Privacy Policy

PRIVACY POLICY

Last updated: 4 October 2026

QMADS LTD is committed to protecting your personal information and respecting your privacy.

This Privacy Policy explains how we collect, use, store, share and protect personal information when you visit our website, contact us, purchase or enquire about our services, use our systems or portal, apply for a role, or otherwise engage with QMADS.

This policy applies to personal information processed by QMADS LTD in connection with our consultancy, regulatory compliance and associated services.

1. WHO WE ARE

QMADS LTD is a specialist health and social care regulatory compliance consultancy.

We support organisations across services including:

• CQC registration and regulatory compliance
• Ofsted registration and compliance
• CIW, HIW, HIS and RQIA regulatory support
• Policies and procedures
• Compliance and policy management systems
• Mock inspections
• Governance and quality assurance
• Remedial action planning
• Regulatory training
• Business planning
• Financial viability assessments
• Interview preparation
• Site and premises assessments
• Registered Manager recruitment
• Ongoing consultancy and compliance support

For the purposes of applicable UK data protection legislation, QMADS LTD will generally act as the data controller for personal information we collect and determine how to use.

In some circumstances we may process personal information on behalf of a client. Where this occurs, the client may be the data controller and QMADS may act as a data processor.

QMADS LTD 
Argent House- 175 Hook Rise South
Tolworth
Surrey
KT6 7LD

Email: business@qmads.co.uk
Telephone: 0208 111 1188
Website: www.qmads.co.uk
Company Number: 08313940

Data Protection Contact

Our Data Protection contact is:

Tariq Minhas

Email: business@qmads.co.uk

Telephone: 0208 111 1188

2. DATA PROTECTION LEGISLATION

We process personal information in accordance with applicable UK data protection and privacy legislation, including:

• The UK General Data Protection Regulation, known as UK GDPR
• The Data Protection Act 2018
• The Data (Use and Access) Act 2025, where applicable
• The Privacy and Electronic Communications Regulations 2003, known as PECR, as amended
• Other applicable confidentiality, privacy and information governance requirements

We aim to process personal information lawfully, fairly and transparently and only to the extent necessary for legitimate business and regulatory purposes.

3. PERSONAL INFORMATION WE MAY COLLECT

The information we collect depends on your relationship with QMADS and the services we provide.

It may include:

• Identity information
• Name
• Title
• Date of birth where relevant
• Identification documentation where necessary
• Photograph
• Signature
• Nationality or immigration information where directly relevant to a service
• Contact information
• Home or business address
• Email address
• Telephone and mobile numbers
• Correspondence details
• Professional information
• This may include:
• Job title
• Employment history
• Qualifications
• Professional registrations
• Training records
• CVs
• References
• Experience
• Employment details
• Professional memberships
• Registered Manager or Nominated Individual information
• Business information
• We may process information relating to:
• Your company or organisation
• Directors, shareholders, partners or owners
• Organisational structure
• Regulated activities
• Locations
• Business plans
• Staffing arrangements
• Governance systems
• Policies and procedures
• Operational arrangements
• Regulatory history
• Registration applications
• Inspection findings
• Compliance issues
• Commercially sensitive information
• Financial and transactional information
• This may include:
• Billing details
• Invoices
• Payment records
• Transaction history
• Financial information supplied for services such as financial viability assessments or business plans
• We do not normally retain complete payment-card details where payment is processed through an external payment provider.

Communications

We may retain:

• Emails
• Telephone notes
• Meeting notes
• WhatsApp or other business communications
• Consultation notes
• Correspondence with regulators
• Enquiries
• Complaints
• Service feedback
• Website and technical information
• Where applicable, we may collect:
• IP address
• Browser type
• Device information
• Pages visited
• Date and time of visits
• Referral source
• Cookie identifiers
• Analytics information
• Interaction with forms or website features

Further information about cookies may be provided in our Cookie Policy or cookie-management platform.

4. SPECIAL CATEGORY AND SENSITIVE INFORMATION

Due to the nature of regulatory and healthcare consultancy, information supplied to QMADS may occasionally contain particularly sensitive personal information.

