Last updated: 10 July 2026
1. ABOUT THIS POLICY
This policy explains how Sugarman Health and Wellbeing Limited and its subsidiary companies (“we”, “us”, “our”, or “the Company”) collect, use, share and protect your personal data, and the rights you have. It applies to candidates, temporary and locum workers, clients, website visitors and anyone else whose personal data we handle. It should be read together with our terms of business and any other notices we give you when we collect your data.
We may update this policy from time to time – see “Changes to this policy” below.
2. WHO IS THE DATA CONTROLLER AND HOW TO CONTACT US
Sugarman Health and Wellbeing Limited is the data controller for the personal data described in this policy. Where another company is the controller, we will make that clear when we collect your data.
We are registered with the Information Commissioner’s Office (ICO) under registration number [ICO registration number].
We have appointed a Data Protection Officer (DPO). You can contact our DPO about anything in this policy or to exercise your rights:
– DPO name / title: Stuart Pepper
– Email: sp@t20capital.com
– Post: 33 Soho Square, London, W1D 3QU
General contact details are on the “Contact us” page of our website.
3. THE PRINCIPLES WE FOLLOW
We comply with the data protection principles in the UK GDPR and the Data Protection Act 2018. This means personal data must be:
– processed lawfully, fairly and in a transparent way;
– collected only for specified, explicit and legitimate purposes (purpose limitation);
– adequate, relevant and limited to what is necessary (data minimisation);
– accurate and kept up to date;
– kept no longer than necessary (storage limitation);
– kept secure (integrity and confidentiality); and
– handled in a way we can demonstrate and be accountable for (accountability).
The ICO regulates our compliance with data protection law.
4. PERSONAL DATA WE COLLECT
Depending on your relationship with us, we may collect and process:
– Information you give us by filling in forms on our site or otherwise – for example when you register, subscribe, post material, request services, enter a competition or promotion, complete a survey, or report a problem;
– Records of your correspondence with us;
– Recruitment information – your CV, work history, qualifications, references, availability and details of the services you provide to our clients;
– Identity and eligibility information – for example right-to-work, DBS and background-check information;
– Where we provide or arrange care and support for you as a service user: information about your care and support needs, your health and medical information, care and support plans, risk assessments, records of the care provided, and details of your family, carers, advocates or representatives;
– Health and other special category information relevant either to a worker’s suitability for health and social care roles, or to the care and support we provide to service users (see section 7);
– Technical and usage data about your visits to our site – for example IP address, device and browser type, location data and pages viewed (see section 9 on cookies).
5. WHERE WE GET YOUR DATA FROM
We collect most information directly from you. We also obtain personal data from other sources.
For candidates and workers, in particular:
– job boards, professional networking sites and CV databases where you have made your details available;
– your named referees and, where relevant, previous employers;
– background-check, right-to-work and DBS providers, and occupational-health assessors.
Where we provide or arrange care and support services, we also receive personal data about service users from:
– local authorities, the NHS, integrated care bodies and other organisations that commission or fund your care;
– GPs, hospitals, community health teams and other healthcare and social care professionals involved in your care;
– your family members, carers, advocates or legal representatives (for example an attorney or court-appointed deputy); and
– social workers and safeguarding professionals.
6. HOW AND WHY WE USE YOUR DATA, AND OUR LAWFUL BASIS
We only use your personal data where the law allows. The main ways we use it, and our lawful basis for each, are:
– Registering you and providing recruitment services (contact details, identity, work history, qualifications, availability): Contract; and steps taken at your request before a contract.
– Placing you with, and supplying your services to, our clients (profile, references, right-to-work, suitability information): Contract; and legitimate interests.
– Providing or arranging health and social care and support for you as a service user (care and support needs, health information, care plans, risk assessments, records of care): Contract, where you arrange or pay for your own care; a legal obligation or public task, where a local authority, the NHS or another body commissions your care; and, in an emergency where you cannot give consent, your vital interests or those of another person.
– Meeting legal and regulatory obligations – right-to-work, safeguarding, tax, working-time records, and care regulation (identity, right-to-work, DBS/health-check outcomes, payroll data, care records): Legal obligation; and, for regulated care, our public task and regulatory duties.
