Privacy & Cookie Policy

1. Who we are

This website is operated by Aries Medical Services Ltd, trading as Health Connections. Registered in England & Wales — Company No. 13460879. Registered office: Unit 46–56 Innovation Centre, Highfield Drive, St Leonards on Sea, TN38 9UH.

We are a CQC registered ambulance service provider (Provider ID: 1-12389332536). As a healthcare organisation we take our data protection obligations seriously. This policy explains how we collect and use personal data when you visit this website or contact us.

2. What data we collect and why

2.1 Enquiry and referral forms

When you complete the enquiry or referral form on this website, we collect:

• Your name and job title
• Organisation name
• Email address and phone number
• Details of your transport or commissioning enquiry

Legal basis: Legitimate interests (responding to a business enquiry) and, where relevant, performance of a contract or pre-contractual steps.
Retention: Enquiry data is retained for 24 months from last contact, then securely deleted.

2.2 Patient referral data

When NHS commissioners or clinical teams submit patient transport referrals, this may involve special category data (health information). This is processed under Article 9(2)(h) GDPR (healthcare purposes) and the NHS Data Security and Protection requirements (DSP Toolkit Ref: 8AB12). Patient data is processed strictly for the purpose of providing the commissioned transport service and is retained in accordance with NHS Records Management Code of Practice.

2.3 Website analytics

We use only essential, functional cookies by default. We do not load third-party analytics or advertising trackers without your explicit consent via the cookie banner. See Section 6 (Cookie Policy) for full details.

2.4 Server logs

Our web server automatically logs standard access data (IP address, browser type, pages visited, timestamps). This is used solely for security and operational purposes and is not linked to individual identities. Retained for 30 days.

3. Who we share your data with

We do not sell, rent or trade personal data. We may share data with:

• NHS commissioners and clinical teams — as necessary to fulfil a transport referral
• Our operational software provider — for job management and clinical governance purposes (under a data processing agreement)
• Our IT infrastructure provider — hosting and email services (under a data processing agreement)
• CQC and other regulatory bodies — where legally required

All third-party processors are bound by GDPR-compliant data processing agreements.

4. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate data
• Erase data we no longer need to retain
• Restrict processing in certain circumstances
• Object to processing based on legitimate interests
• Data portability where processing is automated and consent-based

To exercise any of these rights, contact us at dpo@healthconnections.co.uk. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk • 0303 123 1113.

5. Data security

We hold ISO 27001 certification for information security management. All data transfers are encrypted (TLS 1.2+). Access to personal data is restricted to authorised staff on a need-to-know basis. We maintain a data breach response procedure and will notify the ICO of reportable breaches within 72 hours.

6. Cookie Policy

6.1 What are cookies?

Cookies are small text files stored on your device when you visit a website. They help websites remember your preferences and function correctly.

6.2 Cookies we use

Essential cookies (always active)

These are necessary for the website to function and cannot be switched off.

Analytics cookies (only with consent)

We do not currently load any analytics cookies by default. If we introduce analytics in future, this policy will be updated and your consent will be requested via the cookie banner before any analytics cookies are set.

Third-party cookies

This website loads fonts from Google Fonts (fonts.googleapis.com). Google may set a connection cookie for performance purposes. No personal data is shared with Google as part of font loading.

6.3 Managing cookies

You can manage or delete cookies through your browser settings at any time. Note that disabling essential cookies may affect website functionality.

7. Changes to this policy

We may update this policy from time to time. Material changes will be notified on this page with an updated date. We recommend checking this page periodically.

8. Contact us