This may include information relating to:

• Health
• Disability
• Ethnicity
• Religious or philosophical beliefs
• Sexual orientation
• Professional fitness
• Safeguarding matters

We will only process special category personal information where there is a lawful basis under Article 6 UK GDPR and an appropriate additional condition under Article 9 UK GDPR.

Depending on the circumstances, this may include processing that is:

• Necessary for employment, social security or social protection purposes
• Necessary for establishing, exercising or defending legal claims
• Necessary for reasons of substantial public interest where permitted by law
• Necessary for health or social care purposes where the relevant legal conditions apply
• Based on explicit consent where this is the appropriate legal basis

We do not intentionally request sensitive personal information unless it is relevant and proportionate to the service being provided.

5. CRIMINAL OFFENCE INFORMATION

Some regulatory, recruitment or registration processes may involve information relating to criminal convictions, cautions, DBS disclosures or other criminal offence information.

We only process this type of information where it is necessary, lawful and proportionate and where the requirements of the Data Protection Act 2018 are satisfied.

Access to such information is restricted to individuals who require it for legitimate professional purposes.

6. HOW WE OBTAIN YOUR INFORMATION

We may obtain personal information directly from you.

For example, when you:

Contact us

Complete an enquiry form

Book a consultation

Purchase a service

Enter into a contract with us

Provide documents

Communicate by email, telephone, messaging service or video call

Create an online account

Subscribe to communications

Apply for employment or recruitment opportunities

Information from your organisation

Your employer, business partner, director, Registered Manager, Nominated Individual or authorised representative may provide information about you where this is necessary for a service.

Information from public sources

We may obtain relevant professional or business information from sources including:

Companies House

Regulatory registers

Professional registers

CQC

Ofsted

CIW

HIW

HIS

RQIA

Public websites

Business websites

Publicly available professional profiles

Information from regulators and third parties

Where appropriate, information may be received from:

Regulators

Professional advisers

Contractors

Recruitment candidates or employers

Regulatory representatives

Other parties involved in the work we have been instructed to carry out

Where UK GDPR requires us to provide privacy information following indirect collection of personal data, we will do so within the applicable timeframe unless an exemption applies.

7. WHY WE USE YOUR INFORMATION AND OUR LAWFUL BASES

We only process personal information where we have a lawful reason for doing so.

Responding to enquiries and arranging consultations

Typical lawful basis:

Legitimate interests and/or steps at your request before entering into a contract

Providing consultancy and regulatory services

Typical lawful basis:

Performance of a contract

Preparing CQC, Ofsted or other regulatory applications

Typical lawful basis:

Performance of a contract

Producing policies, Statements of Purpose, business plans and regulatory documentation

Typical lawful basis:

Performance of a contract

Reviewing documents and compliance systems

Typical lawful basis:

Performance of a contract

Providing mock inspections, governance reviews or training

Typical lawful basis:

Performance of a contract

Operating client accounts or compliance portals

Typical lawful basis:

Performance of a contract and legitimate interests

Communicating with clients

Typical lawful basis:

Performance of a contract and legitimate interests

Communicating with regulators on your behalf

Typical lawful basis:

Performance of a contract and/or legitimate interests

Processing payments and invoices

Typical lawful basis:

Performance of a contract and legal obligation

Accounting, taxation and financial record keeping

Typical lawful basis:

Legal obligation

Managing complaints and disputes

Typical lawful basis:

Legitimate interests, legal obligation and, where necessary, legal claims

Maintaining evidence of services provided

Typical lawful basis:

Legitimate interests

Preventing fraud, misuse and security incidents

Typical lawful basis:

Legitimate interests and legal obligation where applicable

Improving our systems and services

Typical lawful basis:

Legitimate interests

Website analytics and performance

Typical lawful basis:

Consent where required and/or legitimate interests as permitted by law

Direct marketing

Typical lawful basis:

Legitimate interests and/or consent, subject to PECR

Recruitment

Typical lawful basis:

Steps before entering into a contract, legitimate interests and legal obligations

Establishing, exercising or defending legal claims

Typical lawful basis:

Legitimate interests and applicable provisions relating to legal claims

Where we rely on legitimate interests, we consider whether our interest is necessary and proportionate and whether your rights and freedoms override that interest.

