Privacy Statement & Policy

Total Case Management Limited

Total Case Management Ltd (TCM) is committed to protecting the privacy, confidentiality, integrity and availability of all personal information entrusted to us.

As a specialist case management provider supporting individuals with catastrophic injuries, acquired brain injuries, complex disabilities and rehabilitation needs, TCM regularly processes personal data and special category data, including health information. TCM is committed to ensuring compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and all relevant legislation. [gov.uk], [ico.org.uk]

This policy applies to:

Directors
Employees
Agency workers
Contractors
Self-employed associates
Clinical case managers
Consultants
Volunteers
Students on placement
Third-party service providers processing personal data on behalf of TCM

Purpose

The purpose of this policy is to:

Protect the rights and freedoms of individuals whose information we process.
Ensure lawful and secure handling of personal information.
Define responsibilities relating to data protection.
Reduce the risk of data breaches and misuse.
Demonstrate compliance with data protection legislation. [ico.org.uk], [gov.uk]

Types of Information Processed

TCM may process:

Personal Data

Names
Addresses
Telephone numbers
Email addresses
Dates of birth
NHS numbers
Employment information
Financial information
Emergency contact details

Special Category Data

TCM routinely processes special category data which requires additional protection under UK GDPR. This may include:

Physical health information
Mental health information
Medical records
Rehabilitation reports
Therapy assessments
Genetic information where relevant
Ethnic origin
Disability information

We may also process information relating to criminal convictions and safeguarding concerns where permitted by law. [ico.org.uk], [gov.uk]

Data Protection Principles

TCM will ensure all personal data is processed in accordance with the following principles:

Processed lawfully, fairly and transparently.
Collected for specified, legitimate purposes.
Adequate, relevant and limited to what is necessary.
Accurate and kept up to date.
Retained only as long as necessary.
Processed securely and confidentially.
Managed in a way that demonstrates accountability. [gov.uk], [ico.org.uk]

Lawful Bases for Processing

TCM processes personal information under one or more of the following lawful bases:

Performance of a contract.
Compliance with legal obligations.
Legitimate interests.
Vital interests.
Public task where appropriate.
Consent where required.

Where special category data is processed, TCM will identify an appropriate Article 9 condition under UK GDPR before processing begins. [ico.org.uk]

Employee Responsibilities

All employees and associated persons must:

Handle personal information confidentially.
Access only information necessary for their role.
Follow TCM security procedures.
Complete mandatory data protection training.
Report any actual or suspected data breach immediately.
Maintain strong password practices.
Use secure communication methods.
Ensure personal data is not disclosed improperly.

Failure to comply may result in disciplinary action and, where appropriate, referral to professional bodies.

Third-Party Contractors and Associates

All third parties processing personal information on behalf of TCM must:

Comply with UK GDPR and Data Protection Act 2018 requirements.
Sign confidentiality agreements.
Sign appropriate Data Processing Agreements (DPAs).
Implement appropriate technical and organisational security measures.
Report breaches without undue delay.
Only process personal data on documented instructions from TCM.

This includes:

Independent Case Managers
Therapists
Rehabilitation professionals
IT providers
Payroll providers
HR consultants
Administrative contractors
Agency staff

TCM retains responsibility for ensuring that third-party processors provide sufficient guarantees regarding information security. [gov.uk], [ico.org.uk]

Information Security

TCM will implement appropriate measures including:

Encrypted devices.
Password-protected systems.
Multi-factor authentication where possible.
Secure cloud storage.
Controlled access to records.
Role-based permissions.
Secure disposal of records.
Regular software updates.
Staff training.

Physical records will be secured in locked storage with restricted access.

Data Sharing

TCM may share information where necessary with:

Clients and their representatives
Solicitors
Deputies and Court Appointed Representatives
NHS Organisations
Local Authorities
Care Providers
Therapists
Insurers
Regulatory Bodies
CQC
Professional Indemnity Insurers

Information will only be shared where there is a lawful basis and where appropriate safeguards exist.

Data Retention

Personal information will only be retained for as long as necessary.

Retention periods will be determined based upon:

Legal requirements
Regulatory requirements
Clinical requirements
Insurance requirements
Limitation periods for legal claims

Records will be securely destroyed when no longer required.

Individual Rights

TCM recognises individuals' rights under UK GDPR, including:

Right to be informed
Right of access
Right to rectification
Right to erasure
Right to restrict processing
Right to data portability
Right to object
Rights relating to automated decision-making

Requests will be handled within statutory timeframes. [gov.uk]

Data Breaches

Any actual or suspected data breach must be reported immediately to the Data Protection Lead.

TCM will:

Investigate the incident promptly.
Assess risk to individuals.
Notify the ICO where required.
Notify affected individuals where necessary.
Implement corrective actions.

Monitoring and Compliance

Compliance with this policy will be monitored through:

Staff training
Audits
Incident reporting
Management reviews
Supplier reviews

Non-compliance may result in disciplinary action, contract termination, professional referral or legal action.

Contact

Data Protection Lead
Total Case Management Ltd

Email: info@totalcm.org.uk

Telephone: 01928 732 999

Privacy Notice - Total Case Management Ltd

Last Updated: 16^th July 2026

Who We Are

Total Case Management Ltd provides specialist case management services to individuals with catastrophic injuries, acquired brain injuries, complex disabilities and rehabilitation needs.

For the purpose of data protection legislation, Total Case Management Ltd is the Data Controller for the personal information described within this Privacy Notice.

Information We Collect

We may collect and process:

Personal Information

Name
Address
Telephone number
Email address
Date of birth
NHS number
Family details
Employment details

Sensitive (Special Category) Information

Medical records
Health assessments
Rehabilitation reports
Therapy reports
Mental health information
Disability information
Care records

We may also process safeguarding and criminal offence information when legally necessary. [ico.org.uk], [gov.uk]

Why We Use Your Information

We use your information to:

Deliver case management services
Coordinate rehabilitation
Communicate with professionals involved in your care
Arrange care, treatment and support services
Meet legal and regulatory obligations
Manage invoices and payments
Protect individuals from harm
Improve service quality

Our Lawful Basis

We process information under:

Contract
Legal obligation
Legitimate interests
Vital interests
Explicit consent where required

Special category data is processed under appropriate health and social care provisions and other lawful conditions permitted by UK GDPR. [ico.org.uk]

Who We May Share Information With

Where appropriate, we may share information with:

Solicitors
Deputies
Court of Protection Representatives
Healthcare providers
Therapists
Local Authorities
Care agencies
Insurers
NHS organisations
Regulatory bodies
Professional advisers

Information is only shared when necessary and lawful.

How Long We Keep Information

We retain personal information only for as long as required by:

Legal obligations
Regulatory requirements
Clinical needs
Insurance requirements

Records are securely deleted or destroyed when no longer needed.

Keeping Information Secure

We use a range of security measures, including:

Secure systems
Encryption
Password protection
Access controls
Staff training
Confidentiality agreements

Your Rights

You have the right to:

Access your information
Correct inaccurate information
Request deletion in certain circumstances
Restrict processing
Object to processing
Request transfer of data
Withdraw consent where applicable
Complain to the Information Commissioner's Office (ICO) [gov.uk], [gov.uk]

Contact Us

If you have questions regarding this Privacy Notice or wish to exercise your rights:

Data Protection Lead
Total Case Management Ltd

Email: Heather @totalcm.org.uk

Telephone: 01928 732999

Complaints

If you are unhappy with how we have handled your information, please contact us first.

You also have the right to complain to:

Information Commissioner's Office (ICO)
www.ico.org.uk
0303 123 1113 [gov.uk]