This policy explains how we collect, use, share and protect personal data. It applies to visitors to our website and to people whose personal data we handle in the course of providing our case management platform and related services. We are committed to handling personal data lawfully, fairly and transparently, and to the high standards expected when working with people affected by serious injury.
This policy is issued by Oria CM Ltd (referred to as "Oria CM", "we", "us" and "our"), a company registered in England and Wales under company number 16212258, with its registered office at Spaces Deansgate, 125 Deansgate, Manchester, M3 2BY.
Oria CM operates a clinical case management platform and an associate marketplace that connects funders with self-employed case managers and providers, and supports the coordination of care and rehabilitation for people who have sustained catastrophic or complex injury.
For the personal data described in this policy, Oria CM is a data controller. We are registered with the Information Commissioner's Office under registration reference ZB863752.
You can contact us about this policy or about your personal data using the details in section 16.
This policy covers personal data we handle as a controller, including information about:
Case management of an injured person usually involves more than one organisation. Our roles are as follows. Oria CM is a controller for the personal data it determines the purposes of, including running the platform, capturing service consent, clinical governance, safeguarding and assurance. The self-employed case managers and clinicians who work on a case are independent professionals who exercise their own clinical judgement, and they act as joint controllers with us in respect of the case management of their clients. Funders, such as insurers, solicitors, deputies and NHS bodies, are separate controllers in their own right, and when we share information with them for their own purposes we provide it on a controller to controller basis. Our technology and service suppliers act as our processors and handle personal data only on our written instructions.
To coordinate care and rehabilitation we may process the following, including special category data:
Health data, and information about how care is delivered, is sensitive. We only collect what we need to provide and assure the service.
We collect personal data:
Under the UK GDPR we must have a lawful basis for each purpose. The table below sets out our main purposes and the bases we rely on. The precise basis can depend on the circumstances of a particular case.
Where we rely on consent, you can withdraw it at any time, and we will explain what that means for the service. Where we rely on legitimate interests, we have weighed our interests against the rights of the people concerned, and you can ask us for more information about that assessment. The recognised legitimate interests we use, such as safeguarding vulnerable individuals and network security, are bases introduced by the Data (Use and Access) Act 2025.
Many of the people we support may, at times, lack the mental capacity to make decisions about their own personal data. Where that is the case, we work with the appropriate decision maker, such as a court appointed deputy, an attorney under a lasting power of attorney, or those making decisions in the person's best interests under the Mental Capacity Act 2005. Where consent is the appropriate basis and the person cannot give it themselves, we look to the proper representative, and we record the basis on which we are acting. Our service consent is captured during onboarding rather than at the point of referral.
We share personal data only where necessary, and with appropriate safeguards in place. Recipients can include:
We do not sell personal data. Where a supplier processes personal data on our behalf, we put in place a written contract that meets the requirements of Article 28 of the UK GDPR. Where we share information with a funder or another professional for their own purposes, we do so as separate controllers, and that organisation is responsible for its own handling of the data.
Our case managers and providers are self-employed and engaged on a contractor basis. We process their personal data to onboard, instruct, pay and assure them, and to meet our regulatory and safer recruitment obligations. Because they exercise independent professional judgement, they act as joint controllers with us in respect of the clients they manage, and the division of responsibilities between us is set out in a written arrangement. Where they handle personal data through the platform under our instructions, that handling is governed by our data processing terms.
We aim to keep personal data within the United Kingdom. Where a supplier processes personal data outside the UK, we make sure an appropriate safeguard is in place, such as UK adequacy regulations or the International Data Transfer Agreement or Addendum, so that the data remains protected to UK standards. You can ask us for more information about the safeguards we use.
We keep personal data only for as long as necessary for the purposes set out in this policy, and to meet our legal, regulatory, clinical governance and insurance obligations. Our main retention periods are:
When personal data is no longer needed, we delete or anonymise it securely.
We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss or misuse. These include access controls, encryption in transit, audit logging, integrity controls over records, staff and associate training, and contractual controls over our suppliers. We keep these measures under review.
We use software tools, including artificial intelligence features, to read and structure the information held on the platform, for example to organise documents and pull information into the right fields. When these tools process your information, they do so only to carry out that task at the time, on a read only basis. Your information is not retained by the tool afterwards, and it is not used to train any artificial intelligence model. Any AI provider we use acts as our processor under written contract. These tools support the work of qualified professionals and do not make decisions about your care on their own. If we ever introduce a process that makes a decision about you with legal or similarly significant effects based solely on automated processing, we will tell you and explain your right to ask for human review. Questions about our use of these tools can be sent to privacy@oria.cm.
Subject to certain conditions, you have the right to:
To exercise a right, contact us using the details in section 16. To withdraw a consent you gave on your client consent form, you can also email consent@oria.cm. We will respond within the time limits set by law. We may need to ask you for information to confirm your identity, and, where a request is complex or unclear, to clarify what you are looking for, in which case the time limit can be paused until we receive what we need.
Our website uses cookies and similar technologies. Some are strictly necessary for the site to work or to keep it secure, and for these we do not ask for consent. We use some low risk functional and analytics cookies to understand and improve how the site is used, and for these we give you clear information and an easy way to opt out. We ask for your consent before using any cookies that are not strictly necessary or low risk, such as cookies used for targeted advertising. You can manage your preferences at any time through our cookie settings.
Our website and platform are intended for use by professionals and other adults, and are not directed at children. We may process information about a young person where they are the subject of a case, and we handle that information with particular care.
If you have a question about this policy or about how we handle personal data, or you want to exercise a right, please contact us:
Oria CM, Spaces Deansgate, 125 Deansgate, Manchester, M3 2BY. Email: privacy@oria.cm
If you are unhappy with how we have handled your personal data, you have the right to complain to us directly, and we will acknowledge your complaint within 30 days and respond to it without undue delay. You also have the right to complain to the Information Commissioner's Office. You do not have to complain to us first, but it may help us put things right more quickly. You can contact the Information Commissioner's Office at ico.org.uk, or by post at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
We may update this policy from time to time. When we make significant changes, we will take reasonable steps to bring them to your attention. The date at the top of this policy shows when it was last updated.
Oria CM Ltd, company number 16212258. Registered office: Spaces Deansgate, 125 Deansgate, Manchester, M3 2BY.
