Privacy Policy
Last updated: Tuesday, 14th June 2026
At OFH Care, we take your privacy seriously. This privacy policy explains how we collect, use, store, and share personal data when delivering our two main services: mental capacity assessments and brain injury case management.
We comply with the UK GDPR and the Data Protection Act 2018. All data is stored securely within the UK and never sold to third parties. Client records are retained only for the required legal periods. You have the right to access, correct, erase, or restrict your data at any time.
This privacy policy also serves as our Fair Processing Notice. It explains in clear terms how OFH Care collects, uses, and protects personal information for both mental capacity assessments and case management services.
Contact Details
If you wish to raise concerns about data collection and processing, please contact us at OFH Care, c/ Regus, 7th Floor, Regal House, 70 London Road, Twickenham, TW1 3QS.
Email: admin@ofhcare.co.uk
Telephone: 0333 939 8032
Information We Collect
Website Use & Cookies
When you visit our website, we may collect:
- Information about how you browse and which pages you view
- Technical data such as your IP address, browser type, and referrer URL
- We use this information to keep the website secure, enhance your user experience, and ensure proper functionality. Cookies are only used with your consent.
Information We Collect for Mental Capacity Assessments (COP3, LPA, Litigation & Court of Protection)
When carrying out a mental capacity assessment, such as for completing a COP3 form, lasting power of attorney capacity assessment, capacity to litigate, or Court of Protection assessment, we may process:
- Personal details (name, date of birth, address, gender)
- Medical and health information (diagnosis, prognosis, medical reports, treatment received)
- Decision-specific information:
- Property & financial affairs: assets, income, expenditure, beneficiaries, financial history
- Health & welfare: treatment options, risks, care needs, rehabilitation details
- Litigation capacity: understanding of proceedings, ability to instruct a solicitor, and funding details
- Testamentary capacity or gifting: dependents, beneficiaries, family relationships, gifting intentions
- We may also collect views from referrers, solicitors, healthcare professionals, or family members to support the assessment.
- Your mental capacity assessment data is strictly confidential and is never shared beyond you, your referrer, and, where legally required, the courts or safeguarding authorities.
Information We Collect for Brain Injury & Catastrophic Injury Case Management
When delivering case management services for brain injury or catastrophic injury clients, we may collect:
- Identity and contact details (name, address, email, phone number)
- Injury details (nature, date, and impact of the condition)
- Health and well-being information (diagnosis, mobility, therapy notes, psychological or cognitive needs)
- Social and lifestyle details (family situation, accommodation, daily routine, education, employment, social activities)
- Care and rehabilitation needs (personal care, equipment, transport, therapy, technology, domestic support)
- Financial information (funding arrangements, benefits, details relevant to a legal claim)
- This information helps us complete an Initial Needs Assessment (INA), create a rehabilitation plan, and coordinate with healthcare providers, schools, therapists, or employers.
- Your case management information is only shared with trusted professionals directly supporting your rehabilitation and daily living needs.
Payment & Billing
For both services, we may also process payment details, including:
- Name and contact details of the payer
- Billing address
- Invoices and financial records (kept in line with HMRC requirements)
Why We Collect Your Information (How We Use It)
We use your information to:
- Provide assessments and case management services tailored to your needs
- Share information with solicitors, deputies, attorneys, or other professionals at your request
- Ensure legal compliance (e.g. safeguarding, court requirements, HMRC obligations)
- Communicate effectively with clients, families, and referrers
- Process payments and manage contracts
- Improve and secure our website
Legal Basis for Processing
We process your data under one or more of the following legal bases:
- Consent – when you or your representative agree to an assessment
- Contract – to deliver services and process payments
- Legal obligation – safeguarding, court orders, tax and financial records
- Vital interests – where processing is essential to protect someone’s life
- Legitimate interests – for business operations, defending legal claims, and ensuring website security
How Long Do We Keep Your Information
Client records (including complaints) are kept for 8 years after the last interaction. Unaccepted referrals/quotations are kept for 2 years. Financial records are kept for 7 years (HMRC requirement).
