This notice applies to Chrysalis Healthcare Group Limited and all of its subsidiaries, trading divisions and product brands (individually or together referred to as ‘Chrysalis’, ‘us’, ‘we’ and ‘our’). It explains how we collect, use, share and protect your personal data, and the rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Chrysalis Healthcare Group Limited is registered in England, company number 11018685. Its registered office is at 1 Worsley Court, High Street, Worsley, M28 3NJ.

Chrysalis Finance Limited is registered in England, company number 6541664. Its registered office is at 1 Worsley Court, High Street, Worsley, M28 3NJ. It is authorised and regulated by the Financial Conduct Authority under Firm Reference Number 631193 and it is registered with the Information Commissioner’s Office under reference ZA007247.

Financing First Limited is registered in England, company number 04114714. Its registered office is at 1 Worsley Court, High Street, Worsley, M28 3NJ. It is authorised and regulated by the Financial Conduct Authority under Firm Reference Number 720098 and it is registered with the Information Commissioner’s Office under reference Z6015142.

TreatmentPay Limited is registered in England, company number 12822532. Its registered office is at 1 Worsley Court, High Street, Worsley, M28 3NJ. It is registered with the Information Commissioner’s Office under reference ZA927796.

Who is responsible for your personal data

Each of the companies above is a “controller” of the personal data it uses, which means it decides how and why your personal data is used. The company you have a relationship with (for example, the company that provides or arranges your finance) is responsible for your personal data. Where more than one Chrysalis company is involved in providing a product or service to you, each will be a separate controller. In this notice, “you” means our customers, applicants for our products, and anyone else whose personal data we use

Personal data we collect

Chrysalis is committed to protecting your privacy. This notice sets out the personal information that we may collect or obtain about you and how we treat that information.

We may collect and use the following types of personal data about you:

  • Identity data: your name, title, date of birth, and proof of identity documents.
  • Contact data: your address and address history, email address and telephone numbers.
  • Financial data: your employment status, income and expenditure, residential status, bank account details, payment history, and information from credit reference agencies.
  • Treatment data: the type, cost and provider of the treatment you are financing. This may reveal information about your health (see “Health and other sensitive information” below).
  • Information about your circumstances: including any information you share with us about a health condition, life event or other circumstance that may affect how we can best support you.
  • Communications data: records of our correspondence with you, recordings of telephone calls, and details of any complaints.
  • Technical data: your IP address, device and browser information and cookie identifiers when you use our website or customer portal.
  • Marketing data: your marketing preferences.

We collect your personal data directly from you and from other sources, including:

  • from the healthcare practice or clinic that introduces you to us when you apply for finance (some of these practices act as our appointed representatives);[C2.1]
  • if another person provides your information to us when they apply to obtain a product from us on your behalf or that is to be held jointly with you;
  • when you provide it online or by any other method of communication, for example, on “contact us” forms, or when you provide it through the course of our relationship, for example, if you inform us of a change in your circumstances;
  • from credit reference agencies and fraud prevention agencies;
  • from lenders on our panel, where we have introduced you to them;
  • from open banking providers, where you choose to share your bank account information with us to help us assess affordability;
  • from publicly available sources, such as the electoral register; and
  • technical information, including the Internet Protocol (IP) address used to connect to the internet, may be collected from you when you visit our website or customer portal (see our Cookie Policy).

We may communicate and interact with customers and prospective customers through services operated by Meta Platforms group companies, including:

  • WhatsApp Business;
  • Facebook;
  • Facebook Messenger;
  • Instagram; and
  • other Meta business products and communication tools.

Where you contact us or engage with us through these platforms, we may process personal data including:

  • your name and contact details;
  • social media profile information;
  • telephone number;
  • message content and attachments;
  • records of communications and interactions;
  • marketing preferences;
  • technical and usage data relating to your interaction with our content, advertisements, or communications.

We may use Meta services and business tools for purposes including:

  • customer support and communications;
  • responding to enquiries;
  • account servicing;
  • appointment reminders and notifications;
  • marketing and promotional communications;
  • lead generation;
  • advertising performance measurement;
  • analytics and audience insights; and
  • improving our products and services.

Meta Platforms Ireland Limited and related Meta group companies may independently process certain personal data in accordance with their own privacy policies and terms.

We recommend that you do not send highly sensitive personal data, financial account credentials, payment card information, medical information, or special category personal data through social media or messaging platforms unless specifically requested through an approved secure process.

Health and other sensitive information

Because we provide finance for healthcare treatment, information about the treatment you are financing may reveal information about your health. Health information is “special category data” under data protection law, and we will only use it where the law allows us to. We use it to assess your application and to provide and manage your agreement with your explicit consent, which we ask for when you apply.

If you tell us about a health condition or other circumstances that may make you vulnerable, we will record this so that we can support you and make sure you are treated fairly. We will only use this information for that purpose, and we rely on your explicit consent or where this is not possible, the condition in paragraph 18 of Schedule 1 to the Data Protection Act 2018 (safeguarding of economic well-being of certain individuals). We will only share it where this is necessary to support you or where the law requires it.

