Privacy policy

Who is responsible for your information

Bluebell Care Group is the data controller for the information described here. That means we decide what is collected and why, and we are the organisation you can hold to account for it.

Registered name and number

TBD — Bluebell has not yet supplied the registered company name, company number or registered office. A company must show all three on its website, so this will not stay open.

Registration with the ICO

TBD — the data protection fee registration number, once confirmed. You can check any organisation on the ICO’s public register.

Data protection officer

TBD — whether a data protection officer is appointed depends on the scale of the health and care information we process, and that assessment is Bluebell’s to make and record. If one is appointed, their contact route will be published here.

What we collect

From this website, only what you type into a form and choose to send:

• Your name, and a phone number or email address so we can reply.
• The town or area you are asking about, if you tell us.
• Which service you are asking about, and who the enquiry is about.
• Anything you write in the message box, which may include health information about you or about someone you care for.
• If you ask us to contact you in a different format, what would help — for example that you use British Sign Language, or need large print.
• If you are enquiring as a professional, your organisation and your role.

We do not use analytics, advertising or tracking technology on this website, so we do not build a record of the pages you looked at. See our cookies policy, which explains the one thing this site does store and why it needs no consent banner.

Sometimes information about you reaches us from someone else — a social worker making a referral, a relative enquiring on your behalf, a hospital discharge team. Where that happens we will tell you what we hold and where it came from, within a month at the latest, or sooner if we contact you before then.

Why we use it, and what allows us to

Data protection law requires us to have a specific reason in law for each thing we do with your information, not just a good intention. These are ours.

Answering your enquiry

Our legitimate interests. You asked us a question; replying to it is the obvious and expected use of what you sent, and you can object at any time.

Arranging and delivering care

Performance of a contract with you, or the performance of a public task where your care is arranged by a council or the NHS.

Protecting someone who may be at risk

Protecting someone’s vital interests, or a task carried out in the public interest. We may act on a safeguarding concern without asking you first, and our safeguarding policy explains when and why.

Recruitment

Taking steps towards an employment contract with you.

Meeting our legal and regulatory duties

Compliance with a legal obligation — for example notifying our regulator of an incident we are required to report.

Giving us your information is never a legal requirement. But if you do not give us a name and a way to reach you, we cannot reply, and that is the only consequence.

Health and other sensitive information

Information about someone’s health, disability, mental capacity, race, religion or sex life is treated differently in law and needs a second, stricter condition on top of the reason above. In a care setting this comes up constantly — a single sentence in an enquiry form often contains it.

Providing care and support

Article 9(2)(h), health or social care, together with the health and social care purposes condition in Schedule 1 of the Data Protection Act 2018. Both are needed; the Article alone is not enough in UK law.

Safeguarding a child or an adult at risk

The safeguarding condition in Part 2 of Schedule 1 of the Data Protection Act 2018. It applies where we are protecting someone from neglect or harm and asking their consent would either be impossible or would get in the way of protecting them.

An emergency where you cannot tell us anything

Article 9(2)(c), vital interests. This is a narrow, last-resort basis for genuine emergencies, not a routine one.

Where we rely on a Schedule 1 condition we are also required to keep an internal policy document setting out how we comply with the data protection principles and how long we keep the information. That document is an accountability record for the regulator rather than a published page, and the ICO can require us to produce it.

Who else sees it

Inside Bluebell, an enquiry goes to the team that owns the route you used and to nobody else. That is the whole reason the routes exist rather than one shared inbox.

Outside Bluebell, we may share information with:

• A council or NHS body, where they arrange or fund your care, or where they are carrying out a safeguarding enquiry.
• The police or a safeguarding team, where someone is at risk of harm.
• Our regulator, where we are required to notify them of something.
• Suppliers who process information on our behalf and under our instructions — for example whoever hosts this website or our email.

TBD — the named suppliers, and what each of them does. We will not list a processor we have not confirmed, because a list that is wrong is worse than a list that is honestly incomplete.

We do not sell your information, and we never share it for advertising.

How long we keep it

The law lets us state either a period or the criteria we use to work one out. Where we have confirmed a period we will state it. Where we have not, these are the criteria.

• An enquiry that does not become care. Kept long enough to answer it and to show we answered it, then deleted. We intend to state this as a fixed period.
• Care records. Set by the retention schedule in the Records Management Code of Practice for Health and Social Care, which gives different periods for different kinds of record. We follow the schedule rather than picking a single number.
• Records about a child. Held much longer, and set by the retention schedule of the council responsible, not by us. For a child who has been looked after this is measured in decades, and that is deliberate: people ask for their own childhood records many years later, and they are entitled to find them.
• Safeguarding records. Kept for as long as they may be needed for a safeguarding review, which can be considerably longer than the care itself.

TBD — the confirmed retention period for each record type. This is a decision for Bluebell’s registered manager and data protection adviser to make and record, and it is not one this website can make for them.

Whether it leaves the UK

Your enquiry is held in the UK. Two things do leave, and neither of them is your enquiry. The icon typeface on this site is served by Google, so your browser makes a request to Google’s servers and Google sees the IP address it comes from. The photographs are served by Cloudflare, so on pages carrying a photograph your browser fetches it from Cloudflare and Cloudflare sees the same thing — and may serve the image from outside the UK.

Neither one is sent anything else about you, and neither stores anything on your device. We intend to remove both by serving the typeface and the photographs ourselves. Our cookies policy sets out exactly what each request involves.

TBD — whether any of our other suppliers hold data outside the UK. We have not confirmed our suppliers. If any of them store or access information outside the UK we will say so here and name the safeguard we rely on, and you will be able to ask us for a copy of it.

What you can tell us to do

These are rights, not requests we may grant. Some have limits, and where a limit applies we will tell you which one and why.

• See it. Ask for a copy of what we hold about you. Free, and normally within one month.
• Correct it. Have something inaccurate put right.
• Have it deleted. Though not where we are required to keep it — a care record or a safeguarding record cannot simply be erased on request.
• Pause our use of it while a disagreement about it is sorted out.
• Object to our using it, where we rely on our legitimate interests.
• Take it elsewhere, in a portable form, where we hold it on the basis of your consent or a contract.
• Withdraw consent at any time, where consent is what we relied on. Withdrawing it does not undo what was lawful before.

Ask through any route on our contact page. We may need to check who you are first, which protects you rather than us.

Decisions made by a computer

We do not make any decision about you by automated means alone. No part of this website decides whether you are eligible for a service, and no algorithm sorts or scores your enquiry. A person reads it. If that ever changes we will say so here, and you will have the right to have a human involved, to make your case, and to contest the outcome.

If you are unhappy with how we have handled your information

Tell us first. Since June 2026 you have a statutory right to complain directly to us about how we have used your personal information, and we have a duty to take it seriously. We will acknowledge a complaint within 30 days and respond substantively without undue delay.

Then the ICO. If you are not satisfied with our answer — or if you would rather not come to us at all, which is your right — you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint. Complaining to us first does not take away your right to go to the ICO, and it does not affect your right to claim compensation through the courts.

A complaint about your care, rather than about your information, goes down a different route with a different escalation body. Our complaints route covers that.

Changes to this notice

TBD — the date this notice was last reviewed. We will publish it here, and we will not backdate it. Where a change is significant we will say what changed rather than only moving the date.