Menu

Privacy Policy

Blatchford Group is a world leading rehabilitation provider with clinical expertise in prosthetics, orthotic, special seating and wheelchairs. This privacy policy explains how we use any personal information we collect about you, as a past, present, future employee, a service user or when you use our website.

What information we collect about you

Web access collection of information

Blatchford collects personal data through its website to provide services, respond to enquiries, and improve user experience. This includes data submitted voluntarily and data collected automatically through analytics tools.

Cookie Usage

We use cookies to enhance your experience on our website, including storing preferences, enabling ecommerce functionality, and supporting analytics and social media features. For full details on the types of cookies we use and your consent options, please see our Cookie Policy.

When you interact with our website, we may collect:

  • Name, email address, and contact details (when registering, placing orders, or requesting a catalogue)
  • Information submitted via contact forms and mailing list subscriptions
  • Website usage data collected via cookies and Google Analytics
  • Any other personal data you voluntarily provide

This personal information always requires your confirmation before it is submitted to Blatchford. You may refuse to provide it; however, this may prevent you from engaging in certain website activities, such as receiving requested information.

Blatchford always aims to minimise the amount of personal information required to deliver a specific service or feature.

We Use This Data To:

  • Process product or service orders
  • Respond to enquiries and send requested information
  • Manage subscriptions and mailing lists
  • Improve website functionality and user experience
  • Ensure secure and personalised access to online features

UK Health record collection and confidentiality

When you are a patient of Blatchford, we record all your treatment and appointment details so that your clinician, nurse, or other healthcare professional can plan your care appropriately. To ensure your safety and continuity of care, we collect personal information such as your name, address, next of kin, and ethnic origin, along with records of clinic visits, investigation results, and correspondence related to your treatment.

We also document your treatments, allergies, medications, reactions to medicines, and any long-term conditions such as diabetes or asthma. These records are kept confidential within Blatchford and are only accessed by staff who need them to carry out their duties. All staff are bound by strict professional and contractual codes of confidentiality. Where possible, we anonymise data to protect your identity.

We only share your information with external organisations directly involved in your care, such as NHS hospitals, community nurses, or therapy staff. Your data is retained in accordance with the NHS Code of Practice for Records Management. For more details on retention periods, please contact our Data Protection Officer at [email protected]

What we may collect:

  • Personal details: name, address, next of kin, ethnic origin
  • Appointment and treatment history
  • Results of investigations and clinical correspondence
  • Information on allergies, medications, and reactions
  • Details of long-term conditions (e.g., diabetes, asthma)

We Use This Data To:

  • Plan and deliver safe and effective treatment
  • Maintain accurate clinical records
  • Support continuity of care across appointments and services
  • Communicate with other healthcare professionals involved in your care

UK National Data Opt-Out

Blatchford applies the UK National Data Opt-Out in accordance with NHS Digital guidance, where we act as a provider of publicly funded health services in England. This means that if you have registered an opt-out, we will not use your confidential patient information for research or planning purposes, unless required to do so by law.

As part of delivering our UK services, we may collect and use information for purposes beyond your individual care, such as:

  • Improving the quality and standards of care we provide
  • Supporting research and development of our products
  • Monitoring health and safety across our services

These activities are only carried out when there is a clear legal basis for using your information. They help us to improve healthcare for you and future generations.

You have a choice about whether your confidential patient information is used for these broader purposes. If you are happy for your data to be used in this way, no action is needed. If you choose to opt out, your information will still be used to support your individual care, but not for research or planning.

In most cases, we use anonymised data for research and planning, which means you cannot be identified and your confidential patient information is not required.

To learn more or to register your choice, please visit www.nhs.uk/your-nhs-data-matters.

For further details, please contact our Data Protection Officer. Contact information is provided at the end of this policy.

Wheelchair Service Self-Referrals

Blatchford provides wheelchair services through NHS clinics, including the option for patients to self-refer via our website. This service is designed to support individuals with long-term mobility needs who may be eligible for a manual wheelchair.

What we may collect:

  • Name, contact details, and date of birth
  • Medical and mobility-related information
  • Details of your current condition and equipment needs
  • Information about your eligibility for NHS services
  • Any other personal data you provide to support your referral

We use this data to:

  • Assess your eligibility for wheelchair services
  • Schedule clinical assessments and appointments
  • Provide appropriate equipment and support
  • Communicate with you regarding your referral and care

Clinical Study Volunteers

Blatchford occasionally collects and processes personal data from individuals who participate in clinical evaluations, product trials, or who voluntarily share their experiences through case studies and true stories, including those related to the Tectus® orthotic device.