– Assessing fitness and suitability to work in health and social care roles (occupational-health, DBS and health-check information – special category): Legal obligation, plus the conditions in section 7.
– Administration, customer service and improving our services (account, correspondence, survey and website-usage data): Legitimate interests.
– Marketing our services to you (contact details and preferences): Consent; or legitimate interests where the “soft opt-in” applies.
Where we rely on legitimate interests, our interests are running and growing our business and matching suitable workers with clients; we balance these against your rights and you can object at any time (see section 14). Where we provide regulated care, we also process personal data to meet our duties as a care provider and to keep people safe.
7. HEALTH AND OTHER SPECIAL CATEGORY DATA
We process “special category” data (such as health, and information about care needs) and criminal-records information (such as DBS results) in two main situations: to assess a worker’s suitability for health and social care roles, and to provide care and support to service users. In addition to a lawful basis in section 6, we rely on the following conditions.
For assessing workers:
– processing necessary for the assessment of your working capacity as an employee or worker, carried out under the responsibility of a professional subject to a duty of confidentiality (Article 9(2)(h) UK GDPR); and
– where needed, obligations in the field of employment law (Article 9(2)(b)).
For providing care and support to service users:
– processing necessary for the provision of health or social care or treatment, and the management of health or social care services, carried out under the responsibility of a professional (or another person) subject to a duty of confidentiality (Article 9(2)(h) UK GDPR); and
– in an emergency, where you are physically or legally incapable of giving consent, to protect your vital interests or those of another person (Article 9(2)(c)).
For safeguarding:
– where we process special category or criminal-records data to protect children or adults at risk of harm or neglect, we rely on the safeguarding conditions in Schedule 1 to the Data Protection Act 2018, and we may share information without your consent where the law allows and it is necessary to protect someone.
Mental capacity: where a service user lacks capacity to make a particular decision, we handle their personal data in their best interests in line with the Mental Capacity Act 2005, and we will deal with anyone lawfully acting for them, such as an attorney under a lasting or enduring power of attorney or a court-appointed deputy.
Children and young people: where we provide services to people under 18, we take extra care with their personal data and, where appropriate, involve those with parental responsibility.
We only collect special category and criminal-records data where it is necessary, we apply extra safeguards to keep it secure, and we keep an Appropriate Policy Document as required by the Data Protection Act 2018.
8. MARKETING
We will only send you marketing where we are allowed to. We send marketing by email and SMS only where you have opted in, or where you are an existing client and the message relates to similar services you have already received from us (the “soft opt-in”), in which case every message includes an easy way to opt out.
We may contact you by telephone about opportunities and services; where required we screen numbers against the Telephone Preference Service and stop if you ask us to.
You can opt out of marketing at any time – by using the unsubscribe link in any message, by telling your recruitment consultant, or by contacting our DPO. Withdrawing consent is as easy as giving it and does not affect anything we did beforehand.
9. COOKIES AND SIMILAR TECHNOLOGIES
When you visit our websites we use cookies and similar technologies. Some are strictly necessary to make the site work. Others – for example analytics cookies and advertising or third-party cookies – are only used in line with the choices you make.
We ask for your consent through the cookie banner shown when you first visit, and you can change your preferences at any time. Strictly necessary cookies do not require consent. Analytics cookies used only for statistical purposes may operate on an opt-out basis where the law allows, but we still tell you about them and give you a way to opt out. Advertising and other non-essential third-party cookies are only set where you have given consent.
Our cookie banner and our separate Cookie Policy list the specific cookies we use, their purpose and how long they last.
10. WHO WE SHARE YOUR DATA WITH
We may share your personal data with:
– clients to whom we are proposing or supplying you, so they can assess and engage you;
– other companies in our group – our subsidiaries, ultimate holding company and its subsidiaries (as defined in section 1159 of the Companies Act 2006) – where they act as controller or processor for the purposes in this policy;
– our service providers acting as processors under written contracts (for example IT, payroll, background-checking and occupational-health providers);
– where we provide or arrange your care: the healthcare and social care professionals involved in your care, such as your GP, hospital, pharmacy and community health teams;
– your family members, carers, advocates or representatives, where appropriate and in line with your wishes and best interests;
– local authorities, the NHS and other bodies that commission, fund or are involved in your care;
– the Care Quality Commission and other regulators, and local safeguarding partners, the police and other authorities, where we need to share information to safeguard a child or adult at risk, to comply with care regulation, or where we are otherwise legally required or permitted to do so, including for fraud prevention and credit-risk reduction; and
– a buyer or seller (and their advisers) if we sell or reorganise our business or assets.
