Last updated: November 2026

About this policy

This policy explains how Tiggo Care Limited (“Tiggo Care”, “we”, “us”, “our”) collects, uses, shares and protects personal information. It applies to:

• people who receive our care services, or are considering them (“clients”);
• people who arrange or pay for care on a client’s behalf, including attorneys, deputies and other representatives;
• clients’ next of kin and other family members we are in contact with;
• people who visit our website or contact us;
• people who apply to work with us; and
• our suppliers and their contacts.

It does not apply to our employees or carers, who receive a separate privacy notice.

We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, as amended from time to time (together, “data protection law”).

Who we are

Tiggo Care Limited is the data controller for the personal information described in this policy. This means we decide how and why it is used.

• Company: Tiggo Care Limited, registered in England and Wales
• Company number: 13517828
• Registered office: Hyde Park House, 5 Manfred Road, London SW15 2RS
• ICO registration number: ZB266288

We have appointed a Data Protection Officer (DPO), who is responsible for making sure we comply with data protection law and for handling questions and requests about your information:

• Email: dataprotection@tiggocare.com
• Phone: 020 8145 0052
• Post: Data Protection Officer, Tiggo Care Limited, Hyde Park House, 5 Manfred Road, London SW15 2RS

The information we collect

We only collect the information we need for the purposes set out in this policy. What we collect depends on how you are involved with us.

Clients and prospective clients

• Identity: name, title, date of birth, gender, marital status, photo ID and a photograph of you.
• Contact details: address, phone numbers and email address.
• Health and care information: medical history, medication, whether you have capacity to make particular decisions, care needs, care plans, records of the care we provide, and information gathered during assessments and reviews.
• Herbert Protocol form: if you are living with dementia, a completed form that helps the police find you if you go missing.
• Your preferences: religious and cultural beliefs, dietary requirements, favourite activities, pets and house rules (for example, whether carers wear shoes indoors).
• Your home: directions, entry instructions, key safe codes and notes on the condition of your home that affect safe care.
• Your household: who lives with you, as this affects your care arrangements and fees.
• Equality information: such as ethnicity or religion, where you choose to provide it.
• Financial information: bank details and payment history.

People who arrange care, representatives and next of kin

• Name, address, phone numbers, email address and photo ID.
• Your relationship to the client.
• Copies of documents showing your authority to act, such as a Lasting Power of Attorney or Court of Protection deputyship order.
• Bank details and payment history, if you pay for the client’s care.

Website users

• Name and contact details, if you get in touch with us through our website.
• Information about your device, such as IP address, device type and model, operating system, browser, city and time zone.
• How you use our website, such as pages visited, number and length of sessions, buttons clicked and the website that referred you.

People who apply to work with us

• Name, date of birth and contact details.
• Education, training, qualifications, employment history and experience of providing care.
• Right to work, visa status and employment status.
• The type of care you are interested in providing and how you heard about us.
• Anything else you include in your CV, application form or covering letter, including special category information you choose to share (such as health, ethnicity or religion).
• If your application progresses: references and criminal records (DBS) checks, as required by law for care roles.

Suppliers

• Name, title and contact details, including billing and delivery addresses.
• Bank details and payment history.

Phone calls and CCTV

• Calls to and from our office number may be recorded for safeguarding, training, quality assurance and evidence.
• We use CCTV at our premises for security and safety.

Where your information comes from

Most of this information comes directly from you. We may also receive information from people who arrange care on a client’s behalf, from health and social care professionals involved in a client’s care (such as GPs, hospitals and social workers), from referees and the Disclosure and Barring Service for job applicants, and from credit reference agencies.

How we use your information

Clients, representatives and next of kin

We use this information to:

• assess care needs and write and review care plans;
• arrange and deliver care, including giving carers safe access to the client’s home;
• coordinate care with the client’s representatives, attorneys and the health and social care professionals involved;
• send invoices, collect payments, give refunds, carry out credit checks and recover unpaid fees;
• check the quality of our care through reviews, spot checks, management visits, medication supervisions and satisfaction surveys;
• keep people safe, including raising safeguarding concerns and helping the police if a client goes missing;
• meet our legal and regulatory obligations, including those set by the Care Quality Commission; and
• analyse information to improve our services.

