collectively referred to as “Oakdale”.
We will update this Privacy Notice from time to time. When we do change the notice (in a significant way), we will post an update on our website.
Oakdale takes data protection and confidentiality very seriously. This privacy notice covers:
If you have any questions or concerns about this Privacy Notice or how we process your information, or if you would like to make a complaint about a possible data breach, please contact us:
Email: dpo@oakdalecentre.org
Postal Address:
The Governance Team
Oakdale Group
49 Valley Drive
Harrogate
HG2 0JH
We take data security extremely seriously and all such communications are examined and replies issued where appropriate as soon as possible. If you are unsatisfied with the reply you receive, you may refer your complaint to the Information Commissioner’s Office (ico.org.uk)
What is a Privacy Notice?
Oakdale is a ‘data controller’. This means that we are responsible for deciding how we hold and use personal information about you. We are required under data protection legislation to notify you regarding how we hold and use your personal information.
Privacy Notice For Clients Receiving Assessment, Therapy
and Treatment By Oakdale
This notice applies to our clients receiving assessment, therapy and treatment by Oakdale. We may update this notice at any time but if we do so, we will provide you with an updated version of this notice available on our website as soon as reasonably practical. It is important that you read and retain this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information and what your rights are under data protection legislation.
We may collect, store and use the following categories of personal information about you:
Personal contact details such as:
We may also collect, use and share ‘aggregated data’ such as statistical data for any purpose. Aggregated data could be derived from your personal information but is not considered personal information in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your ‘usage data’ to calculate the percentage of users accessing a specific website feature. However, if we combine or connect aggregated data with your personal information so that it can directly or indirectly identify you, we treat the combined data as personal information which will be used in accordance with this Privacy Notice.
We may also handle the following special categories of sensitive personal information:
We may collect personal information directly provided by you or your legal representative at any time you are in contact with Oakdale and we may collect, store and use your personal information whilst you are engaged with Oakdale. We may also collect your personal information from third parties such as the NHS, commissioning authorities or through your private medical insurer (and for funding and/or payment for services received).
In most cases, we will use your personal information to provide assessment, therapy, treatment or payment purposes. In rare cases, we may need to use your personal information to protect your (or someone else’s) interests or if it is in the public interest for us to do so.
Oakdale and its affiliates may share this personal information with each other but will always use it in accordance with this Privacy Notice. We may also combine it with other information to provide and improve our services.
We will only use your personal information when the law allows us to. We will use your personal information in the following circumstances:
We may also use your personal information in the following situations, which are likely to be rare:
Some of the above grounds may overlap and there may be several grounds that justify our use of your information.
The situations in which we will use your personal information include:
If you do not wish for your information to be used for these purposes, you can let us know that you wish to opt-out.
We process sensitive personal information for the following purposes:
We will not sell, share or give information to third parties for marketing purposes.
The personal information we collect is stored in a variety of electronic forms. Regardless, we have appropriate and adequate technical and administrative processes in place to make sure that all your information is kept secure.
We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will publish an updated Privacy Notice on our website.
Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
We will share your personal information with third parties where required by law, where it is necessary to be able to provide you with assessment, therapy or treatment, to protect your interests (or someone else’s interests) or where we have another legitimate interest in doing so.
‘Third parties’ includes third party service providers (including IT software providers), commissioning authorities (such as your GP, local authorities, provider trusts, local systems or private medical insurances) and other entities within Oakdale.
Third party service providers: Oakdale engages third party service providers to provide certain services to the business. These often support our IT software or systems (including online payment providers). In order for them to provide their services, we need to allow them to process personal data necessary for their tasks. When we use third party service providers to process personal data on our behalf, we require them to commit to compliance with relevant data protection legislation.
Commissioning authorities: If our services are commissioned for you by third parties (your GP, local authorities, provider trusts, local systems, private medical insurers etc.) we may be required to provide some information about you to them including your name and contact details such as: postal address, telephone number, email address and physical or mental health history for the purposes outlined above.
We may also share your personal data with other third parties.
Sale or restructuring: We may need to share your personal information if a sale or restructuring of all or part of Oakdale occurs. In this situation we will, so far as possible, share anonymised data with the other parties before the transaction completes. Once the transaction is completed, we will share your personal data with the other parties if and to the extent required under the terms of the transaction.
