Privacy policy
1. Who we are
Elite Medical and Ambulance Services Limited (“Elite”, “we”, “us”) provides patient transport, secure patient transport, high dependency and frontline ambulance services, repatriation, event medical and welfare cover, and first aid and pre-hospital training across the UK from our headquarters in Hailsham, East Sussex. We are registered with the Care Quality Commission.
We are the data controller for the personal information described in this notice.
- Registered company number: 08510248
- Headquarters: Unit 51, The Granary Business Centre, Broad Farm, Hellingly, East Sussex, BN27 4DU
- ICO registration number: ZB257370
- Data Protection Officer: our Data Protection Lead, email [email protected]
2. What this notice covers
This notice explains how we collect, use, share and protect personal information when you:
- use our website or contact us
- are a patient we transport or treat, or someone who books transport for a patient
- book or attend an event we provide medical cover for, or are treated by our event team
- book or attend one of our training courses
- apply to work with us
- give us feedback or make a complaint
If you work for us, the data protection information in the Employee Handbook (Chapter 1.4) also applies to you.
We follow the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Data (Use and Access) Act 2025, the Privacy and Electronic Communications Regulations 2003 and the common law duty of confidentiality.
3. Information we collect
If you are | What we collect | Where it comes from |
A patient we transport or treat | Name, date of birth or age, address, contact details, weight, mobility needs, medical history and current condition, medication, clinical records made by our crews, and next of kin. For secure transport: Mental Health Act section status and related legal information. For repatriation: discharge letters, fit to fly certificates and insurance details. | You, your family or carer, and the NHS Trust, hospital, GP, local authority, insurer or care provider who books the journey |
Someone booking transport | Name, job title or relationship to the patient, phone, email, organisation, purchase order and budget codes | You |
An event organiser | Name, organisation, contact details, event details, risk assessments and billing details | You |
A person treated at an event | Name, contact details, age, injury or illness details, treatment given, and patient report form | You and our clinicians |
A training customer or learner | Name, organisation, contact details, date of birth, course attended, assessment results, certificates, and any support needs you tell us about | You or your employer |
A job applicant or bank worker | CV, qualifications, professional registration, employment history, right to work documents, ID photo, driving licence details, Enhanced DBS certificate and references | You, referees, the DBS update service and professional registers |
Giving feedback | Your answers, and if you choose, your age, gender, disability, ethnicity, religion and whether you have a mental health, dementia or learning disability diagnosis | You (the equality questions are voluntary) |
A website visitor | Information you enter in forms, and technical data such as IP address, browser type and pages visited (see section 9, Cookies) | You and your device |
A newsletter subscriber | Name and email | You |
Some of this is special category data (such as health, ethnicity or religion) or criminal offence data (such as DBS checks). We give it extra protection, as explained below.
4. How we use it and our lawful bases
The law requires a lawful basis for each use of personal information. For special category and criminal offence data, we also need an additional condition.
Purpose | Lawful basis (UK GDPR Article 6) | Additional condition (sensitive data) |
Planning and providing safe transport, care and treatment | Contract (Article 6(1)(b)) | Provision of health or social care (Article 9(2)(h)) |
Emergencies where you cannot give consent | Vital interests (Article 6(1)(d)) | Vital interests (Article 9(2)(c)) |
Secure transport under the Mental Health Act or Children Act | Contract (Article 6(1)(b)) | Provision of health or social care (Article 9(2)(h)) |
Safeguarding children and adults at risk | Legal obligation (Article 6(1)(c)) | Safeguarding of children and individuals at risk, Data Protection Act 2018, Schedule 1 |
Repatriation, including liaising with insurers and overseas hospitals | Contract (Article 6(1)(b)) | Provision of health or social care (Article 9(2)(h)) |
Event medical cover and quotes | Contract (Article 6(1)(b)) | Provision of health or social care (Article 9(2)(h)), for patients treated |
Running training courses and registering learners for certification | Contract (Article 6(1)(b)) | Not usually needed |
Recruitment, DBS checks and right to work | Steps before entering a contract (Article 6(1)(b)); legal obligation (Article 6(1)(c)) | Employment and safeguarding conditions, Data Protection Act 2018, Schedule 1 |
Feedback and service improvement | Legitimate interests in improving our service (Article 6(1)(f)) | Equality questions: your explicit consent (Article 9(2)(a)) |
Meeting CQC, NHS contract and regulatory requirements | Legal obligation (Article 6(1)(c)) | Provision of health or social care (Article 9(2)(h)); public health (Article 9(2)(i)) where relevant |
Answering enquiries | Legitimate interests (Article 6(1)(f)) | Not usually needed |
Sending our newsletter | Consent (Article 6(1)(a)). You can unsubscribe at any time | Not applicable |
Defending legal claims | Legitimate interests (Article 6(1)(f)) | Legal claims (Article 9(2)(f)) |
We do not sell your information, and we do not use it to make automated decisions that significantly affect you.