Website users

We use this information to respond to your enquiries, run and improve our website, fix problems, understand how it is used and, where the law allows, send you information about our services.

People who apply to work with us

We use this information to assess your suitability for the role, carry out the checks the law requires for care roles and contact you about your application.

Suppliers

We use this information to receive goods and services, pay you and manage our relationship with you or your organisation.

Everyone

We also use personal information to keep accurate records, deal with complaints and legal claims, and prevent fraud.

Our lawful bases

Data protection law only allows us to use personal information where we have a lawful basis. We do not rely on your consent to use or share the health information we need to provide your care.

• Contract: to provide care services under our agreement with you, to take steps you ask for before an agreement (such as an assessment or a quote), and to manage contracts with individual suppliers.
• Legal obligation: to meet our duties under care regulations, safeguarding, health and safety, record-keeping and tax law, and to carry out right to work and DBS checks.
• Vital interests: to protect someone’s life or wellbeing in an emergency.
• Legitimate interests: to run our business; coordinate care with representatives and next of kin; carry out credit checks, prevent fraud and recover unpaid fees; assess job applications; manage supplier relationships; record calls and use CCTV; improve our services; and send some marketing. We only rely on this basis where our interests are not outweighed by yours.
• Consent: to send marketing where the law requires consent, to use non-essential cookies, and to use special category information that job applicants choose to share. You can withdraw your consent at any time.

Health and other special category information

Information about health, ethnicity, religion and similar matters is called “special category” information and has extra protection. We use it where it is necessary:

• for the provision of health or social care;
• to protect someone’s vital interests when they cannot give consent;
• to safeguard people at risk of harm;
• to establish, exercise or defend legal claims; or
• with your explicit consent, where none of the above applies.

Criminal records information

We only use information about criminal convictions and offences where data protection law allows it, for example DBS checks on people applying to work with us, or where it is relevant to the safety of a client’s care.

Who we share your information with

We never sell personal information. We only share it where necessary, and always with appropriate safeguards. Depending on your situation, we may share it with:

• Health and social care professionals involved in a client’s care, such as GPs, district nurses, hospitals, pharmacies, social workers and local authorities.
• Representatives, attorneys, deputies and next of kin, where the client has agreed or where it is in the client’s best interests.
• The police and emergency services, in an emergency, if a client goes missing, or to prevent or detect crime.
• Regulators and public bodies, such as the Care Quality Commission, local authority safeguarding teams, the Information Commissioner’s Office and HMRC, where the law requires.
• Credit reference and fraud prevention agencies, to carry out credit checks and prevent fraud.
• Debt collection agencies, if fees remain unpaid.
• Our service providers, such as the IT and software suppliers we use to deliver our services (for example Birdie, The Access Group, Microsoft, Google, Typeform, DocuSign and GoCardless), and our website and marketing providers. They may only use the information on our instructions.
• Professional advisers, such as auditors, lawyers and insurers.
• Social media platforms, if you choose to link your social media accounts to us.
• A buyer or successor business, if we merge with or are acquired by another organisation or reorganise our business. Your information would remain protected in line with this policy.

Family access through Birdie

We use a secure care management system, Birdie, to plan and record care. Clients, and family members or representatives the client has agreed to (or where it is in the client’s best interests), may be given access to view information such as visit times, care notes and care plans. Clients can ask us to remove someone’s access at any time.

Transfers outside the UK

Some of our service providers may store or process personal information outside the UK, for example on their IT systems. When this happens, we make sure your information is protected to the standard UK law requires, using one of these safeguards:

• the country has been approved by the UK government as providing adequate protection; or
• the provider has signed the Information Commissioner’s International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses; or
• another safeguard recognised by data protection law applies.

