Privacy policy

Last updated: October 2026

1. Who we are

HLTH Compliance (HLTH Compliance Limited, registered in England and Wales, company number 14385681, registered office Castle Chambers, 43 Castle Street, Liverpool, L2 9TL) provides CQC and Ofsted compliance, governance, and risk assurance services. We are the data controller for the personal data described in this policy. You can contact us about anything in this policy at hello@hlth-compliance.com or on 0161 241 3163.

2. The information we collect

Website visitors: technical information such as browser type, IP address, and pages visited, collected through cookies and analytics tools (see section 8), plus any details you submit through our contact forms.

CQC report requests: if you ask for a CQC rating report on our website, we collect your name, your work email address, your phone number if you choose to give it, and the CQC location you asked about. We also record a one-way (hashed) version of your IP address and your browser's user agent, so we can limit repeated requests and prevent misuse of the form.

Enquiry forms: if you contact us through the enquiry form on our contact page, or the Ask an expert form on our CQC assessment framework pages, we collect the details you enter, such as your name, email address, phone number, organisation and message, and the page you sent it from.

Clients and prospective clients: names, job titles, contact details, and business information needed to provide our services and manage our relationship.

Individuals involved in client engagements: where we support a client’s CQC or Ofsted registration or compliance work, we process personal data about individuals named in that work, such as registered managers and nominated individuals. This typically includes name, date of birth, professional qualifications, work history, and application content. Where DBS details form part of an application we handle them under strict controls, and we do not process health information about service users in our application work.

3. How we use it and our lawful bases

We use personal data to deliver our contracted services, including preparing and supporting regulatory applications (performance of a contract with our clients, and legitimate interests where the individual is not our direct client); to manage enquiries and our client relationships (legitimate interests); to meet our legal and regulatory obligations (legal obligation); and to send marketing about our services where permitted (legitimate interests or consent, and you can opt out at any time).

When you ask for a CQC rating report, we use your details to create the report and email it to you, because you asked us to (performance of a contract, or steps you ask us to take). We may follow up once about the report (legitimate interests); reply to that email if you would rather we did not. We use the hashed IP address and user agent only to limit repeated requests and protect the form from misuse (legitimate interests). We do not add you to a mailing list.

When you send us an enquiry, we use your details to reply and, if you go on to work with us, to manage that relationship (legitimate interests, or steps you ask us to take before entering into a contract).

4. Our use of artificial intelligence

We use one approved AI tool, Claude by Anthropic, to assist with drafting and analysis in our work. It operates under commercial terms which mean our data is not used to train AI models. Every AI-assisted output is reviewed by a qualified member of our team, and AI does not make decisions about any individual. We never input DBS or criminal record information, or health information, into AI tools. Our use of AI is governed by our internal AI policies, and our client AI transparency statement is available on request.

5. Who we share it with

Regulators such as the CQC and Ofsted, when submitting or supporting applications on a client’s instruction; service providers who process data on our behalf under contract, including Anthropic (AI processing) and our IT and website providers; and professional advisers where necessary. We do not sell personal data.

6. International transfers

Some of our service providers process data outside the UK. Anthropic processes data in the United States, safeguarded by the EU Standard Contractual Clauses and the UK International Data Transfer Addendum incorporated in its data processing agreement.

Resend, Vercel, Google and Calendly may process personal data in the United States. Where personal data is transferred outside the UK, we rely on UK adequacy regulations (for example for the European Economic Area, or for a United States provider certified under the UK Extension to the EU-US Data Privacy Framework) or on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

7. How long we keep it

We keep client engagement records, including application documents, for 6 years after the engagement ends, unless a longer period is required by law. Conversations in our AI tool that contain client personal data are deleted once an engagement concludes, and deleted conversations are purged by the provider within approximately 30 days. Website enquiry data is kept only as long as needed to handle the enquiry.

We keep CQC report requests for up to 24 months from the date of the request, and then delete them.

8. Cookies, analytics, and advertising

Our website uses cookies and similar technologies for functionality, analytics, and advertising. Non-essential cookies are used only with your consent, which you can give or withdraw through the cookie choices offered on our site or via your browser settings.

When you first visit, a cookie banner asks for your choice before any analytics or advertising cookies are set. You can change your choice at any time using the Cookie settings link in the footer of every page. The cookies we use are: hlth_consent (essential, stores your cookie choice for 6 months); _ga and _ga_* (Google Analytics, only with analytics consent, up to 2 years); ph_phc_*_posthog (PostHog, only with analytics consent, up to 1 year); and _gcl_au (Google Ads, only with advertising consent, 90 days).

We use PostHog, hosted in the EU (Frankfurt), to see how our site is used: which pages are visited and which buttons and links are clicked. If you do not accept analytics cookies, PostHog stores nothing on your device: a page reload counts as a new visitor and we cannot recognise you between visits. If you accept, PostHog stores an identifier in a cookie and in your browser's local storage, so we can recognise return visits, and it may record how you move around our pages (a session recording, with anything you type into a form field hidden). You can withdraw your consent at any time using the Cookie settings link in the footer, and PostHog then removes what it stored.

We use Google services for analytics and for remarketing, which means we may show advertisements on third party websites (including Google) to previous visitors to our site. Third party vendors, including Google, use cookies to serve ads based on past visits. You can manage how Google advertises to you through the Google Ad Preferences page, or opt out of interest-based advertising entirely.

Our live chat is provided by Tidio. Nothing from Tidio loads until you click the chat button. From then on, we remember in your browser's local storage that you opened the chat, and Tidio keeps an identifier there, so that a conversation carries on as you move between pages; it does not set advertising cookies. If you use the chat, Tidio processes your messages and any details you give so that we can reply; some replies are written by Tidio's AI assistant, Lyro.

Videos on our site are embedded using YouTube's privacy-enhanced mode (youtube-nocookie.com), which is designed not to store information about you until you play a video. When you play one, Google processes your data under its own privacy policy.

We may also collect aggregated, non-identifying statistics about visitor behaviour to understand how our site is used; these do not identify you personally.

Our website may contain links to external sites we do not operate. We are not responsible for the content or privacy practices of third party sites and recommend reviewing their privacy policies.

9. Your rights

Under UK data protection law you have the right to access your personal data, to have it corrected or erased, to restrict or object to our processing (including direct marketing), and to data portability. To exercise any right, contact hello@hlth-compliance.com. We will respond within one month. If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

10. Changes to this policy

We review this policy at least annually and will post any changes on this page.