Who We Share Your Information With
We only share personal information where it is strictly necessary, appropriate, and lawful. The way information may be shared differs between our services:
Mental Capacity Assessments
Information from a mental capacity assessment is highly sensitive. We will only share it with:
- You (the client) or your authorised representative
- The referrer (such as a solicitor, deputy, healthcare professional, or relative) but only where the referral has been made through them
- Courts or safeguarding authorities – if we are legally required to do so (for example, in Court of Protection matters or where there are safeguarding concerns)
- Our legal advisors and insurers, but only if there is a dispute or legal claim
- We will never share an assessment report with anyone else without your consent.
Case Management Services
Case management often requires wider coordination to ensure the client’s rehabilitation, safety, and daily living needs are met. In addition to the above, we may also share information with:
- Healthcare providers, therapists, and social care professionals involved in the client’s rehabilitation or care
- Schools, colleges, or employers (where relevant to educational or vocational support)
- Service providers such as equipment suppliers, payroll/HR companies, or domestic support (e.g. carers, cleaners, transport providers, tradespeople, etc.) – but only when they are working directly to support the client as part of an agreed case management plan
In both services, we may share information with:
- Safeguarding authorities, the police, or courts if required by law
- Cloud service providers for secure storage of data
- We will never sell or share your personal data for marketing purposes.
International Transfers
We do not transfer client data outside the UK.
How We Store Your Information
- Secure servers and encrypted cloud storage
- Locked filing cabinets for printed records
- Restricted staff access on a need-to-know basis
Your Rights
You have the right to:
- Access – request a copy of your data
- Rectification – correct inaccurate information
- Erasure – ask us to delete your data where applicable (not possible if legally required to keep records)
- Object – to certain processing carried out under legitimate interest
- Restrict – limit how we use your data in certain circumstances
- Portability – request your data be transferred to another provider (where applicable)
- To exercise your rights, please contact us using the details provided above.
Complaints
You can review our complaint policy, download the complaint leaflet, and complete our online complaint form. If you have any concerns, please contact us first. If unresolved, you have the right to complain to the Information Commissioner’s Office (ICO): https://ico.org.uk/concerns/
Updates to This Privacy Policy
We may update this privacy policy occasionally to reflect changes in law or our services. The date of the latest update is always displayed at the top of this page.
Frequently Asked Questions
Do you sell my data?
No. We never sell personal information to third parties.
Who will see my mental capacity assessment report?
For mental capacity assessments, your report will only be shared with you and the referrer (such as your solicitor, deputy, or healthcare professional). We will not share it with anyone else unless we are legally required to do so (for example, by a court order or a safeguarding authority).
Is my brain injury case management information confidential?
Case management involves coordinating care and rehabilitation, so your information may be shared with healthcare providers, therapists, schools, employers, or service suppliers directly supporting your agreed case management plan. We only share the minimum necessary information and always in your best interests.
Can I request a copy of my report or records?
Yes. Under GDPR, you have the right to request a copy of your data, unless a legal restriction applies.
What happens if I withdraw my consent?
You can withdraw consent at any time. However, this may mean we cannot continue providing services that rely on that consent, including capacity assessments and case management.
How long do you keep client records in the UK?
- Mental capacity assessment records – 8 years after the last interaction
- Unaccepted referrals – 2 years
- Case management records – 8 years after the last interaction
- Financial data – 7 years (HMRC requirement)
Do you transfer my data abroad?
No. All data is stored and processed within the UK.
How do you keep my information safe?
We store data securely using encrypted servers, cloud storage, and locked filing systems. Access is limited to authorised staff only.
How do I raise a concern?
Please contact us first so we can resolve it. If you remain unsatisfied, you may complain to the Information Commissioner’s Office (ICO).
What’s the difference between a Privacy Policy and a Fair Processing Notice?
In practice, there is no difference for our clients. A privacy policy is usually published on our website, while a Fair Processing Notice is often given directly to service users. At OFH Care, this privacy notice also serves as our Fair Processing Notice. It explains how we collect, use, and protect your information for both mental capacity assessments and case management services, in line with UK GDPR and the Data Protection Act 2018.