Privacy policy

Privacy policy for community clients

Scope and overview

This privacy notice is issued on behalf of the Acacium Group and all its group companies. A full list of our group companies and their trading names can be found on our website: acaciumgroup.com/our-brands/. All reference to the Acacium Group refer to these companies. If you require a printed copy of this privacy notice or our group companies, please contact us using the details below.

When we mention “we”, “us” or “our” in this privacy notice, we are referring to any company in the Acacium Group.

The controller for your personal data is Pulse Healthcare Limited, trading as Ellea Nursing.

This privacy notice applies to you when any of your information is supplied to us by the commissioner of your care (which could be the NHS or a local authority), by yourself or a family member/guardian or any other person with lawful authority to share your information. You, or someone acting on your behalf, could for example provide information via an online enquiry submitted through our website or a direct phone or email enquiry about us potentially providing you with a package of package.

1. Our contact details

Please contact us using the details below if you have any questions about this privacy notice or personal data we hold about you:

Email us at dpo@acaciumgroup.com

Write to us at:

Data Protection Officer

Acacium Group

9 Appold Street

London

EC2A 2AP

You do also have the right to make complaints about the way we use your personal data directly to the Information Commissioner’s Office (often referred to as “the ICO”) and details about how to do so are at the end of this privacy notice. We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please feel free to contact us in the first instance.

We regularly review this privacy notice and will update it where necessary. We do recommend you regularly review this privacy notice to make sure you have the most up to date information. This privacy notice was last updated on 30/04/25

2. What does this privacy notice cover?

There are certain laws that we must comply with whenever we process your personal data, particularly the UK GDPR and Data Protection Act 2018.  ‘Personal data’ means any information about you specifically as an individual and ‘processing’ means any use of your personal data, to include collecting it in the first place.

This privacy notice explains how we make sure we comply with those laws in respect of your personal data.  We process your personal data because it allows us to ensure that we send the right people to care for you and that we plan the right support to meet your needs, among other essential activities to provide our services to you. This privacy notice covers all venues that we are commissioned to provide care or send staff to provide care.

We are committed to ensuring that your privacy is protected. If you provide us with personal data, you can be assured that it will only be used in accordance with this privacy notice.

3. What is the lawful basis for using your personal data?

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. This means that we must process your information in compliance with our regulatory framework and the law .There is a list of possible lawful bases in the UK GDPR and you can find out more about them on the ICO’s website

That means we will only use your personal data when the law allows us to. Most commonly, we will use your personal data for the purposes listed below:. These are commonly called the lawful basis for processing.

1. Legitimate Interest: this applies where the processing of your personal data is necessary for legitimate interests pursued by us or a third party, except where such interests are overridden by your interests or fundamental rights and freedoms that require protection of your personal data.

We rely on this to use your information to deliver care to you. We may also share your information with other relevant people who support us in delivering your care. Examples of this could be your GP or Social Worker. However, we will always prioritise and consider your rights and ensure they are protected – we won’t share your information unless we consider it necessary to do so in connection with your care.

To comply with legal requirements: this applies where there are legal duties or requirements for us to use your personal data in a certain way, for example if we are required to share it in connection with legal proceedings and as a result of a specific court order. It could also apply where a regulator, such as the ICO or General Medical Council, requires us to share certain information in connection with matters they are investigating. When we provide care  services to you, we will need to process information relating to you and your health. This is often referred to as “special categories of personal data”. Such data requires a higher level of protection, and the law says that we must comply with additional requirements and safeguards. The special categories of data we collect are in italics in the table below.

Those additional requirements include identifying an additional lawful basis for us to use any special category data and we rely on the fact that processing is necessary for health or social care purposes: This means that we can process the information that is necessary in order that we can safely provide care services to you.

We will only use your personal data for the purposes for which we collected it, unless we lawfully and reasonably consider that we need to use it for another reason and that reason is compatible with the law and the original purpose in this privacy notice.

Please note you will not be subject to any automated decision making meaning that only humans, and not AI, will make decisions about your care and treatment.

