Last updated: 18 August 2026
CM Bespoke Care Ltd respects your privacy and is committed to protecting your personal information. This privacy policy explains how we collect, use, store and share personal information when you contact us, use our website, enquire about or receive our care services, apply to work with us, or otherwise interact with our team.
We process personal information in accordance with the UK General Data Protection Regulation, the Data Protection Act 2018 and other applicable data protection legislation.
Who We Are
CM Bespoke Care Ltd is the data controller responsible for the personal information covered by this policy.
Company name: CM Bespoke Care Ltd
Company registration number: 10697242
Registered office: Ground Floor Office Suite, Upper Baveney Park, Cleobury Mortimer, Kidderminster, DY14 8LF, United Kingdom
Additional office: Unit 1, Sandford Court, Sandford Avenue, Church Stretton, Shropshire, SY6 6BH, United Kingdom
Telephone:01746 718 816
Email:info@cmbespokecare.co.uk
Who This Policy Applies To
This policy applies to personal information relating to:
- People who receive, enquire about or may require our care services.
- Relatives, representatives, attorneys, advocates and emergency contacts.
- People making an enquiry or referral on somebody else’s behalf.
- Care practitioners, employees, applicants, contractors and volunteers.
- Healthcare and social care professionals who work with us.
- Suppliers, business contacts and visitors to our website or offices.
Personal Information We Collect
The information we collect depends on your relationship with us and the reason for the interaction. It may include:
- Your name, address, telephone number and email address.
- Your date of birth, age, gender and preferred form of address.
- Details submitted through our website, by telephone, by email or in person.
- Information about a care enquiry, referral or requested service.
- Contact details for relatives, representatives and emergency contacts.
- Information about communication needs, preferences and consent choices.
- Financial, invoicing, payment and funding information.
- Records of correspondence, assessments, meetings and telephone conversations.
- Information required to manage complaints, concerns, incidents or safeguarding matters.
- Recruitment, employment, training, qualification and professional information.
- Identity, right-to-work, reference and background-check information where required.
- Technical information such as an IP address, browser, device and website activity.
Health and Care Information
When assessing, arranging or providing care, we may need to process sensitive information about a person’s health, wellbeing and circumstances. This is known as special category personal data and may include:
- Physical and mental health information.
- Medical conditions, diagnoses, treatment and medication.
- Mobility, communication, nutrition and personal-care requirements.
- Disability, capacity and accessibility information.
- Daily routines, personal preferences and desired care outcomes.
- Risk assessments, care plans and records of care provided.
- Information concerning religious or cultural needs where relevant to care.
- Information needed to protect a person’s safety, dignity and welfare.
We collect only the information reasonably required to assess needs, plan appropriate support, provide safe and personalised care, meet our legal and regulatory responsibilities, and protect the wellbeing of the people we support.
How We Obtain Personal Information
We may receive personal information:
- Directly from the person the information concerns.
- From a relative, representative, attorney, advocate or emergency contact.
- From a healthcare or social care professional.
- From a local authority, NHS body, commissioner or other referring organisation.
- From an employer, recruitment provider, referee or background-check service.
- Through our website, forms, telephone calls, emails and meetings.
- From publicly available sources where appropriate and lawful.
If someone provides us with personal information about another person, they should have the appropriate authority to do so and should make that person aware of this privacy policy where possible.
How We Use Personal Information
We may use personal information to:
- Respond to enquiries and provide information about our services.
- Arrange and complete care assessments.
- Prepare, deliver, monitor and review personalised care plans.
- Match clients with suitable care practitioners.
- Communicate with clients, relatives, representatives and professionals.
- Manage medication, risks, incidents and changes in a person’s circumstances.
- Protect the health, safety, dignity and welfare of clients and staff.
- Manage contracts, fees, funding, payments and accounts.
- Maintain appropriate care, operational and regulatory records.
- Manage complaints, compliments, concerns and safeguarding matters.
- Recruit, train, support and manage our workforce.
- Meet legal, regulatory, insurance and professional requirements.
- Improve our services, processes, website and communication.
- Prevent and investigate fraud, misuse, security incidents or unlawful activity.
- Establish, exercise or defend legal claims.
Our Lawful Bases
We must have a lawful basis for each use of personal information. Depending on the circumstances, we may rely on:
- Contract: where processing is necessary to enter into or perform a contract for care, employment or another service.
- Legal obligation: where we must process information to comply with care, employment, safeguarding, financial, regulatory or other legal requirements.
- Legitimate interests: where processing is reasonably necessary to operate and improve our organisation, respond to enquiries, maintain records, protect our services or communicate appropriately, provided those interests do not override an individual’s rights.
- Consent: where we have asked for clear permission for a particular use. Consent may be withdrawn at any time, although this will not affect processing that has already taken place lawfully.
- Vital interests: where processing is necessary to protect somebody’s life or physical safety.
Our Use of Special Category Information
In addition to having a lawful basis, we must satisfy a separate legal condition when processing health information or other special category data. Depending on the circumstances, we may process this information where it is necessary for:
- The provision or management of health or social care.
- Employment, social security or social protection obligations and rights.