What we may collect:

  • Health and medical information relevant to their condition and treatment
  • Photographs, videos, and written testimonials
  • Biographical and contact details
  • Information about their use of Blatchford products and services

Purpose of Processing

With your explicit consent, we may use this data for:

  • Clinical evaluation and product development
  • Educational and training materials
  • Marketing and promotional content (e.g., website, social media, brochures)
  • Public case studies and true stories to raise awareness and share lived experiences

Advocate Programme, Case Studies and Social Media Releases

Blatchford is proud to share the experiences of individuals who use our products through initiatives such as the Advocate Programme, True Stories, and Case Studies. These programmes are designed to inspire others, raise awareness, and promote understanding of life with prosthetic and orthotic devices.

If you choose to participate in any of these initiatives, we may collect and process the following types of personal data:

  • Name, contact details, and biographical information
  • Photographs, videos, and written testimonials
  • Information about your use of Blatchford products and services
  • Social media handles (if provided)
  • Any other personal data you voluntarily provide

How We Use This Data:

  • With your explicit consent, we may use your data for the following purposes:
  • Publishing your story on our website, social media platforms, and marketing materials
  • Featuring you in brochures, exhibitions, advertising, and promotional campaigns
  • Sharing your experiences in internal training, educational resources, and public communications
  • Creating and distributing content across digital and print media

Medical Device Supply

When Blatchford has been instructed to supply you a medical device, the order contains some personal information. Blatchford needs the information to be able to supply the correct device for your treatment. The use of the personal details ensures that the product supplied is fit for purpose, for warranty purposes and for maintenance history. Details include name, activity level, weight, gender, age, relevant measurements and delivery address. These records are kept confidential within the Company at all times and are only shared with staff when they need it to carry out their job. All staff are required to work to strict professional standards and have signed contractual codes of confidentiality. The minimum amount of personal information is used in order to supply the right medical device to you. If you want more details on how long we will hold your information then contact the company Data Protection Officer.

To support the supply of your medical device, we may collect and process the following types of personal data:

  • Name and contact details
  • Activity level and weight
  • Gender and age
  • Relevant anatomical measurements
  • Delivery address
  • Any other data necessary to ensure the device is clinically appropriate

We use your personal data for the following purposes:

  • Ensuring the medical device is suitable and fit for your clinical needs
  • Fulfilling warranty and maintenance obligations
  • Maintaining accurate records of product history and service
  • Complying with regulatory and contractual obligations

Job Applicants, Current and Former Employees

When individuals apply to work at Blatchford, we will only use the information you supply to us to process your application and to monitor recruitment statistics. Where we want to disclose information to a third party, for example to take up a reference or obtain a disclosure from the Disclosure and Barring Service, we will not do so without informing you beforehand unless the disclosure is required by law.

Personal information about unsuccessful job candidates will be held for 3 months after the recruitment exercise has been completed. It will then be securely destroyed or deleted.

Once a person has taken up employment with Blatchford, we compile a file relating to their employment. The information contained in this file is kept secure and is only used for purposes directly relevant to that person’s employment. Once their employment with Blatchford has ended, we retain the file in accordance with our retention schedule and then delete it.

We may collect and process:

  • Contact details, CVs, and application forms
  • Employment history, qualifications, and references
  • Interview notes and assessment results
  • Background checks, including DBS disclosures where applicable
  • Employment-related records during and after your time with us

We use your personal data to:

  • Manage recruitment and assess suitability for roles
  • Fulfil employment obligations and maintain HR records
  • Comply with legal and regulatory requirements
  • Monitor and improve our recruitment and employment practices

Data Access and Confidentiality

Your data is only accessible to staff involved in recruitment or employment matters. All staff are bound by confidentiality obligations and professional standards.

Retention

Unsuccessful applicants: Data is retained for 3 months after the recruitment process concludes.

Employees: Data is retained in line with our internal retention schedule and securely deleted thereafter.

Third Party Processors

We use a number of third parties to process personal data on our behalf. The third parties have been carefully chosen and use Standard Contractual Clauses to comply with EU data protection regulations. These are:

  • Hotjar (Privacy Policy)
  • Salesforce (Marketing Cloud) (Privacy Policy)
  • Dayforce (Dayforce - Dayforce Privacy Policy)
  • Microsoft, for user authentication/authorisation.
  • Zoom, for webinars
  • Survey Monkey, for Customer Service surveys

Email communications

If you choose to join our mailing list, Blatchford uses the third party service Salesforce Marketing Cloud to provide our mailing list functionality. Refer to the ‘Third Party Processors’ section of this notice for information about them. Blatchford mailing lists include email address, name and country information and this information is stored on Marketing Cloud servers hosted in the EU. It is always possible to remove your personal data from our mailing list by opting out via the ‘Unsubscribe’ link at the bottom of any emails sent by Blatchford via Marketing Cloud. If you have difficulties removing yourself from the list then contact our Data Protection Officer.

