Privacy Policy

Fen Response Medical 

​

Last updated: 12 October 2026 

​

Fen Response Medical respects your privacy and is committed to protecting your personal information. This notice explains what information we collect, why we use it, who we may share it with, how long we keep it and your rights. 

​

1. Who we are 

​

Fen Response Medical provides event medical cover, first aid training, prehospital care and consultancy services. 

​

The organisation responsible for your personal information, known as the data controller, is: 

​

Fen Response Medical 

​

Business correspondence address: 205 New Barns Avenue, Ely, Cambridgeshire, CB7 4RE 

​

Email: info@fenresponsemedical.co.uk 

​

Data protection contact: Managing Director 

​

ICO registration number: [Insert number, where applicable] 

​

Please use these contact details for privacy enquiries, requests about your information or data protection complaints. 

​

2. Who this notice applies to 

​

This notice applies to: 

• Visitors to our website and people who contact us. 

• Clients, prospective clients and their representatives. 

• People who receive medical assessment, treatment or support from us. 

• Parents, carers, guardians and emergency contacts. 

• People attending our training courses. 

• Suppliers and other business contacts. 

Separate privacy information will be provided for recruitment and staff administration where required.

​

3. Information we collect 

​

We collect information relevant to the services you request or receive. 

​

Enquiries, bookings and consultancy 

​

This may include your name, business name, job title, email address, telephone number, billing address, event details, correspondence, contract information and payment records. 

​

During consultancy work, we may receive information about staff, workplace incidents or first aid arrangements. We ask clients to provide anonymised information wherever identifiable personal information is unnecessary. 

​

Medical assessment and care 

​

This may include: 

• Your name, date of birth, address and contact details. 

• Relevant medical history, allergies and medication. 

• Details of your injury, illness, symptoms and clinical observations. 

• Assessment findings, treatment, advice, referrals and handover information. 

• Records of consent, capacity assessments or refusal of care. 

• Relevant emergency contact or parent/guardian details. 

• Information needed to address a safeguarding concern. 

• Incident details, including when and where care was provided. 

​

Health information is special category personal data, which has additional protection under data protection law. 

​

Training 

​

This may include your name, contact details, employer, attendance, assessment results, certification records and feedback. 

Where necessary, we may also collect information about accessibility needs or reasonable adjustments. We will explain why we need any health information requested for this purpose. 

​

Website use 

​

Depending on the website services in operation and your cookie choices, we may collect your IP address, browser and device information, pages visited, access times and cookie preferences. 

​

Complaints and incidents 

​

We may collect correspondence, witness accounts and other information necessary to investigate complaints, safeguarding concerns, incidents or legal claims. 

​

We aim to collect only the information needed for the relevant purpose. 

​

4. Where information comes from 

​

We usually collect information directly from you through conversations, assessments, forms, emails, bookings or training activities. 

​

Where necessary, we may also receive information from: 

• A parent, guardian, carer or emergency contact. 

• An event organiser, employer or person booking training. 

• Someone reporting an incident or requesting medical assistance. 

• Ambulance services, other healthcare providers or emergency services. 

• Safeguarding agencies. 

• Training providers or awarding organisations. 

• ​

Where information comes from someone else, we will provide appropriate privacy information unless a lawful exception applies. 

​

5. Why we use your information and our lawful bases 

​

UK data protection law requires us to have a lawful basis for using personal information. 

                         

 

 

 

 

 

 

 

 

 

 

 

 

​

​

​

​

​

​

​

​

​

​

​

​

​

​

 

 

 

 

 

 

 

When relying on legitimate interests, we assess whether the use is necessary and balance our interests against your rights and reasonable expectations. 

​

We do not treat an event organiser’s contract with us as a contract with an individual patient. 

​

6. Additional protection for health and other sensitive information 

​

When we use special category information, we need an additional legal condition as well as a lawful basis. 

​

For medical care and associated records, we rely on the health or social care condition under Article 9(2)(h) of the UK GDPR, together with the applicable Data Protection Act 2018 condition, where processing takes place under the responsibility of an appropriate professional or another person subject to the required duty of confidentiality. 

​

In a life-threatening emergency, Article 9(2)(c) may apply where the information is necessary to protect someone’s vital interests and the individual is physically or legally incapable of consenting. 

​

Other conditions may apply for particular purposes: 

• Explicit consent, for optional uses of sensitive information where you have a genuine choice. 

• Legal claims, where information is necessary to establish, exercise or defend a claim. 

• Substantial public interest, for safeguarding where the relevant statutory condition and safeguards are met. 

​

We identify and document the appropriate condition for the activity concerned. 

​

Consent to medical treatment is separate from consent as a data protection lawful basis. Withdrawing consent to optional data use does not necessarily require us to delete a clinical record that we must lawfully retain. 

​

7. Who we share information with 

​

We share information only where necessary and lawful. Depending on the circumstances, recipients may include: 

• Authorised members of our team involved in delivering or administering your service. 

• Ambulance services, hospitals and other healthcare professionals involved in your care. 

• Local authority safeguarding teams, police or other relevant agencies. 

• Training providers and awarding organisations for assessment, quality assurance and certification. 

• Insurers, legal advisers, accountants and other professional advisers. 

• Public authorities or regulators where disclosure is required or otherwise lawful. 

• Providers of website hosting, email, secure storage, clinical record systems, booking services and payment processing. 

​

Suppliers processing information on our behalf must operate under appropriate contractual and security arrangements. 