We only share what is necessary and require our processors to keep your data secure and use it only on our instructions.
11. INTERNATIONAL TRANSFERS
11. INTERNATIONAL TRANSFERS
We store the personal data we hold about candidates, workers, clients and service users in the UK, and we do not routinely transfer this operational data outside the UK.
Some of the third-party services we use to run our website do, however, involve a limited amount of technical data being processed outside the UK. When you visit sugarmanhealth.com, services that provide website analytics (only where you have consented), web fonts and interactive maps may receive technical information such as your IP address and details about your device or browser. The providers we currently use for this are Google (which provides Google Analytics and Google Maps) and Adobe (which provides the Typekit web fonts); both are based in, or process data in, the United States.
Where personal data is transferred outside the UK, we make sure it is protected by an appropriate safeguard recognised under UK data protection law – for example UK “adequacy” regulations covering the country concerned, the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses – together with a transfer risk assessment where required. You can ask us for more information about the safeguards we use by contacting our Data Protection Officer using the details in section 2.
12. HOW LONG WE KEEP YOUR DATA
We keep personal data only for as long as necessary for the purposes we collected it for, including to meet legal, regulatory, tax, accounting and safeguarding requirements. In general:
– recruitment and placement records are kept for [e.g. 6] years after our last engagement with you, reflecting limitation periods for potential claims;
– certain records must be kept longer under sector rules – for example safeguarding, DBS, right-to-work and health records – in line with NHS, CQC and statutory retention requirements;
– marketing data is kept until you opt out or after a period of inactivity;
– website and analytics data is kept for [period].
When we no longer need personal data we securely delete or anonymise it.
13. AUTOMATED DECISION-MAKING AND PROFILING
We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. A member of our team is always involved in decisions about your suitability and placement. If this changes, we will tell you and explain your rights.
14. YOUR RIGHTS
Under UK data protection law you have the right to:
– be informed about how we use your data (this policy);
– access a copy of your data (a subject access request);
– have inaccurate or incomplete data corrected;
– have your data erased (the right to be forgotten) in certain circumstances;
– restrict or object to our processing, including objecting to direct marketing at any time;
– data portability – to receive certain data in a portable format or have it transferred;
– withdraw consent at any time where we rely on consent; and
– complain to the ICO (see section 16).
Some rights only apply in particular situations. Where we cannot fully comply – for example because we must keep data to meet a legal obligation, for public-health reasons, or to establish, exercise or defend legal claims – we will explain why. Where we erase or correct data, we will, where possible, tell others we have shared it with.
15. HOW TO MAKE A REQUEST
To exercise any of your rights, contact our DPO using the details in section 2. We may need to confirm your identity by reasonable means. There is usually no charge. We will respond within one month. If your request is complex or you have made several requests, we may extend this by up to two further months and will tell you within the first month if so. In limited cases we may charge a reasonable fee or refuse a request that is manifestly unfounded or excessive – if we do, we will explain why and tell you about your right to complain.
16. COMPLAINTS
If you are unhappy with how we have handled your personal data, please contact our DPO first so we can try to put things right. You also have the right to complain to us formally, and we will acknowledge your complaint and respond.
You can also complain to the Information Commissioner’s Office at any time – ico.org.uk, or 0303 123 1113.
17. OTHER WEBSITES AND THIRD PARTIES
Our site may contain links to and from third-party websites, including those of partners, advertisers and affiliates. Those sites have their own privacy policies and we are not responsible for them – please check their policies before submitting any personal data.
If you give us personal data about another person, please make sure they know how their data will be used and, where relevant, that you are entitled to provide it.
18. CHANGES TO THIS POLICY
We may update this policy from time to time to reflect changes in the law, best practice or our services. The latest version will always be on our website and we will tell you about significant changes where appropriate. This policy was last updated on 10 July 2026.