When we carry out fraud prevention checks, we may process information about criminal offences or alleged offences. We only do this where it is permitted by the Data Protection Act 2018, for example to prevent fraud.

How we use your personal data and our lawful basis

We may only use your personal data where we have a lawful basis to do so. We use your personal data:

  • to assess your application and provide and manage your agreement, including checking your identity and assessing your creditworthiness and affordability. We do this to enter into and perform our contract with you, and to meet our legal and regulatory obligations, including FCA rules on creditworthiness assessments;
  • to introduce you to lenders on our panel where we act as a credit broker. We do this to take steps at your request before you enter into a contract;
  • to prevent and detect fraud and money laundering. We do this to meet our legal obligations, including under the Money Laundering Regulations 2017, and because it is in our legitimate interests to prevent fraud;
  • to communicate with the practice that introduced you about the progress of your application and to arrange payment for your treatment. We do this to perform our contract with you, and because it is in our legitimate interests to administer finance arranged through our partners;
  • to collect payments and recover any money owed, including through debt collection agencies. We do this to perform our contract with you and because it is in our legitimate interests to recover debts;
  • to handle your enquiries and complaints. We do this to meet our regulatory obligations and because it is in our legitimate interests to resolve issues;
  • to monitor and improve our products, services and the outcomes our customers receive, including under the FCA’s Consumer Duty. We do this to meet our regulatory obligations and because it is in our legitimate interests;
  • to keep records and report to our regulators, to meet our legal and regulatory obligations;
  • to send you marketing with your consent or, where the law allows, because it is in our legitimate interests (see “Marketing” below); and
  • to run and secure our website and customer portal, because it is in our legitimate interests. We only use non-essential cookies with your consent.

Where we rely on our legitimate interests, we have considered whether those interests are outweighed by your rights. You can ask us for more information about this.

Website

You may browse this website without telling us who you are.. If you fill out the “Contact Us” form on our website, we will collect your name, email address, your question or comment and your IP address. We use cookies and similar technologies on our website. We use strictly necessary cookies to make the website work, and we only use other cookies, such as analytics and marketing cookies, if you agree to them through our cookie banner. You can change your choices at any time using the “Manage consent” link. Our Cookie Policy explains which cookies we use and how long they last. You can find out more about how cookies work at https://ico.org.uk/your-data-matters/online/cookies/

Our website may contain links to third-party sites not operated by Chrysalis, such as Facebook, Instagram, LinkedIn or TikTok. These websites are not under our control and, as such, we are not responsible for the content of them or for their privacy practices. If you choose to use any linked third-party website, any personal data collected by that site will be controlled by the privacy notice of that third party.

We may use Meta business and advertising tools, including cookies, pixels, tags, and related technologies, to:

  • measure the effectiveness of advertising campaigns;
  • understand website usage and customer engagement;
  • deliver relevant advertising;
  • create audience insights; and
  • improve our services and marketing activities.

These technologies may collect information regarding your device, browser activity, pages visited, interactions with our website, and engagement with advertisements or communications.

Where required by law, we will obtain your consent before placing non-essential cookies or similar tracking technologies on your device.

Our website may contain links to third-party sites not operated by Chrysalis, such as Facebook or Twitter. These websites are not under our control and, as such, we are not responsible for the content of them or for their privacy practices. If you choose to use any linked third-party website, any personal data collected by that site will be controlled by the privacy notice of that third party.

Credit applications

If you apply for credit, we will collect information about you which will be recorded on a computer. We may also share your information with carefully selected third party lenders outside Chrysalis where we act as a credit broker and we may use and search the records of credit reference or fraud prevention agencies to check your identity, assess your creditworthiness and affordability and to prevent fraud and money laundering. You can view the Privacy Policies of those third parties by clicking the links below:

Where we introduce you to a lender, that lender will be a separate controller of your personal data and will use it in line with its own privacy notice. The lender may carry out its own credit and fraud prevention checks.

Credit reference agencies. When we carry out a credit search, the credit reference agency will keep a record of it. A soft search will be left on your credit file upon application, and a hard search will be left once your loan goes live or we your loan is declined. We may also share information about your agreement and how you manage it with credit reference agencies on an ongoing basis, including if you miss payments. Credit reference agencies may share this information with other organisations. The identities of the credit reference agencies, and the ways in which they use and share personal data, are explained in more detail in the Credit Reference Agency Information Notice (CRAIN), available at www.transunion.co.uk/crain

Fraud prevention agencies. Before we provide finance to you, we carry out checks to prevent fraud and money laundering and to verify your identity. These checks involve sharing your personal data with fraud prevention agencies. If we, or a fraud prevention agency, decide that you pose a fraud or money laundering risk, we may refuse your application, and the fraud prevention agency may keep a record of that risk. This may result in other organisations refusing to provide services, financing or employment to you.

We may also use your information to protect Chrysalis or others, and we may share your information with third parties when we believe it is necessary to comply with the law or to protect our or another person’s rights, property or safety, including exchanging information with third parties to protect against fraud and reduce payment risks.