The table below shows you what information we process and why:

Personal data	Purpose	Lawful basis
Full legal name DOB NHS number Telephone number Address Home number Mobile number	To provide safe care for you To let us know how to contact you To communicate and manage our relationship with you To confirm your identity when we speak with other relevant teams about the care we provide you If you fund your own care we will require financial information which would include a credit check.	Legitimate Interest
Sex life and sexual orientation information Racial or ethnic origin Religion or philosophical beliefs	To ensure the care package we provide is in keeping with any personal preferences and practises To provide safe personal care	Legitimate interest Processing is necessary for health or social care purposes
Next of Kin details	To contact someone in the event of an emergency	Legitimate Interest.
Details of Clinical condition and medical history Details of assessments from other relevant health professionals Name of GP Practice Name of Hospital/Department Clinic/hospital/GP Code/NHS number Details of care and support provided by us Details of any court orders that will impact delivery of care and support Details of previous and current medication and equipment Referrers: Telephone No Address Email Clinician	To ensure that we can undertake a full clinical assessment To be able to communicate directly with the commissioner of care and MDT in the interest of your/our clients clinical safety To communicate directly in the event of an urgent or emergency finding To ensure we are able to compile a comprehensive Care plan to deliver safe and effective care in the community setting.	To comply with legal requirements Legitimate interest Processing is necessary for health or social care purposes
Details of your diet, routine, likes and dislikes	To ensure the care you receive fits in with your lifestyle To allow you choice in your daily routine To make sure you have the food and drink you like and to keep you healthy. To give you choice	To comply with legal requirements Legitimate interest Processing is necessary for health or social care purposes
Opinions and evaluations of the service that we have provided through routine satisfaction surveys	To enable us to provide a service that meets the individual’s needs and to address any concerns and improve our service	Legitimate Interests
Communication Any complaints on the service provided via email, letter or verbally Any incidents determined	Investigate or prevent any complaints or incidents raised	To comply with legal requirements
	To carry out or assist with any legal or regulatory investigation	To comply with legal requirements
Car insurance information and MOT	Only required if we drive your car	Legitimate Interests
Questionnaires/Surveys/ Marketing	To gather feedback on the services received, we may collect and analyse opinions to enhance the quality of the services we provide	Legitimate Interests

4. When do you have to provide us with information?

As we are providing care to you, you may be required to provide specific information beforehand to ensure we can support you in a safe and appropriate manner.

5. Will we process any additional information about you while providing care services?

When we provide you with care, it may be necessary for us to obtain further information about you from others, to make sure your care and support are appropriate. We have set out below, details of the sources that we will use to obtain this information:

Our workers that care for you – we will need to ask our workers for information relating to the care that they have provided to you and any concerns that relates to your health and wellbeing. This will be documented in your care records.

Other healthcare professionals – we may need to obtain information that will assist us to deliver the best care for you. This could be from a speech and language therapist, psychologist, occupational therapist of other professional that is supporting you.

Professional agencies – we may need to get information from other professional agencies such as social services, where this is necessary to provide support to you.

6. Why is your personal data shared across the Acacium Group of companies?

The personal data that you provide will be shared within ACACIUM Group, to enable us to provide our services to you, for example the resourcing of workers. We will also share your personal data across Acacium Group to ensure that our legal and regulatory obligations are achieved. The data that is shared will be kept to the minimum needed for the purpose and where possible it will be anonymized or pseudonymised.

Examples of data shared within Acacium Group include:

• Shift dates and times: Shared with finance teams to ensure workers are paid and Acacium Group can bill for their services.
• Incidents and complaints details: Shared with Clinical Governance teams to provide independent oversight and expertise.
• Out of Hours team: Granted access to necessary operational data to support during evenings and weekends.
• Management reporting: Anonymised and pseudonymised data is used for reporting purposes.
• Will we share your data with third parties?

We will share your personal data with the below third parties when required to do so, this will be limited to necessary information:

• The commissioner for your care;
• Anyone cited in a court order or if someone who holds a valid Power of Attorney;
• Our professional advisors;
• Local Authorities such as your social worker;
• Any educational settings you may attend;
• People who are in charge of or involved in your care ie- GP, District Nurses, Consultants;
• Approved Secondary suppliers: Limited information would be provided to our approved secondary providers should we not be able to fill a shift with our own staff. We would never supply secondary agency staff without seeking prior agreement from yourself and whoever funds your care;
• Organisations who regulate us or those we employ or engage to provide services to you;
• Third parties who provide services or online platforms; and
• Third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them.

We require that all third parties respect the security of your personal data and adhere to data protection laws. Where we share your personal data with third parties providing operational services to us, we only allow them to process your personal data for specific purposes in accordance with our instructions, as set out in a legally binding contract.

7. How long do we keep your personal data for?

We will only keep your personal data for as long as is necessary for the purposes for which it was collected. In order to determine the appropriate retention period for your personal data, we consider the amount, nature, and sensitivity of your personal data.