8. REGULATORY CONSULTANCY AND INFORMATION SHARING

Where you instruct QMADS to support a regulatory application or matter, you acknowledge that relevant information may need to be prepared, reviewed or shared with the appropriate regulatory body.

This may include, depending on the service:

Care Quality Commission, CQC

Ofsted

Care Inspectorate Wales, CIW

Healthcare Inspectorate Wales, HIW

Healthcare Improvement Scotland, HIS

Regulation and Quality Improvement Authority, RQIA

Local authorities

Commissioners

Other regulatory or statutory bodies

We will only share information that is reasonably necessary for the work we have been instructed to undertake or where disclosure is otherwise required or permitted by law.

9. WHO WE MAY SHARE YOUR INFORMATION WITH

We may share information with third parties where necessary to operate our business and deliver our services.

These may include:

Regulatory authorities

Professional advisers

Accountants

Solicitors

Insurers

IT and cloud-service providers

Website hosting providers

CRM providers

Email and communications providers

Document-storage providers

Payment processors

Accounting software providers

Appointment and scheduling providers

Analytics providers

Contractors and consultants

Authorised subcontractors

Recruitment platforms

Professional verification services

Where another organisation processes personal information on our behalf, we require appropriate contractual and security arrangements to be in place.

We do not sell personal information to third parties.

10. OUR STAFF, CONSULTANTS AND SUBCONTRACTORS

Access to personal information within QMADS is limited to staff members, consultants and contractors who reasonably require access to perform their responsibilities.

Individuals working for or on behalf of QMADS are required to maintain confidentiality.

Where a third-party supplier processes personal information on our behalf, appropriate data-processing provisions will be implemented where required by law.

11. INTERNATIONAL TRANSFERS

Some of the technology and cloud services we use may store, access or process information outside the United Kingdom.

Where this results in a restricted international transfer of personal information, we take steps to ensure that the transfer complies with UK data protection law.

Depending on the destination and supplier, this may include reliance on:

UK adequacy regulations

The UK Extension to the EU-US Data Privacy Framework where applicable

The International Data Transfer Agreement, known as IDTA

The UK Addendum to approved EU Standard Contractual Clauses

Another safeguard permitted under Article 46 UK GDPR

A permitted statutory exception where appropriate

Where required, we also assess whether the relevant transfer mechanism provides an appropriate level of protection.

You may contact us for further information about safeguards applying to relevant international transfers.

12. ARTIFICIAL INTELLIGENCE AND AUTOMATED TECHNOLOGIES

QMADS may use technology-assisted tools to support activities such as:

Document preparation

Document review

Information organisation

Administrative support

Meeting or communication summaries

Workflow management

Research

Quality assurance

Where personal or confidential information is processed using such technologies, we aim to apply appropriate contractual, technical and organisational safeguards.

We remain responsible for our use of personal information and do not rely solely on automated technology to make legally significant decisions about individuals unless permitted by law and appropriate safeguards are in place.

Where applicable, human review forms part of our professional decision-making and consultancy processes.

13. AUTOMATED DECISION-MAKING

QMADS does not ordinarily undertake solely automated decision-making that produces legal effects or similarly significant effects on individuals.

If this changes for a particular service, we will provide appropriate information about:

The nature of the automated processing

The logic involved

The significance and likely consequences

Applicable rights and safeguards

14. DIRECT MARKETING

We may contact existing or prospective clients regarding services, regulatory developments, compliance information, events, publications or other services that we reasonably believe may be relevant.

Our marketing activities are carried out in accordance with UK GDPR and PECR.

