Link Case Management Ltd understands that your privacy is important to you and that you care about how your personal data is used.

1. About this notice

This notice explains how Link Case Management Ltd (“Link CM”, “we”, “us”) collects and uses personal information. It covers:

  • our clients, including children and adults who may lack capacity, and the people who act for them (deputies, litigation friends, parents and attorneys)
  • clients’ family members
  • professionals we work with, such as solicitors, deputies, therapists, clinicians, care agencies, schools and Support Workers, including people who attend meetings
  • people who contact us through our website, email or phone

We are the controller of the personal information described here. We are registered with the Information Commissioner’s Office (ICO), registration number ZA109987.

2. Who we are

Link Case Management Ltd is a CQC-registered Case Management company for adults and children with brain, spinal, complex neurological and poly-trauma injuries. We are a limited company registered in England and Wales, company number 09525106.

Registered office: Suite G1, Alexandra Court, Carrs Road, Cheadle SK8 2JY.

3. What information we hold

About clients:

  • name, date of birth, address and contact details, and claim and court references
  • health information, including injuries, medical and therapy records, cognition, capacity assessments, care needs and rehabilitation progress
  • information about care and support arrangements, education, home and family circumstances
  • safeguarding information
  • occasionally, other sensitive information where it is relevant to care or the claim, such as ethnicity, religion or the circumstances of an incident (which may include criminal offence information)
  • recordings, transcripts and minutes of meetings

About family members, representatives and professionals: names, contact details, job titles, and what is said in meetings and correspondence.

About website and email enquirers: if you use our contact form or email us, your name, contact details and anything you choose to tell us. Our website does not use cookies or analytics.

4. Where we get information from

We get information from:

  • you
  • the solicitor, deputy or other party who instructs us
  • the Court of Protection, through deputies
  • GPs, hospitals and other NHS services
  • therapists and clinicians
  • care and support agencies, including through their care record systems
  • schools and local authorities
  • people who attend meetings

5. Why we use it, and our lawful basis

We use personal information to:

  • accept and carry out instructions under the Rehabilitation Code
  • assess and report on a client’s needs, rehabilitation and costs
  • coordinate therapies, care and education
  • recruit and manage Support Workers for clients
  • support decisions under the Mental Capacity Act 2005
  • keep the records of our work, including minutes of meetings
  • bill for our work
  • protect people from harm
  • meet our legal and regulatory duties, including to the CQC
  • answer enquiries

Our lawful bases under the UK GDPR are:

  • Legitimate interests (Article 6(1)(f)): delivering the Case Management we are instructed to provide. You can object to this (section 10).
  • Contract (Article 6(1)(b)): where we contract directly with the client or their deputy.
  • Legal obligation (Article 6(1)(c)): for example, CQC notifications and keeping financial records.
  • Vital interests (Article 6(1)(d)): only in an emergency, to protect someone’s life.

For health and other sensitive information, we rely on:

  • Article 9(2)(h): providing health or social care, with the Data Protection Act 2018, Schedule 1, Part 1, paragraph 2. Our staff work under a duty of confidentiality.
  • Article 9(2)(f): legal claims.
  • Safeguarding of children and individuals at risk: Data Protection Act 2018, Schedule 1, Part 2, paragraph 18.
  • Criminal offence information: Schedule 1, paragraph 33 (legal claims), or paragraph 18 (safeguarding).

6. Meetings, recordings and AI tools

Recording. We may record meetings so that we can produce accurate minutes. The Case Manager will say at the start of a meeting if it is being recorded.

Recordings and transcripts are kept in our secure file storage.

AI tools. We may use AI tools to help us prepare first drafts of some documents, such as meeting minutes, reports and letters.

A member of our team checks, corrects and approves every document before it is used or sent. AI tools do not make decisions about anyone.

The AI tool providers act only on our instructions, under contracts with Data Protection terms, and do not use our information to train their AI models. We delete the information from the tools once the final document is saved to our records.

Automated decisions. We do not make decisions about anyone by automated means alone, and we do not use personal information for profiling.

7. Who we share it with

We share information only where we need to, and only what is needed. Recipients include:

  • the solicitors, deputies and other parties who instruct us
  • the Court of Protection, through deputies
  • therapists, clinicians, GPs and NHS services involved in the client’s care
  • care and support agencies, schools and local authorities
  • people attending meetings, who receive the minutes
  • local authority safeguarding teams, the police and the CQC, where the law requires it or to protect someone from harm
  • our insurers and professional advisers, if needed
  • IT and service providers that store or process information for us under contract

We do not sell personal information. If we are ever legally required to share information, for example by a court order, we will do so only as far as the law requires.

8. Sending information outside the UK

Our main files are stored in the UK. Some of our IT service providers store or process information in other countries, including countries in the European Economic Area, Canada and the United States.

Where a transfer is not covered by UK adequacy regulations, we use safeguards approved under UK law. UK adequacy regulations recognise another country’s Data Protection laws as adequate. The safeguards we use include the International Data Transfer Addendum to the EU Standard Contractual Clauses, issued by the ICO.

For example, AI tool providers may process information in the United States and other countries. We transfer information to them under the EU Standard Contractual Clauses with the UK Addendum.

You can ask us for a copy of the relevant safeguards using the details in section 13.

9. How long we keep it

We keep information only for as long as we need it for the purposes in this notice, including any possible legal claim, and in line with our retention schedule. Records about children and people who lack capacity may be kept longer, because legal time limits can be extended for them. We then delete or securely destroy the information.

10. Your rights

You have the right to:

  • be told how we use your information (this notice)
  • ask for a copy of your information (a “subject access request”)
  • have inaccurate or incomplete information corrected
  • ask us to delete your information
  • ask us to limit how we use your information
  • move information you gave us to another organisation, where the law allows
  • not be subject to decisions made by automated means alone. We do not make such decisions

Your right to object. Where we rely on legitimate interests, you can object to our use of your information. We will stop unless we have compelling legitimate grounds, or we need the information for legal claims.

Some rights are limited, for example where we must keep records for legal claims or for safeguarding. A deputy, attorney or litigation friend may be able to exercise these rights for someone who lacks capacity. A parent may be able to exercise them for a child.

To use any of these rights, contact us by any means: in writing, by email or by phone. You do not normally have to pay. We will reply within one month. If your request is complex, we may extend this by up to two further months, and we will tell you why within the first month.

11. Complaints

If you are unhappy with how we have used your information, please tell us first using the details in section 13. We will acknowledge your complaint within 72 hours and achieve resolution within 21 days.

You also have the right to complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, or phone 0303 123 1113.

12. Keeping information secure

We use access controls, encrypted devices and secure UK-based file storage. Our staff are trained in confidentiality. We choose suppliers that give contractual Data Protection commitments. Paper records are kept in locked storage and securely shredded in our office when no longer needed.

13. How to contact us

Data Protection lead, Link Case Management Ltd, Suite G1, Alexandra Court, Carrs Road, Cheadle SK8 2JY
Email: dataprotection@linkcm.co.uk
Phone: 0161 445 5500 (Monday to Thursday 9am to 5pm, Friday 9am to 4pm)

14. Changes to this notice

We review this notice regularly.

Last updated: 10/11/2026