Riverstone Healthcare Partners

Privacy Policy

Website Privacy Policy

Riverstone Healthcare Partners Ltd
Prepared: 13 October 2026
Publication/revision date: 15 October 2026

1. Scope

This notice explains how Riverstone Healthcare Partners Ltd (“Riverstone”, “we”, “us”, “our”) handles personal information when you visit https://riverstonehealthcare.co.uk, make an enquiry or communicate with us about our services.

It covers website-related enquiries and preliminary discussions, not a complete account of care-record or employment processing. If you become a client, undergo a detailed assessment or apply for employment, we will provide the relevant additional privacy information.

We handle information under applicable UK data protection law, including the UK GDPR and Data Protection Act 2018, as amended. Website use is not itself consent to processing that requires consent.

2. Who is responsible for your information

Riverstone Healthcare Partners Ltd is the controller for the website-related activities described here.

Company number: 16440437
Registered in: England and Wales
Registered office: 159b Manor Road, Chigwell, IG7 5QA

Business/contact address: 4 Cottesbrooke Close, Daventry, NN11 8BF, United Kingdom
Email: enquiries@riverstonehealthcare.co.uk
Telephone: +44 20 3757 1147

For privacy requests or complaints, contact us using these details and mark your message “Data protection”.
Dedicated privacy contact or Data Protection Officer, if applicable: [Insert confirmed details or remove this line if not applicable].

3. Information we collect and its sources

Information you supply may include your name, contact details, preferred contact method, relationship to a prospective service user, enquiry content and relevant follow-up communications.

An enquiry may include information about care needs, disability or health. Health information is special-category personal data and receives additional protection. Please do not submit detailed medical records or unnecessary sensitive information through general enquiry facilities.

Technical information may include IP address, browser, operating system, request timestamps, security events and website interaction information, depending on the technologies actually deployed.

We receive information directly from you and, where relevant, from relatives, authorised representatives, referring professionals or organisations. Technical information is generated through website use and providers supporting the website. We provide privacy information to the person concerned where required, subject to applicable exceptions.

If you contact us on another person’s behalf, ensure you have appropriate authority or another lawful basis to share their information. Authority to make an enquiry does not automatically entitle you to receive their confidential information.

4. Purposes and lawful bases

The table below describes our proposed website-processing activities. The bases are applied according to the purpose, not treated as interchangeable options. Any health information additionally requires the condition explained in Section 5.

Activity	Information	Article 6 basis	Interest or qualification
Answer general enquiries, including enquiries from representatives	Contact details and enquiry content	Legitimate interests — Article 6(1)(f)	Responding to requested enquiries and running a responsive care business, balanced against individual rights.
Take requested steps towards a contract with the person concerned	Contact details and relevant pre-contract information	Article 6(1)(b)	Only where necessary at that individual’s request for a contract with them; not automatically applicable to every service-user or representative enquiry.
Maintain website security and investigate misuse	Technical logs and relevant communications	Legitimate interests — Article 6(1)(f)	Protecting visitors, information and systems; proportionate collection and retention.
Comply with an identified legal duty	Information required by the relevant duty	Legal obligation — Article 6(1)(c)	Only where a specific legal obligation applies; not used as a general justification.
Handle and defend legal claims	Relevant correspondence and records	Legitimate interests — Article 6(1)(f)	Establishing, exercising or defending rights and claims; special-category condition where needed.
Optional analytics and optional electronic marketing, if enabled	Permitted usage information or contact details and preferences	Consent — Article 6(1)(a)	Proposed consent-first approach. Any alternative analytics exception or marketing basis requires separate assessment and updated wording before use.

5. Health and other sensitive information

We minimise health information collected during an initial enquiry. A message or form submission does not automatically amount to explicit consent to process health information.

Where processing is necessary for providing or managing health or social care, we rely on Article 9(2)(h) only where its requirements, the relevant UK-law condition and confidentiality safeguards are satisfied. This does not authorise unrelated marketing or general analytics involving health information.

Where we specifically request explicit consent for an optional activity, we will explain its purpose and your choice separately. Where necessary for legal claims, Article 9(2)(f) may apply. Other activities, including safeguarding disclosures, require their own documented lawful basis and additional condition where applicable.

If an appropriate condition is not available for health information received, we will not continue using it for care evaluation merely because it was volunteered; we will restrict its handling and determine appropriate next steps.

[Before publication, confirm the actual Article 9 condition and confidentiality arrangements for care-enquiry handling. Amend this section if the described care condition is not available.]

6. Enquiry channels and information you need to provide

We use information submitted through the enquiry facilities actually available on the website, email or telephone to respond and arrange suitable next steps. General enquiries are not emergency channels.

Basic contact information is needed to respond. Providing other information is generally optional unless a specific field is identified as necessary. Without necessary details we may be unable to answer or assess the request.

Detailed confidential information should be shared only through an appropriate channel agreed with us. If a new purpose or further assessment requires additional information, we will explain it when collected.

7. Cookies and website technologies

The Cookie Policy explains the technologies actually used, their providers, purposes, duration and your choices. Necessary technologies and optional technologies must be distinguished; a functional label alone does not establish an exemption from consent.

Where consent is required, technologies must not operate until consent is given. Refusing optional cookies must not prevent ordinary access unless a lawful, separately assessed arrangement applies.

Cookie Policy: https://riverstonehealthcare.co.uk/cookie-policy-uk/
Cookie preference control: [Insert confirmed settings link or access instructions].

8. Analytics and embedded services

[Insert the confirmed analytics, embedded-content and communication services, or state that none are used. Do not publish this paragraph until the technology audit is complete.]