Depending on the circumstances, we may rely on:

Your consent

Our legitimate interests in developing and promoting our business where the law permits this

Different rules may apply depending on whether the recipient is:

An individual

A sole trader

Certain types of partnership

A corporate subscriber such as a limited company or LLP

Where consent is required, we will obtain it before sending the relevant communication.

You have an absolute right to object to the use of your personal information for direct marketing.

You can unsubscribe at any time by:

Clicking an unsubscribe link in an electronic communication

Replying to us requesting removal

Emailing business@qmads.co.uk

We may retain limited information on a suppression list after you unsubscribe so that we can respect your request not to receive future marketing.

15. COOKIES AND WEBSITE ANALYTICS

Our website may use cookies and similar technologies for purposes including:

Essential website functionality

Security

Preferences

Analytics

Measuring website performance

Understanding how visitors interact with our website

Advertising or marketing where applicable

Where the law requires consent before placing non-essential cookies on your device, these cookies will not be activated until the relevant consent has been obtained.

You can control applicable cookie preferences through our website cookie-management system.

16. HOW LONG WE KEEP INFORMATION

We do not retain personal information indefinitely.

Information is retained only for as long as reasonably necessary for:

The purpose for which it was collected

Delivering our services

Maintaining appropriate business records

Meeting contractual requirements

Complying with legal, tax and regulatory requirements

Dealing with complaints

Establishing or defending legal claims

Our indicative retention periods are as follows:

Enquiries that do not proceed

Normally up to 24 months after the last meaningful contact

Client service files

Normally 6 years after completion or termination of the relevant engagement

Contracts and contractual records

Normally 6 years after the contractual relationship ends

Invoices and tax or accounting records

Normally 6 years from the end of the relevant accounting period, or longer where legally required

CQC, Ofsted or regulatory application working files

Normally retained with the associated client file

Complaints and disputes

Normally 6 years after closure, subject to the circumstances

Marketing records

Until consent is withdrawn, an objection is made, the information is no longer needed, or an earlier review requires deletion

Suppression records

May be retained for as long as reasonably necessary to ensure marketing objections continue to be respected

Recruitment applications

Normally up to 12 months for unsuccessful applicants unless there is a lawful reason for longer retention

Website analytics

According to the configured retention period of the relevant analytics system

Legal claims

For as long as reasonably necessary considering applicable limitation periods

These periods are guidelines rather than absolute limits.

We may retain information for longer where:

Required by law

Required by a regulator

There is an ongoing complaint, investigation or dispute

Litigation or legal proceedings are reasonably anticipated

The information forms part of a continuing client relationship

We may delete information sooner where there is no continuing lawful or business need to retain it.

17. INFORMATION SECURITY

We take reasonable and proportionate technical and organisational measures to protect personal information against:

Unauthorised access

Accidental loss

Alteration

Disclosure

Destruction

Misuse

Measures may include:

Access controls

Password protection

Multi-factor authentication where appropriate

Secure cloud systems

Restricted permissions

Confidentiality obligations

Staff awareness

Secure backups

Device and account controls

Contractual controls with suppliers

No internet-based or electronic system can be guaranteed to be completely secure, but we take proportionate measures designed to minimise risks.

18. CONFIDENTIALITY

QMADS routinely handles confidential commercial and regulatory information.

Our staff, consultants and contractors are expected to maintain the confidentiality of information accessed during their work.

We will not disclose confidential or personal information without a lawful basis unless:

Disclosure has been authorised

It is necessary for providing the contracted service

It is required by law

It is required by a regulator or competent authority

Another lawful basis for disclosure applies

19. YOUR DATA PROTECTION RIGHTS

Depending on the circumstances, you may have the following rights.

Right of access

You may request confirmation of whether we process your personal information and obtain a copy of information to which you are legally entitled.

Right to rectification

You may ask us to correct inaccurate personal information or complete information that is incomplete.

Right to erasure

You may ask us to delete personal information in certain circumstances.

This right is not absolute and we may need to retain information where a lawful reason applies.

Right to restrict processing

You may ask us to restrict the way we use your personal information in certain circumstances.