Automated decision-making

When you apply for finance, we (and lenders on our panel) may use automated systems, such as credit scoring, to help decide whether to accept your application. These systems take into account the information you give us, information from credit reference and fraud prevention agencies, and our lending criteria, to assess whether the finance is affordable for you and whether you meet those criteria. This may mean your application is declined automatically.

If a decision with a significant effect on you is made solely by automated means, you have the right to be told about it, to give us your views, to ask for a person to review the decision, and to challenge it. Please contact us using the details in “How to contact us” above.

Who we share your personal data with

We may share your personal data with:

  • other companies in the Chrysalis Healthcare Group;
  • the healthcare practice that introduced you to us (including our appointed representatives), so that they know the progress of your application and so that we can pay them for your treatment;
  • lenders on our panel, where we act as a credit broker;
  • credit reference agencies and fraud prevention agencies;
  • service providers who support our business, such as IT and cloud hosting providers, communications providers, identity verification providers and payment providers. They act only on our instructions;
  • debt collection agencies and debt purchasers;
  • our funders, where your agreement is funded or securitised;
  • our professional advisers and auditors;
  • regulators and public bodies, including the Financial Conduct Authority, the Financial Ombudsman Service, the Information Commissioner’s Office, HMRC and law enforcement agencies, where we are required or permitted to do so by law; and
  • anyone to whom we transfer, or may transfer, our rights under your agreement, or any buyer or potential buyer of our business.

International transfers

We do not transfer your personal data outside the UK. Where we, or our service providers, transfer personal data outside the UK, we make sure it is protected, for example by only transferring it to countries the UK government has decided provide adequate protection, or by using contracts approved for this purpose, such as the International Data Transfer Agreement. You can contact us for more information about these safeguards.

Privacy, security and confidentiality

The privacy and security of your information is important to us. Any personal data we obtain from you is processed in accordance with the UK GDPR and the Data Protection Act 2018. Chrysalis has security policies, rules and other measures in place to protect the personal information we hold about you, and takes all reasonable steps to protect your information, We do not sell your personal data.

How long we keep your personal data

We keep your personal data only for as long as we need it for the purposes set out in this notice, including to meet our legal, regulatory, accounting and reporting requirements. In general:

  • if your application is declined or does not go ahead, we keep your personal data a minimum of 3 months from the date of the application and thereafter for so long as we have a legitimate reason to continue to hold that information;
  • if you take out an agreement with us, we keep your personal data for a minimum of six years after the agreement ends and thereafter for so long as we have a legitimate reason to continue to hold that information;
  • we keep records of identity checks for at least five years after our relationship ends, as required by the Money Laundering Regulations 2017 and thereafter for so long as we have a legitimate reason to continue to hold that information;
  • we keep complaint records for at least three years, in line with FCA rules;

Marketing

We would like to tell you about products and services that may interest you. We will only send you marketing by email or text message if you have agreed to this or, if you are an existing customer, where the marketing is about our own similar products and services and you have not opted out. You can opt out at any time by clicking “unsubscribe” in any marketing email, replying STOP to a text message, or contacting us.

Your rights

You have the following rights in relation to your personal data:

  • Access: to ask for a copy of the personal data we hold about you.
  • Rectification: to ask us to correct personal data that is inaccurate or incomplete.
  • Erasure: to ask us to delete your personal data in certain circumstances.
  • Restriction: to ask us to limit how we use your personal data in certain circumstances.
  • Objection: to object to us using your personal data where we rely on our legitimate interests, and to object at any time to us using it for direct marketing.
  • Portability: to ask us to transfer personal data you have given us to you or to another organisation, in certain circumstances.
  • Withdrawing consent: where we rely on your consent, to withdraw it at any time. This will not affect anything we did before you withdrew it.
  • Automated decisions: the rights described in “Automated decision-making” above.

Some of these rights do not apply in every situation, for example where we need to keep information to meet our legal or regulatory obligations. To exercise any of your rights, please contact us using the details in “How to contact us” above. There is normally no charge, and we will usually respond within one month.

How to complain

If you have any concerns about our use of your personal information, you can make a complaint to us at Chrysalis Healthcare Group Limited, PO Box 404, Alderley Edge, Cheshire SK9 0EA or by emailing dataprotection@chrysalisfinance.com. We will acknowledge your complaint within 30 days and let you know the outcome without undue delay.

If you are not satisfied with our response, you can also complain to the ICO if you are unhappy with how we have used your data.

The ICO’s address:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

ICO Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk (you can also complain online at https://ico.org.uk/make-a-complaint/)

Changes to our Privacy Notice

This Notice may be updated periodically at Chrysalis’s discretion to reflect changes in our privacy practices or relevant laws. Chrysalis will make any changes to this Notice by updating this page. If we make significant changes, we will let you know by email or through your customer portal. You should check this page from time to time to ensure that you are happy with any changes. This Privacy Notice was last updated on [date]