Optional analytics, where used, helps evaluate website performance and improve information. We will explain the provider, information collected, basis, retention and transfers, and provide appropriate controls.

We will not send names, email addresses, medical details or enquiry-message content to analytics or advertising tools as part of ordinary website measurement. The implementation must be configured and tested to support this restriction.

9. Sharing and recipients

We do not sell website personal information. We share only what is necessary and lawful with relevant recipients.

Recipient categories may include hosting and website-maintenance providers; email and enquiry-system providers; security and permitted analytics providers; professional advisers; and authorities or regulators where a lawful disclosure is required.

Where a care enquiry progresses, relevant sharing with care professionals, commissioners or other service providers will be explained through further privacy information as appropriate. Information is not shared with every category in every case.

Processors acting on our behalf must be subject to appropriate contractual arrangements. If a recipient acts as an independent controller, its role and relevant privacy information will be explained. A supplier’s own terms do not remove Riverstone’s responsibilities.

10. International transfers

[Insert confirmed countries, recipients, applicable adequacy arrangements or other safeguards for each restricted transfer, and how to obtain safeguard information. If the verified position is that no restricted transfers occur, replace this field with that statement.]

Transfers can arise through overseas storage or access. Before a restricted transfer, we must establish an applicable lawful mechanism, such as UK adequacy arrangements or appropriate safeguards, with any required assessment. You can contact us for relevant safeguard information, subject to legitimate redactions.

11. Retention

We retain information only for the necessary period. Retention decisions consider whether an enquiry remains active, whether it progresses to care, applicable record-keeping duties, complaint and legal-claim requirements, and the sensitivity of the information. We review records for deletion or secure anonymisation when no longer required.

Unsuccessful or closed enquiries: [Insert approved period from closure].
Technical/security logs: [Insert approved period and incident exception].
Analytics information: [Insert verified provider setting or state not used].
Marketing contacts and consent records: [Insert approved period and review criteria].
Privacy requests and complaints: [Insert approved retention period].

If an enquiry becomes a care relationship, relevant information will move into the care-record arrangements described in the service-user privacy notice. It is not automatically retained indefinitely. Minimal suppression information may be kept to respect marketing opt-outs.

A documented legal hold may delay deletion of relevant records until an investigation or claim is resolved.

12. Security

We use technical and organisational measures appropriate to the information and risks. These should include controlled access, suitable supplier arrangements, secure handling and disposal, staff awareness and appropriate system maintenance.

No internet transmission or system is completely secure. This does not remove our duties to safeguard information or manage and report incidents where required. Please report suspected website-related privacy or security concerns using our contact details.

13. Your rights

Subject to applicable conditions and exemptions, rights include access, correction, erasure, restriction, portability, objection and withdrawal of consent. Portability generally concerns automated processing based on consent or contract. Erasure and other rights do not apply in every circumstance.

You may object to legitimate-interest processing on grounds relating to your circumstances. You have an absolute right to object to direct marketing, including related profiling. Withdrawing consent does not affect processing already lawfully undertaken.

Contact enquiries@riverstonehealthcare.co.uk and identify the request. We may request proportionate identity or authority checks. Requests are normally answered within one month, subject to lawful extensions, pauses and other applicable rules. If an extension applies, we will explain it as required. Requests are normally free; exceptional charges or refusal require a lawful basis and explanation.

14. Marketing

Responding to your enquiry is different from subscribing you to promotional communications. Where consent is required for electronic marketing, we will request a separate choice; it will not be a condition of obtaining care information.

If marketing is used, each message will provide an easy opt-out. You may also contact us directly. Necessary service communications may continue where lawful after you opt out of marketing.

[Confirm whether marketing occurs and the relevant lawful basis and PECR route; remove unused marketing wording or amend it to the verified practice.]

15. Children and representatives

The website is not designed to encourage children to submit information independently. If an enquiry concerns a child, provide only necessary information and explain your relationship and authority where relevant.

We take account of a child’s rights, understanding and circumstances. A relative’s involvement does not automatically override the rights or confidentiality of a child or adult service user.

16. Automated decisions

[Confirm whether solely automated decisions with legal or similarly significant effects occur. If none occur, state: “We do not use website-enquiry information to make solely automated decisions that have legal or similarly significant effects.” If they occur, provide the required details, consequences and safeguards before publication.]

17. Complaints

You can make a data-protection complaint by email to enquiries@riverstonehealthcare.co.uk, by telephone on +44 20 3757 1147, or by writing to our business/contact address. Please explain the concern and the outcome you seek. We can discuss assistance or another suitable format if needed.

We will acknowledge a data-protection complaint within 30 days, investigate appropriately, keep you informed and communicate the outcome without undue delay. The acknowledgement period is not a blanket deadline for resolving every complaint.

You also have the right to complain to the Information Commissioner’s Office. ICO website: https://ico.org.uk/; telephone: 0303 123 1113. You do not need to waive that right to use our complaints process.

18. External websites and updates

Independent external websites have their own privacy information. A link does not transfer Riverstone’s responsibility for its own processing to another organisation.

We will update this notice when our practices or applicable requirements change and display the revision date. We will communicate material changes appropriately. A notice change does not itself provide a lawful basis for a new processing activity.

19. Contact and accessible information

Riverstone Healthcare Partners Ltd
Business/contact address: 4 Cottesbrooke Close, Daventry, NN11 8BF, United Kingdom
Email: enquiries@riverstonehealthcare.co.uk
Telephone: +44 20 3757 1147
Website: https://riverstonehealthcare.co.uk