Right to data portability

Where applicable, you may request certain personal information in a structured, commonly used and machine-readable format or request its transfer to another controller.

Right to object

You may object to processing based on legitimate interests in certain circumstances.

Right to object to direct marketing

You have an absolute right to object to processing of your personal information for direct marketing.

Right to withdraw consent

Where processing is based on your consent, you may withdraw that consent at any time.

Withdrawal does not affect the lawfulness of processing undertaken before consent was withdrawn.

Rights relating to automated decision-making

You may have rights relating to decisions based solely on automated processing where such processing has legal or similarly significant effects.

20. HOW TO EXERCISE YOUR RIGHTS

You can exercise your data protection rights by contacting:

Data Protection Contact

QMADS LTD

Argent House

175 Hook Rise South

Tolworth

Surrey

KT6 7LD

Email: business@qmads.co.uk

Telephone: 0208 111 1188

You do not normally need to pay a fee to exercise your data protection rights.

We may request reasonable information to verify your identity before disclosing personal information.

We aim to respond within the period required by applicable data protection law, normally one calendar month.

This may be extended where legally permitted for particularly complex or numerous requests.

21. KEEPING YOUR INFORMATION ACCURATE

Please tell us if personal information we hold about you changes.

You can contact us at:

business@qmads.co.uk

We may also periodically ask clients to verify information where accuracy is important to an ongoing service.

22. CHILDREN

Our services are primarily provided to businesses and professionals and our website is not intended to collect information directly from children.

However, information relating to children may occasionally be contained within regulatory, safeguarding or operational documentation supplied to us by clients.

Where such information is processed, we expect clients to ensure that it is lawfully shared with us and limited to what is necessary for the relevant purpose.

We will treat such information as confidential and apply appropriate safeguards.

23. INFORMATION RELATING TO OTHER PEOPLE

If you provide personal information about another individual to QMADS, you should ensure that:

You have authority or another lawful basis to provide it

Sharing the information is necessary and proportionate

Where appropriate, the individual has been provided with relevant privacy information

Examples may include information about:

Directors

Employees

Registered Managers

Nominated Individuals

Business partners

Consultants

Referees

Healthcare professionals

24. REGULATORY AND LEGAL DISCLOSURE

We may disclose information where reasonably necessary to:

Comply with a legal obligation

Respond to a lawful regulatory request

Comply with a court order

Protect our legal rights

Establish, exercise or defend legal claims

Prevent or detect fraud

Protect the safety or security of individuals or systems

Where possible and lawful, disclosure will be limited to information reasonably necessary for the relevant purpose.

25. COMPLAINTS

If you have concerns about how QMADS handles your personal information, please contact us first so that we have an opportunity to investigate.

Email: business@qmads.co.uk

Telephone: 0208 111 1188

You also have the right to complain to the UK's data protection regulator:

Information Commissioner's Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Website: ico.org.uk

You may contact the ICO without first complaining to QMADS, although the ICO may normally expect you to have raised your concern with us where appropriate.

26. LINKS TO EXTERNAL WEBSITES

Our website may contain links to websites operated by third parties.

QMADS is not responsible for the privacy practices of external websites.

We recommend reviewing the privacy notice of any external organisation before providing personal information to it.

27. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect:

Changes to our services

Changes to our systems

New regulatory requirements

Changes in data protection law

Changes to the way we process personal information

The latest version will be published on our website and will display the date it was last updated.

Where changes materially affect how we process personal information, we will take reasonable steps to bring those changes to the attention of affected individuals where appropriate.

28. CONTACT US

If you have questions about this Privacy Policy or how QMADS handles personal information, please contact:

QMADS LTD

Argent House

175 Hook Rise South

Tolworth

Surrey

KT6 7LD

Data Protection Contact: Tariq Minhas

Email: business@qmads.co.uk

Telephone: 0208 111 1188

Website: www.qmads.co.uk

Company Number: 08313940

QMADS

CQC, Ofsted and UK Healthcare Regulatory Compliance Consultants