- Protecting vital interests where a person cannot provide consent.
- Reasons of substantial public interest permitted by law, including safeguarding.
- Establishing, exercising or defending legal claims.
- A specific purpose for which explicit consent has been provided.
Access to sensitive information is restricted to people who require it for their role and who are subject to appropriate duties of confidentiality.
Information About People Who May Lack Capacity
Some people receiving care may be unable to make particular decisions about their personal information. Where this applies, we will act in accordance with applicable capacity, care and data protection requirements.
We may communicate with an authorised attorney, deputy, representative, advocate, family member or relevant professional where this is lawful and appropriate. We will continue to involve the person receiving care as much as reasonably possible and respect their rights, wishes and preferences.
Who We May Share Information With
We share personal information only where it is necessary, appropriate and lawful. Depending on the circumstances, recipients may include:
- Authorised CM Bespoke Care employees and care practitioners.
- Relatives, representatives or advocates where the person has agreed or another lawful authority applies.
- GPs, pharmacists, hospitals and other healthcare professionals.
- Social workers, local authorities, NHS bodies and care commissioners.
- Emergency services and safeguarding authorities.
- The Care Quality Commission and other regulatory or inspection bodies.
- Police, courts, legal advisers or public authorities where required by law.
- Insurers, accountants, auditors and professional advisers.
- Secure care-management, communication and family-portal providers.
- IT, hosting, website, email, payroll, recruitment and administrative service providers.
- Prospective purchasers or advisers involved in a lawful business transfer.
Organisations processing information on our behalf must use it only for the agreed purpose and provide appropriate confidentiality and security protections.
We do not sell personal information.
International Transfers
Some technology or service providers may process information outside the United Kingdom. Where personal information is transferred internationally, we will ensure that an appropriate legal safeguard is in place. This may include an adequacy regulation, approved contractual protections or another lawful transfer mechanism.
How Long We Keep Personal Information
We retain personal information only for as long as it is reasonably needed for the purpose for which it was collected and to meet our legal, regulatory, contractual, insurance and safeguarding obligations.
Different retention periods apply to different records, including care records, enquiries, financial information, recruitment files, employment records, complaints and website information. When information is no longer required, it will be securely deleted, destroyed or anonymised.
How We Protect Personal Information
We use appropriate organisational and technical measures to protect personal information against accidental loss, unauthorised access, alteration, disclosure or misuse. These measures may include:
- Role-based access controls and account security.
- Secure care-management and communication systems.
- Staff confidentiality obligations and data protection training.
- Secure storage, backup and disposal procedures.
- Policies for identifying and responding to information-security incidents.
No method of electronic transmission or storage is completely risk-free, but we review our safeguards and take reasonable steps to protect the information entrusted to us.
Your Data Protection Rights
Depending on the circumstances and the lawful basis being used, you may have the right to:
- Ask for confirmation that we process your personal information.
- Request access to your personal information.
- Ask us to correct inaccurate or incomplete information.
- Ask us to erase personal information in certain circumstances.
- Ask us to restrict how personal information is used.
- Object to processing based on legitimate interests or direct marketing.
- Request the transfer of certain information in a portable format.
- Withdraw consent where processing relies on consent.
- Raise a concern about how your information has been handled.
These rights are not absolute and may be limited where we must retain or use information to provide care, protect another person, comply with the law, maintain regulatory records or establish or defend legal claims.
We may need to verify your identity and authority before responding to a request. We will not ordinarily charge a fee, although the law allows a reasonable fee or refusal in limited circumstances.
Marketing Communications
We will send promotional communications only where this is permitted by law. Where consent is required, you can withdraw it at any time by using an unsubscribe facility or contacting us.
Opting out of marketing will not prevent us from sending important communications concerning an enquiry, care arrangement, contract or legal obligation.
Website Information and Cookies
When you visit our website, limited technical information may be collected to deliver the website securely, remember preferences, understand performance and identify technical problems.
Essential cookies may be used where necessary for the website to function. Where optional analytics, advertising or similar technologies are used, they will be managed in accordance with applicable consent requirements. You can also control cookies through your browser settings, although disabling essential cookies may affect website functionality.
Third-Party Websites
Our website may contain links to websites operated by other organisations. We are not responsible for their privacy practices. You should review the privacy information provided by the relevant organisation before submitting personal information.
Changes to This Privacy Policy
We may update this policy to reflect changes in our services, practices or legal responsibilities. The latest version will be published on our website with its updated date.
How to Contact Us
If you have a question, wish to exercise a data protection right or have a concern about how your information has been handled, please contact:
Data Protection Contact
CM Bespoke Care Ltd
Ground Floor Office Suite
Upper Baveney Park
Cleobury Mortimer
Kidderminster
DY14 8LF
United Kingdom
Telephone:01746 718 816
Email:info@cmbespokecare.co.uk
Complaining to the Information Commissioner
We would appreciate the opportunity to address your concern first. You also have the right to complain to the Information Commissioner’s Office, the United Kingdom’s independent data protection regulator.
Further information and the ICO’s complaint process are available at ico.org.uk/make-a-complaint .