Data Security and Protection

Blatchford is committed to safeguarding the personal data we collect and process. We implement a comprehensive set of technical and organisational measures to ensure the confidentiality, integrity, and availability of personal data, and to protect it against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.

Technical Measures

  • Access controls: Personal data is stored in secure systems with role-based access permissions, ensuring only authorised personnel can access relevant information.
  • Secure infrastructure: Our IT systems are protected by firewalls, intrusion detection systems, and regular vulnerability assessments.
  • Data backup and recovery: We maintain secure backup procedures and disaster recovery plans to ensure data availability and resilience.

Organisational Measures

  • Staff training: All employees receive regular training on data protection, information security, and secure handling of personal data.
  • Policies and procedures: We maintain internal policies governing data access, handling, retention, and disposal, aligned with legal and regulatory requirements.
  • Confidentiality agreements: Staff are contractually bound by confidentiality clauses and professional standards.
  • Third-party oversight: Where we engage external service providers, we ensure they meet our security standards through contractual agreements and due diligence.

Monitoring and Review

  • We regularly review and update our security controls to reflect changes in technology, risk, and regulatory requirements. Security incidents are managed through defined procedures, including investigation, mitigation, and reporting where necessary.

Access to Your Information and Correction

Blatchford tries to be as open as it can be in terms of giving people access to their personal information. Individuals can find out if we hold any personal information by making a ‘subject access request’ or ‘Right of Access’ under the Data Protection Act and the General Data Protection Regulation. We will then supply to you:

  • A description of all data we hold about you
  • Inform you how it was obtained (if not supplied by you)
  • Inform you why, what purposes, we are holding it
  • What categories of personal data is concerned
  • Inform you who it could be disclosed to
  • Inform you of the retention periods of the data
  • Inform you around any automated decision-making including profiling
  • Let you have a copy of the information in an intelligible electronic form unless otherwise requested.

To make a request to Blatchford for any personal information we may hold, you will need to request the information from us, either verbally or in a written format. You have the choice of either completing the Subject Access Request (SAR) form, or via email, or via letter to the address provided below. Please be aware the form is NOT mandatory. However, it can speed up the process. If you agree, we will try to deal with your request informally, for example by providing you with the specific information you need over the telephone. We want to make sure that your personal information is accurate and up to date. You may ask us to correct or remove information you think is inaccurate, please address these changes to the Information Security office, by contacting us.

Your Rights under the GDPR

Under the General Data Protection Regulation (GDPR) and other applicable data protection laws, you have certain rights regarding your personal data. These rights are designed to give you control over how your data is collected, used, and stored.

Right to Access: You have the right to request access to your personal data that we hold about you. This includes information about the data we collect, how it is used, and who it is shared with.

Right to Rectification: If your personal data is inaccurate or incomplete, you can request that we correct or update it.

Right to Erasure (Right to be Forgotten): You can request the deletion of your personal data in certain circumstances, such as when it is no longer necessary for the purposes for which it was collected, or if you withdraw your consent on which the processing is based.

Right to Restrict Processing: You have the right to request that we limit the processing of your personal data under specific conditions, such as when you contest the accuracy of the data or object to its processing.

Right to Data Portability: You can request that we transfer your personal data to another organization or to you in a structured, commonly used, and machine-readable format, where technically feasible.

Right to Object: You have the right to object to the processing of your personal data for direct marketing purposes, or when processing is based on legitimate interests, unless we have compelling legitimate grounds for the processing.

Rights Related to Automated Decision-Making: You have the right to not be subject to decisions based solely on automated processing, including profiling, which produces legal effects concerning you or significantly affects you, unless such processing is necessary for the performance of a contract, authorized by law, or based on explicit consent.

California Online Privacy Protection Act (CalOPPA)

CalOPPA is the first state law in the USA to require commercial websites and online services to post a privacy policy. The law’s reach stretches well beyond California to require any person or company in the United States (and conceivably the world) that operates websites collecting Personally Identifiable Information from California consumers to post a conspicuous privacy policy on its website stating exactly the information being collected and those individuals or companies with whom it is being shared. – See more at: http://consumercal.org/california-online-privacy-protection-act-caloppa/#sthash.0FdRbT51.dpuf

According to CalOPPA, we agree to the following:

  • Users can visit our site anonymously.
  • You will be notified of any Privacy Policy changes:
  • You can request to change your personal information by emailing us

California Consumer Privacy Act (CCPA)/California Privacy Rights Act (CPRA): In California, you have additional rights including the right to know what personal data is being collected, the right to opt out of the sale of your personal data, and the right to access and delete your data

Regional Variations in Data Protection Law

Blatchford is committed to respecting privacy rights across all jurisdictions in which we operate. In addition to California-specific laws such as CalOPPA and the CCPA/CPRA, individuals in other regions may be entitled to additional protections under local, state, or national legislation.