Request from a regulator or otherwise to comply with the law. We may also share your personal information: (i) with a regulator; (ii) to comply with the law; or (iii) in other circumstances when we are legally permitted to do so. This may include making returns to HMRC and disclosures to any other regulatory bodies which have authority over Oakdale or our professional advisers (such as lawyers, auditors, regulators etc.), disclosures to shareholders such as directors’ remuneration reporting requirements and to such third parties as we reasonably consider necessary in order to prevent crime.
We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Details of retention periods for different aspects of your personal information are available in our retention policy which is available on the Oakdale intranet and can be requested at any point by any Oakdale client.
To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you. Once you are no longer a client of Oakdale, we will retain and securely destroy your personal information in accordance with our retention policy, applicable laws and regulations.
The personal information we collect is stored in a variety of electronic forms. Regardless, we have appropriate and adequate technical and administrative processes in place to make sure that all your information is kept secure.
We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those of our employees, workers or contractors and other third parties who need to access it to provide services to you. They will only process your personal information on our instructions, and they are subject to a duty of confidentiality. Details of these measures may be obtained from the governance team at dpo@oakdalecentre.org.
We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.
Oakdale makes it easy for you to keep your personal information accurate, complete, and up to date. If any of your information changes please let us know so that we can update our records.
We may transfer the personal information we collect about you to countries within the European Economic Area (EEA). There are adequacy regulations in respect of these countries. This means that the countries to which we transfer your data are deemed to provide an adequate level of protection for your personal information.
We may transfer personal information we collect about you to the United States of America or other parts of the world outside the UK where there has not been an adequacy decision. This means that these countries are not deemed to provide an adequate level of protection for your personal information. We will transfer your personal data to those countries in limited circumstances that include when a third party supplier (such as IT software supplier) has operations (or provides IT software support for example) in such a country and can only deliver their service to Oakdale by transferring your personal data to that country or because their IT infrastructure is structured in such a way that data is stored in those countries.
To ensure that your personal information does receive an adequate level of protection we put in place the following appropriate measures to ensure that your personal information is treated by those third parties in a way that is consistent with and which respects UK law on data protection: data protection agreements, technical and organisational measures, standard contractual clauses and binding corporate rules (where applicable). If you require further information about this or these protective measures, you can request more information from the data protection team at dpo@oakdalecentre.org.
You are entitled to see what personal information we hold about you at any time. This Privacy Notice outlines the information we hold about you and why. If you wish to access your personal information, please contact us at dpo@oakdalecentre.org.
We are not required to process any request for access which is frivolous or vexatious, jeopardises or otherwise affects the privacy of others, is impractical, or for which access is not otherwise required by law. We will let you know in writing if any of these circumstances apply to your request.
Automated decision making takes place when an electronic system uses personal information to make a decision without human intervention.
You will not be subject to decisions that will have a significant impact on you based solely on automated decision making, unless we have a lawful basis for doing so and we have notified you.
We do not envisage that any decisions will be taken about you using automated means, however, we will notify you in writing if this position changes.
You may have a right to data portability under the UK General Data Protection Regulation (GDPR).
The right to data portability allows you to obtain and reuse a copy of your personal data for:
It allows you to move data, copy data and transfer data.
The right to data portability ensures that it is done in a safe and secure way without affecting its usability. However, it will only apply to information concerning you which you have provided to us and where it is held electronically (so does not include paper records).
You can make a data portability request verbally or in writing when we are processing your information:
We will ensure that we provide your information in a ‘structured’, ‘commonly used’ and ‘machine-readable’ format.
You can find further information on the Information Commissioner’s Office website: https://ico.org.uk/your-data-matters/your-right-to-data-portability/
If you would like to make a data portability request please email dpo@oakdalecentre.org.
Please note that as part of the process we may be required to verify your identity.
We will aim to respond to your request within a month but may respond within a further 2 months if the request is complex or we have received a number of requests from you.
You have a right of access under the UK General Data Protection Regulation
(GDPR).
The right of access allows you to obtain confirmation that we are processing your personal data and to receive a copy of that personal data, together with certain supplementary information about how and why it is being used. This enables you to:
The right of access applies to personal data relating to you that we hold in both electronic and paper records, subject to certain legal exemptions.
You can make a Subject Access Request verbally or in writing. If you would like to make a Subject Access Request, please email dpo@oakdalecentre.org. Please note that as part of the process we may be required to verify your identity before releasing personal data to you.
We will aim to respond to your request within one month. However, this timeframe may be extended by a further two months if the request is complex or if we have received a number of requests from you. If an extension is required, we will inform you.
You can find further information on Subject Access Requests on the Information Commissioner’s Office website: https://ico.org.uk/your-data-matters/your-right-of-access/
You may also have the right to:
If you believe you have any of these additional rights or you wish to exercise them, please let us know.
