Legal
Privacy policy
This notice explains how we collect and use your personal information, and your rights over it. Much of what we hold is health information, which the law protects with extra safeguards, and we treat it that way.
Who we are
The Members’ Clinic is a trading name of [LEGAL ENTITY NAME], a company registered in England and Wales (company number [COMPANY NUMBER]), registered office [REGISTERED OFFICE]. We are the data controller for the information described here and are registered with the Information Commissioner’s Office (ICO) under number [ICO REGISTRATION NO.].
We are a multidisciplinary mental health service. Our own clinicians are registered with their relevant professional bodies (for example the HCPC). Where psychiatric assessment or treatment is needed, it is provided by independent consultant psychiatrists we refer to, registered with the General Medical Council, rather than clinicians employed within The Members’ Clinic.
Contact us about your information
Data Protection Officer: [DPO NAME], [DPO EMAIL]
Caldicott Guardian: [CALDICOTT GUARDIAN], who oversees the confidential handling of patient information
The information we collect
| Category | Examples |
|---|---|
| Identity & contact | Name, date of birth, address, email, phone, emergency contact. |
| Enquiry & website | Messages and form responses, and limited technical data (see our cookie policy). |
| Health & clinical | Symptoms, history, assessments, diagnoses, notes, correspondence, medication and risk information. |
| Genetic / pharmacogenomic | Where clinically indicated and only with your explicit consent, results used to guide safer, better-matched medication choices. |
| Special category (other) | Where relevant to your care, for example ethnicity, sexuality, religion, or details about your family and network. |
| Funding & payment | Insurer and policy details, employer sponsorship where applicable, invoices and payment records. |
| Referral source | GP, PMI insurer, employer programme, or self-referral details. |
Why we use it, and our lawful bases
Under UK GDPR we need a lawful basis to use your data, and an additional condition for health and other special category data. In outline:
| What we do | Lawful basis (Art. 6) | Special category (Art. 9 / DPA 2018) |
|---|---|---|
| Provide assessment, treatment and care; keep clinical records | Contract; legitimate interests | Art. 9(2)(h): health care under a duty of confidentiality |
| Respond to enquiries and referrals | Legitimate interests; steps before a contract | Explicit consent, or Art. 9(2)(h) |
| Keep you safe / act in an emergency | Legal obligation; vital interests | Art. 9(2)(c); Art. 9(2)(h) |
| Safeguard children and adults at risk | Legal obligation; public interest | DPA 2018 safeguarding condition |
| Bill and collect payment | Contract; legal obligation | Not usually needed; funding data is not clinical |
| Send you updates or marketing (if you opt in) | Consent | Not applicable; we don’t use health data for marketing |
Your privacy at work
If your employer or insurer pays
They do not see your clinical records. When care is funded by an employer programme or PMI, the funder receives only what is needed to authorise and pay for care, for example that sessions took place and an invoice is due.
They do not receive your clinical notes, assessment content, diagnosis or the detail of what you discuss. Information moves along your care with your consent, and each transition is governed by that consent. You can ask us at any time exactly what a funder can and cannot see.
Who we share it with
We share information only where necessary and, for clinical information, with your consent except where the law requires or permits otherwise. We may share with:
- the clinicians within The Members’ Clinic’s own multidisciplinary team who are involved in your care, so your team works from one shared, secure record;
- independent clinicians we refer you to and share your care with, for example consultant psychiatrists, where you consent; they keep their own records as separate data controllers, and we share only what is needed for safe, coordinated care;
- your GP and other healthcare providers, with your consent, to coordinate safe care;
- your insurer or employer’s programme, limited to what is needed to authorise and pay for care (never clinical detail; see above);
- laboratories or specialists (for example for genetic testing) where you and your clinician agree it is indicated;
- our trusted service providers (IT, secure records, communications, payment) under written contracts that require them to protect your data and use it only on our instructions;
- regulators, safeguarding authorities, courts or the police, where we are legally required or permitted to, or to protect someone from serious harm.
We do not sell your personal data or use it for advertising.
Where your data is held, and for how long
We aim to keep personal data in the UK. Where a provider processes data outside the UK, we ensure an adequate level of protection through UK adequacy regulations or approved safeguards. You can ask us for details of any such transfer.
We keep clinical records in line with the Records Management Code of Practice 2021 and our retention schedule. In outline: adult health records are generally kept for 8 years after your last contact; records for children and young people until their 25th birthday (or longer in defined cases); enquiry data that doesn’t lead to care for a short period only; and financial records for 6 years for tax purposes.
Your rights
Subject to some legal limits, you have the right to be informed; to access a copy of your data; to have inaccurate data corrected; to ask us to erase data; to restrict or object to processing; to data portability; and to withdraw consent at any time (which won’t affect the lawfulness of earlier processing). Some rights are limited where we must retain records for clinical-safety or legal reasons; for example, we can’t always delete a clinical record on request.
To exercise any right, contact our DPO at [DPO EMAIL]. We respond within one month, and there is normally no charge. We don’t make decisions about your care by automated means alone. Clinical judgement is always made by a qualified clinician.
Complaints, and changes to this notice
If you’re unhappy with how we handle your data, please tell our DPO first so we can put it right. You also have the right to complain to the ICO at ico.org.uk/make-a-complaint, or 0303 123 1113.
We may update this notice; the current version is always at themembersclinic.com/privacy. Effective [EFFECTIVE DATE] · Last updated [LAST UPDATED].