We only use identifiable patient information for your direct care. We do not use it for research or service planning without a lawful basis, and if we ever did, we would apply the national data opt-out.
5. Who we share it with
We only share what is needed, and we keep patient information confidential.
- Health and care organisations: NHS Trusts, hospitals, GPs, care homes and other clinicians involved in your care, including receiving hospitals when we hand you over.
- Organisations that commission our services: NHS bodies, local authorities and private providers that book journeys, for audit and contract monitoring.
- Police, courts and local authorities: where needed for Mental Health Act or Children Act transfers, or where the law requires it.
- Safeguarding bodies: if we believe a child or adult is at risk.
- Regulators: the Care Quality Commission and others with a legal right to inspect records.
- Insurers, medical assistance companies and overseas hospitals: for repatriation journeys.
- Awarding bodies: to register learners and issue certificates.
- Suppliers who process data for us, under a written contract and only on our instructions:
- Ambunet: our management system, which holds patient care records (EPCR), incidents, medicines, recruitment, vehicle and event records. Data is hosted in the UK under a data processing agreement.
- BookingLive: training course bookings
- Jotform: online forms
- Warpaint: website support
- Professional advisers: lawyers, accountants and insurers.
6. Transfers outside the UK
Some of our suppliers may store data outside the UK. Where they do, we make sure suitable protections are in place, such as UK adequacy regulations or the UK International Data Transfer Agreement.
For repatriation, we must share patient information with hospitals, clinicians and insurers in the country you are travelling from or to. We do this because it is necessary to provide the service you or your insurer have asked for.
7. How long we keep it
We keep information only as long as we need it. Patient records are kept in line with the NHS England Records Management Code of Practice for Health and Social Care, and our own retention schedule (Policy 12.4).
Information | How long we keep it |
Adult patient records, including event patient report forms | 8 years after the end of care |
Children’s patient records, including event patient report forms | Until the patient’s 25th birthday, or 26th birthday if they were 17 when care ended |
Records of adult patients who have died | 8 years after death |
Mental Health Act transport records | 20 years, or 10 years after death. |
Training and certification records | Until the 75th birthday or six years after the staff member leaves, whichever is longer. Statutory and mandatory training records are kept for ten years after the training was completed. Other training records are kept for six years after completion. |
Unsuccessful job applications | 12 months |
Staff records | Keep until the 75th birthday. |
Enquiries, quotes and feedback | 12 months |
Newsletter details | Until you unsubscribe |
We keep records for longer if they are needed for an investigation, complaint, legal claim or inquest.
8. How we protect it
We protect your information with access controls, staff training, confidentiality agreements and secure systems. Only staff who need information for their role can see it. All staff complete data security training every year.
We hold Cyber Essentials certification, and we complete the NHS Data Security and Protection Toolkit every year. Our 2025 to 2026 assessment was published with standards met.
9. Cookies
Our website uses cookies. Some are essential for the site to work. Others, such as analytics, embedded maps, social media feeds, are only used if you agree through our cookie banner. You can change your choice at any time using the cookie settings link in the footer.
10. Children
We transport and treat patients of all ages, and learners may join some courses from age 14. Where a child cannot make decisions about their information, we work with their parent, guardian or the person with legal responsibility for them. Young people who are able to understand their rights may make requests themselves.
11. Your rights
You have the right to:
- ask for a copy of the information we hold about you
- ask us to correct information that is wrong or incomplete
- ask us to delete information, where we no longer have a reason to keep it
- ask us to restrict how we use your information
- object to us using your information where we rely on legitimate interests
- ask us to transfer information you gave us to another organisation, in some cases
- withdraw your consent at any time, where we rely on consent
- complain to us, and to the Information Commissioner’s Office, about how we have handled your information (see section 12)
Some rights are limited for health records we must keep by law. You can make a request in writing, by email, by phone or in person. Email [email protected] or write to the address in section 14.
We will respond within one month. If your request is complex, or you have made several requests, we may extend this by up to two further months and will tell you why within the first month. We may need to confirm your identity first, and the time limit starts once we have done so. We will carry out a reasonable and proportionate search for your information. There is normally no charge.
12. Complaints
If you are unhappy with how we have handled your information, please contact us first so we can try to put it right. You can complain by email to [email protected], in writing to the address in section 14, or by phone on 03451 220 743.
Our Data Protection Officer will acknowledge your complaint within 30 days, look into it without undue delay, and tell you the outcome.
You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint or by telephone on 0303 123 1113.
13. Changes to this notice
We review this notice at least once a year, and sooner if the law or the way we use information changes. The date of the current version is shown in the version control table at the start of this notice.
14. Contact us
Data Protection Officer
Elite Medical and Ambulance Services Limited
Unit 51, The Granary Business Centre, Broad Farm, Hellingly, East Sussex, BN27 4DU
Email: [email protected]
Telephone: 03451 220 743