You can contact our Data Protection Officer for more information about these safeguards.

How long we keep your information

We only keep personal information for as long as we need it, and we review our records regularly to check they are accurate and still needed.

• Care records: 8 years from the end of care or when the client was last seen, in line with the NHS Records Management Code of Practice. This includes care plans, care notes and visit records.
• Contracts, invoices and other financial records: 6 years, to meet legal, contractual and tax requirements.
• Safeguarding records and other records the law requires us to keep longer: as long as the law requires.
• Phone call recordings: usually 6 months, or longer if needed for an investigation, safeguarding matter, complaint or legal obligation.
• Contact details used for marketing: until you unsubscribe.

At the end of these periods, we securely delete or destroy the information.

How we keep your information secure

We use physical, technical and organisational measures to protect personal information, including:

• limiting access so that only people who need information to do their job can see it;
• secure IT systems for storing and sending information;
• training our staff in confidentiality and data protection; and
• requiring our carers and service providers to keep information confidential.

No method of sending information over the internet is completely secure, so we cannot guarantee the security of information you send to our website. Where a password is needed, please keep it confidential.

If a data breach is likely to put you at risk, we will tell you and the Information Commissioner’s Office as the law requires.

Marketing

We may send you updates about our services, offers and news by email, text, phone or post. We only do this where you have agreed, or where the law allows us to contact existing clients and customers about similar services.

You can stop marketing at any time by:

• clicking the unsubscribe link in any marketing email; or
• emailing dataprotection@tiggocare.com with “remove” in the subject line and the email address you want removed.

Opting out of marketing does not affect messages about your care, your account or our agreement with you.

Your rights

You have the following rights over your personal information:

• Access: to ask for a copy of the information we hold about you.
• Rectification: to ask us to correct information that is inaccurate or incomplete.
• Erasure: to ask us to delete your information in certain circumstances.
• Restriction: to ask us to limit how we use your information.
• Objection: to object to us using your information on the basis of our legitimate interests, and to stop direct marketing at any time.
• Portability: to receive information you gave us in a machine-readable format, or have it sent to another organisation, where we use it on the basis of a contract or your consent and by automated means.
• Withdrawing consent: where we rely on your consent, to withdraw it at any time.
• Automated decisions: not to be subject to decisions made solely by automated means that have legal or similarly significant effects on you. We do not make decisions like this.

Some of these rights do not apply in every situation. For example, we may need to keep care records the law requires us to hold.

To use any of these rights, contact our Data Protection Officer at dataprotection@tiggocare.com. An attorney or deputy can also make a request on a client’s behalf. We may ask for proof of identity or authority before responding. We will normally respond within one month and will not usually charge a fee.

Cookies and other websites

Our website uses cookies, which are small text files placed on your device. We use cookies that are essential for the website to work and, with your consent, cookies that help us understand how the website is used and improve it. Our Cookie Policy explains which cookies we use and how to manage them.

Our website may link to other websites. This policy does not cover those websites, so please read their own privacy policies.

If Tiggo Care stops trading

If Tiggo Care stops trading, we will make sure personal information, and care records in particular, is kept securely for as long as the law requires, and passed on where needed so a client’s care can continue safely.

Changes to this policy

We review this policy regularly and update it when our practices or the law change. The latest version is always on our website at www.tiggocare.com/statutory-pages/privacy-policy, and a copy is kept in each client’s care folder. If we make a significant change, we will tell clients and others whose contact details we hold.

Contact us and complaints

If you have a question or concern about how we use your personal information, please contact our Data Protection Officer first:

• Email: dataprotection@tiggocare.com
• Phone: 020 8145 0052
• Post: Data Protection Officer, Tiggo Care Limited, Hyde Park House, 5 Manfred Road, London SW15 2RS

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator:

• Post: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
• Phone: 0303 123 1113
• Website: ico.org.uk/concerns

‍