EU Member State Variations

While the General Data Protection Regulation (GDPR) provides a unified framework for data protection across the European Union, individual member states may implement additional requirements or procedures. These can include:

  • Age thresholds for consent
  • Specific rules for processing employee data
  • National registration or notification obligations for certain types of processing
  • Enhanced rights in areas such as automated decision-making or profiling

Blatchford endeavours to comply with both the GDPR and any applicable national laws in the EU countries where we operate or process data.

Other U.S. State Laws

Several U.S. states have enacted or proposed privacy legislation that may grant residents additional rights or impose obligations on businesses. These include, but are not limited to:

  • Virginia Consumer Data Protection Act (VCDPA)
  • Colorado Privacy Act (CPA)
  • Connecticut Data Privacy Act (CTDPA)
  • Utah Consumer Privacy Act (UCPA)

Depending on your location, you may have rights such as:

  • The right to access or delete personal data
  • The right to correct inaccurate information
  • The right to opt out of targeted advertising or profiling
  • The right to receive notice about data collection and sharing practices

UK GDPR

Following Brexit, the United Kingdom has adopted its own version of the GDPR, known as the UK GDPR, which largely mirrors the EU regulation but is enforced by the Information Commissioner's Office (ICO). Blatchford complies with the UK GDPR when processing data of individuals located in the UK, including adherence to lawful bases, data subject rights, and international transfer safeguards.

Blatchford will honour applicable rights and obligations under these laws where required.

Exercising Your Rights

Blatchford maintains a set of policies and procedures for managing any requests that you might submit to exercise your rights under the applicable data protection regulations. This includes how to handle subject access requests, logging, timeframes, and legal requirement which is centrally overseen and reported.

A Data Protection Officer has been appointed. To make a request to Blatchford for any personal information we may hold, you will need to request the information from us, either verbally or in a written format. You have the choice of either completing the Subject Access Request (SAR) form, or via email, or via letter to the address provided at the end of this Privacy Policy.

Please be aware the form is NOT mandatory. However, it can speed up the process. If you agree, we will try to deal with your request informally, for example by providing you with the specific information you need over the telephone. We want to make sure that your personal information is accurate and up to date. You may ask us to correct or remove information you think is inaccurate, please address these changes to the Information Security office, by contacting us.

Disclosure of Personal Information

In many circumstances we will not disclose personal data without consent. However, when we investigate a complaint we may need to share personal information with other relevant bodies.
By contacting the Data Protection Officer, by email and/or using the address below you can also get more details on:

  • agreements we have with other organisations for sharing information;
  • circumstances where we can pass on personal data without consent for example, to prevent and detect crime and to produce anonymised statistics;
  • our instructions to staff on how to collect, use and delete personal data; and
  • how we check that the information we hold is accurate and up to date.

Other Websites

Our website contains links to other websites. Our privacy policy only applies to this website, we would encourage you to read the privacy statements on the other websites you visit.

Children's Data Protection

Blatchford does not knowingly collect personal data from children under the age of 13 without parental consent. Where services are provided to minors, we ensure that appropriate safeguards are in place and that consent is obtained from a parent or legal guardian in accordance with applicable laws.

International Data Transfers

Blatchford may transfer personal data outside of the UK, EU or US to third-party processors, service providers, or to other entities with the Blatchford Group. Where such transfers occur, we ensure appropriate safeguards are in place, including Standard Contractual Clauses, to protect your data in accordance with GDPR and other applicable laws.

Complaints or Queries

Blatchford tries to meet the highest standards when collecting and using personal information. For this reason, we take any complaints we receive about this very seriously. We encourage people to bring it to our attention if they think that our collection or use of information is unfair, misleading or inappropriate. We would also welcome any suggestions for improving our procedures. If you do have a complaint, contact the Data Protection Officer who will investigate the matter on your behalf.

If you are not satisfied with the response from Blatchford or believe we are not processing your personal data in accordance with the law you have the right to raise your complaint with the UK Information Commissioner’s Office (ICO)

Contact information UK ICO:
Website:https://ico.org.uk/concerns/
Email:[email protected]
Telephone: +44 (0) 303 123 1113

Changes to This Privacy Notice

We keep our privacy notice under regular review and we will place any updates on this web page. This privacy notice was last updated on xx/xx/xx

Who We Are and How to Contact Us

Blatchford Group is the company that you are supplying your personal information to. The Data Protection Officer for Blatchford and can be contacted by:

Email:[email protected]

Post:
HR Director – Information Security
Blatchford Ltd
Unit D Antura
Kingsland Business Park
Basingstoke
Hampshire
RG24 8PZ