Colleague Privacy Notice
This Privacy Notice is effective from 01 April 2026 and applies to all companies registered or trading under Oakdale Therapies Ltd, including Oakdale Centre CIC and BUSS® For the purposes of this Notice, these entities are collectively referred to as “Oakdale”.
We will update this Privacy Notice from time to time. When we do change the notice (in a significant way), we will post an update on our website.
Oakdale takes data protection and confidentiality very seriously. This privacy notice covers:
If you have any questions or concerns about this Privacy Notice or how we process your information, or if you would like to make a complaint about a possible data breach, please contact us:
Email: dpo@oakdalecentre.org
Postal address:
The Governance Team
Oakdale Group
49 Valley Drive
Harrogate
HG2 0JH
We take data security extremely seriously and all such communications are examined and replies issued where appropriate as soon as possible. If you are unsatisfied with the reply you receive, you may refer your complaint to the Information Commissioner’s Office (ico.org.uk).
What is a Privacy Notice?
Oakdale is a ‘data controller’. This means that we are responsible for deciding how we hold and use personal information about you. We are required under data protection legislation to notify you regarding how we hold and use your personal information.
Privacy Notice For Oakdale Colleagues And Candidates
This notice applies to current and former employees, workers, associates, contractors and candidates applying for employment. This notice does not form part of any contract of employment or other contract to provide services. We may update this notice at any time but if we do so, we will provide you with an updated copy of this notice as soon as reasonably practical. It is important that you read and retain this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information and what your rights are under data protection legislation.
We will collect, store and use the following categories of personal information about
you:
We may also collect, store and use the following sensitive special categories of personal information:
We collect personal information about candidates, employees, workers and contractors through the application and recruitment process, either directly from candidates or sometimes from an employment agency or background check provider. We may also collect additional information from third parties including former employers, credit reference agencies or other background check agencies such as immigration consultants, or the Disclosure and Barring Service.
We may also collect personal information from the trustees or managers of pension arrangements operated by a group company.
We will collect additional personal information in the course of job related activities throughout the period of you working for us.
We will only use your personal information when the law allows us to. Mostly, we will use your personal information in the following circumstances:
We may also use your personal information in the following situations, which are likely to be rare:
The situations in which we will use your personal information include:
Some of the above grounds may overlap and there may be several grounds that justify our use of your information.
We process sensitive personal information for the following purposes:
We will use information about your gender, race or national or ethnic origin, religious, philosophical or moral beliefs, or your sexual life or sexual orientation, to ensure meaningful equal opportunity monitoring and reporting.
If you fail to provide certain information when requested, we may not be able to offer you employment or we may not be able to perform the contract we have entered into with you (such as paying you or providing a benefit), or we may be prevented from complying with any legal obligations (such as to ensure the health and safety of our workers).
We will only use your personal information for the purposes for which we collected it,
unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will publish an updated Privacy Notice on our website.
Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by Law.
We will share your personal information with third parties where required by law, where it is necessary to administer the working relationship with you, which may include during our pre-employment checks, including right to work and the disclosure and barring service, or where we have another legitimate interest in doing so.
‘Third parties’ includes third party service providers (including contractors and designated agents) and other entities within Oakdale and their employees, representatives, strategic investors and their respective advisers. Oakdale engages these third parties to provide certain services to the business.
In order for them to provide their services, we need to allow them to process personal data necessary for their tasks. When we use third parties to process personal data on our behalf, we require them to commit to compliance with relevant data protection legislation.
The following activities are carried out by third party service providers:
We may share your personal information with other third parties in the following circumstances:
Sale or restructuring: We may need to share your personal information if a sale or restructuring of all or part of Oakdale occurs. In this situation we will, so far as possible, share anonymised data with the other parties before the transaction completes. Once the transaction is completed, we will share your personal data with the other parties if and to the extent required under the terms of the transaction.
Request from a regulator or to comply with the law. We may also share your personal information: (i) with a regulator; (ii) to comply with the law; or in other circumstances when we are legally permitted to do so. This may include making returns to HMRC and disclosures to any other regulatory bodies which have authority over the Oakdale, our professional advisers (such as lawyers, auditors, immigration advisers etc.), disclosures to shareholders such as directors’; remuneration reporting requirements and to such third parties as we reasonably consider necessary in order to prevent crime.
We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Details of retention periods for different aspects of your personal information are available in our retention policy which is available on the Oakdale intranet or from our Governance team.