​

An event organiser does not automatically receive your medical records because they booked our services. Routine event reports will use anonymised or aggregated information wherever possible. Identifiable information will be shared only where there is a lawful and justified reason. 

​

Where an employer books your training, we may provide attendance, assessment outcomes and certification information necessary for that booking. We do not routinely disclose medical or accessibility details to your employer. 

​

We do not sell your personal information. 

​

8. Confidentiality and safeguarding 

​

We treat patient information as confidential and restrict access to people who need it for their role. 

​

Where appropriate, relevant information may be shared with healthcare professionals for your direct care and handover, subject to confidentiality requirements. 

​

We may share information without consent where a lawful justification exists, such as a serious safeguarding concern, a risk of serious harm or a legal requirement. We consider necessity and proportionality and disclose only what is relevant. 

​

9. How long we keep information 

​

We retain information for as long as necessary for its purpose, taking account of legal requirements, clinical guidance, awarding organisation requirements and the need to handle complaints or claims. 

​

The criteria we use include: 

• Medical records: the type of care provided, the patient’s age, relevant clinical retention guidance and potential safeguarding or legal issues. Children’s records may need to be retained for longer than adult records. 

• Training and certification records: the requirements of the relevant awarding organisation, certificate verification and assessment or appeal arrangements. 

• Bookings, contracts and financial records: applicable accounting and tax requirements and the period during which contractual claims may arise. 

• Enquiries that do not lead to a booking: whether the enquiry remains active and whether there is a continuing business need. 

• Complaints, incidents and safeguarding records: the nature of the issue, related records and any investigation or legal requirements. 

• Marketing information: until you withdraw consent or object, or until it is no longer needed. We may retain minimal suppression information to avoid contacting you again. 

• Website logs and cookie information: the security purpose or the lifespan of the relevant technology, as described in our Cookie Notice. 

​

Records may be retained longer where an investigation, legal claim or other justified hold applies. When information is no longer required, we securely delete, destroy or anonymise it. 

​

You can contact us for the retention period applicable to a particular record. 

​

10. How we protect information 

​

We use appropriate technical and organisational measures to protect personal information against unauthorised access, loss, misuse or disclosure. 

​

These include access controls, confidentiality requirements, staff guidance, secure handling of paper records and appropriate protection of electronic systems. 

​

If a personal data breach occurs, we assess it and notify affected individuals and the relevant regulator where required by law.

 

11. Information processed outside the UK 

​

Some technology suppliers may store information, or provide support, outside the UK. 

​

Where a restricted international transfer takes place, we ensure an appropriate transfer mechanism is in place. This may include UK adequacy regulations or approved contractual safeguards, supported by any required assessment and additional protections. 

​

You can contact us for information about relevant transfers and how to obtain details of the safeguards used. 

​

12. Cookies and website services 

​

Our website may use cookies and similar technologies for essential functions and, where enabled, analytics or other optional features. 

​

Our Cookie Notice explains which technologies are used, their purposes, their duration and how to manage your preferences. 

Where consent is required, optional technologies will only operate after you agree. You can withdraw that consent through the website’s cookie settings. 

​

External websites linked from our website have their own privacy notices. 

​

13. Marketing and photographs 

​

We will only send electronic marketing where permitted by law. You can unsubscribe using the link in a marketing message or by contacting us. 

​

Messages needed to administer a booking, course or service are separate from marketing. 

​

We do not use patient records for marketing. We will seek separate permission before using identifiable patient photographs, testimonials or case studies for promotional purposes. 

​

14. Children’s information 

​

We take particular care when handling children’s information and explain its use in a way appropriate to their age and understanding. 

​

We involve parents or guardians where appropriate, while considering the child’s capacity, confidentiality rights and safeguarding needs. 

​

A parent or guardian does not automatically have unrestricted access to a child’s confidential medical information. 

​

15. Your rights 

​

Depending on the circumstances, you may have the right to: 

• Be informed about how we use your information. 

• Request access to your personal information and a copy of it. 

• Ask us to correct inaccurate or incomplete information. 

• Ask us to erase information. 

• Ask us to restrict its use. 

• Object to processing based on legitimate interests. 

• Receive certain information in a portable format. 

• Withdraw consent where processing relies on consent. 

• Raise a complaint about our handling of your information. 

​

You have an absolute right to object to the use of your personal information for direct marketing. 

​

Other rights are subject to conditions and exemptions. For example, we may need to retain an accurate medical record or information required for a legal claim. 

​

To exercise your rights, email info@fenresponsemedical.co.uk. We may request proportionate information to verify your identity.

 

We normally respond without undue delay and within one month. Where the law allows an extension or a pause to clarify a request or verify identity, we will explain this. Requests are normally free of charge. 

​

16. Providing information and automated decisions 

​

Some information is needed to arrange a booking, issue a certificate, provide safe care or meet a legal requirement. We will explain when information is required and the likely consequences of not providing it. 

​

Choosing not to provide optional marketing information will not affect your access to our services. 

​

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. 

​

17. Complaints 

If you are concerned about how we have handled your personal information, please contact: 

​

Managing Director — Data Protection 

​

Email: info@fenresponsemedical.co.uk 

​

Address: 205 New Barns Avenue, Ely, Cambridgeshire, CB7 4RE 

​

We will acknowledge your complaint within 30 days, investigate it and keep you informed of progress and the outcome. 

​

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator. 

​

Website: ico.org.uk/make-a-complaint 

​

18. Changes to this notice 

​

We review this notice when our services, systems or legal obligations change. The current version will be available on our website. 

​

Where a change materially affects how we use your information, we will provide an appropriate additional notification.