Under the Record Management Code of Practice for Health and Social Care, we will keep your data for different lengths depending on your age, when we supplied care to you, and other factors as set out under this code. We will also consider broader legal and regulatory requirements.

If you are referred to us and we receive your personal data but do not provide care and support services to you, we will delete your data within 6 months of the decision being made not to provide care.

8. Will we transfer your data outside of the country?

Ellea is based in the UK and your data is processed and stored in the UK.

In the unlikely event that we need to transfer your information outside of the UK, we will always ensure that adequate safeguards are in place to provide a similar level of protection. This includes ensuring that there are safeguards and appropriate technical and organisational measures in place, such as data transfers only to countries deemed to provide an adequate level of protection for personal data by the UK Government and/or specific contracts approved by the Information Commissioner’s Office to ensure similar levels of protection.

Your data may be transferred outside of the UK at your request, for example, if you wish to take a trip abroad; in this case, sometimes we may have to notify local hospitals or agencies to ensure your safety whilst away.

If you would like further information about the methods used to transfer personal data outside of the UK, please contact us at dpo@acaciumgroup.com

9. How do we safeguard your personal data?

We have implemented appropriate security measures to prevent your personal data from accidental loss, alteration, unauthorised disclosure, or access.

Additionally, we have established procedures to address any suspected personal data breaches and will notify you and any applicable regulators if legally required to do so. In particular, we will tell you about it if the breach presents a high risk to your rights and freedoms. 

Furthermore, we limit access to your personal data to individuals who have a business need to know. These individuals will only process your personal data according to our instructions, and are bound by a duty of confidentiality.

10. How will your data be used for marketing?

As a service user, we may occasionally send you information that we believe would be of interest to you or provide current advice that is relevant.

The types of communication you may receive include:

• Updates on Ellea Nursing resources and services
• Program surveys and questionnaires

We understand that you may prefer not to receive this information. While we would regret your missing out, you can opt out by:

• clicking the unsubscribe link at the bottom of any marketing emails we send you; or
• Emailing us at dpo@acaciumgroup.com.

Please note that legal and service updates relating to your package of care do not constitute direct marketing and cannot be opted out of. However, you may be able to choose a different method of communication for these updates. Please contact your operational team for details.

We endeavour to process requests to stop marketing as soon as possible, but this may take up to 28 days. During this period, you may still receive some marketing communications.

11. What are my rights in relation to my information?

You have a number of rights in relation to how we use your information, these are explained in the table below:

Your Rights	Explanation
Your right of access	You have the right to ask us for copies of your personal data. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for..
You right to rectification	You have the right to ask us to correct or delete personal data you think is inaccurate or incomplete. We may, however, refuse your request if we consider that the information is accurate having looked into it.  .
Your right to erasure	You have the right to ask us to delete your personal information. This might not include all your information, particularly if it relates to care and/or treatment you have been provided with. Please ask if you have any further questions.
Your right to restriction of processing	You have the right to ask us to limit how we can use your personal information, although this is subject to certain limitations.
Your right to object to processing	You have the right to object to the processing of your personal data. This might not apply to all your information particularly if it relates to care and/or treatment you have been provided with. Please ask if you have any further questions. You can inform us of any concerns you have regarding the processing of your data and you have the right to discuss this with us
Your right to withdraw consent	This right arises at any time we are relying on the consent you have provided to us to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide our services to you. We will advise you if this is the case at the time you withdraw your consent.
Your right to data portability	You have the right to ask that we transfer the personal data that you gave us to another organisation, or to you, in certain circumstances.

12. How do I exercise my rights?

To make a data protection rights request, please contact us using the details at the top of this privacy notice.

If you are under the age of 13 all the above rights still apply to you – your parents or guardians who have parental rights, can exercise these rights on your behalf.

In most cases we will deal with your request as soon as possible and within one calendar month of your request. If we need more time, however, we will inform you of this.

To find out more about your personal data rights, click here

Please note that we do not charge for any such requests unless there are exceptional circumstances.

13. How to complain

If you have any concerns about our use of your personal data, you can make a complaint to us using our contact details at the top of this privacy notice.

If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO.

At the ICO’s address

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Calling the ICO’s Helpline number: 0303 123 1113

Or visiting the  ICO’s Website: https://www.ico.org.uk/make-a-complaint

14. Updates of this Policy

We regularly review and update this privacy notice as needed. We recommend that you regularly review this privacy notice to ensure you have the most up to date information.

This privacy notice was last updated on 30/04/25.