To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you. Once you are no longer an employee, worker, associate or contractor of the company we will retain and securely destroy your personal information in accordance with our retention policy, applicable laws and regulations.
The personal information we collect is stored in a variety of electronic forms. Regardless, we have appropriate and adequate technical and administrative processes in place to make sure that all your information is kept secure.
We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality. Details of these measures may be obtained from the governance team at dpo@oakdalecentre.org.
We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.
Oakdale makes it easy for you to keep your personal information accurate, complete,
and up to date. If any of your information changes please let us know so that we can
update our records.
We will transfer the personal information we collect about you to countries within the European Economic Area (EEA). There are adequacy regulations in respect of these countries. This means that the countries to which we transfer your data are deemed to provide an adequate level of protection for your personal information.
We may transfer personal information we collect about you to the United States of America or other parts of the world outside the UK where there has not been an adequacy decision. This means that these countries are not deemed to provide an adequate level of protection for your personal information. We will transfer your personal data to those countries in limited circumstances that include when a third party supplier (such as IT software supplier) has operations (or provides IT software support for example) in such a country and can only deliver their service to Oakdale by transferring your personal data to that country or because their IT infrastructure is structured in such a way that data is stored in those countries.
To ensure that your personal information does receive an adequate level of protection we put in place the following appropriate measures to ensure that your personal information is treated by those third parties in a way that is consistent with and which respects UK law on data protection: data protection agreements, technical and organisational measures, standard contractual clauses and binding corporate rules (where applicable). If you require further information about this or these protective measures, you can request more information from the governance team dpo@oakdalecentre.org.
You are entitled to see what personal information we hold about you at any time. This Privacy Notice outlines the information we hold about you and why. If you wish to access your personal information, please contact us at dpo@oakdalecentre.org.
We are not required to process any request for access which is frivolous or vexatious, jeopardises or otherwise affects the privacy of others, is impractical, or for which access is not otherwise required by law. We will let you know in writing if any of these circumstances apply to your request.
Automated decision making takes place when an electronic system uses personal information to make a decision without human intervention. You will not be subject to decisions that will have a significant impact on you based solely on automated decision making, unless we have a lawful basis for doing so and we have notified you.
There are however limited circumstances where an automated decision may be made about you, if you are a candidate who confirms that you do not have the Right to Work in the United Kingdom. Before any automated decision is made, we will obtain your explicit consent before processing your data. If as a candidate, you confirm that you do not have the Right to Work in the UK and you do have the right to work in the UK, please contact Oakdale and we will review.
You may have a right to data portability under the UK General Data Protection Regulation (GDPR). The right to data portability allows you to obtain and reuse a copy of your personal data for:
It allows you to move data, copy data and transfer data. The right to data portability ensures that it is done in a safe and secure way without affecting its usability. However, it will only apply to information concerning you which you have provided to us and where it is held electronically (so does not include paper records).
This may include data such as:
You can make a data portability request verbally or in writing when we are processing your information:
We will ensure that we provide your information in a ‘structured’, ‘commonly used’ and ‘machine-readable’ format.
You can find further information on the Information Commissioner’s Office website: https://ico.org.uk/your-data-matters/your-right-to-data-portability/.
If you would like to make a data portability request please email dpo@oakdalecentre.org.
Please note that as part of the process we may be required to verify your identity. We will aim to respond to your request within a month but may respond within a further 2 months if the request is complex or we have received a number of requests from you.
You have a right of access under the UK General Data Protection Regulation (GDPR).
The right of access allows you to obtain confirmation that we are processing your personal data and to receive a copy of that personal data, together with certain supplementary information about how and why it is being used.
This enables you to:
The right of access applies to personal data relating to you that we hold in both electronic and paper records. This may include information contained within personnel records, payroll records, training records, occupational health information, correspondence, and other employment related records, subject to certain legal exemptions.
You can make a Subject Access Request verbally or in writing. If you would like to make a Subject Access Request, please email dpo@oakdalecentre.org.
Please note that as part of the process we may be required to verify your identity before releasing personal data to you.
We will aim to respond to your request within one month. However, this timeframe may be extended by a further two months if the request is complex or if we have received a number of requests from you. If an extension is required, we will inform you.
You can find further information on Subject Access Requests on the Information
Commissioner’s Office website: https://ico.org.uk/your-data-matters/your-right-of-access/.
You may also have the right to:
If you believe you have any of these additional rights and you wish to exercise them, please let us know.
If you would like to search for anything on our website, please type here and click ‘search’
