Privacy Policy
The Mind & Psychiatry Clinic Privacy Policy
1. Introduction
At The Mind & Psychiatry Clinic, we are committed to protecting your privacy and handling your data in a confidential and professional manner.
This policy explains how we collect, use, store, and share your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. Who We Are
The Mind & Psychiatry Clinic is a private psychiatry clinic based at 6a Randolph Crescent, Edinburgh, EH3 7TH offering diagnostic assessments, therapy, and medication management for a range of mental health conditions.
Data Controller: Dr Amy Martin
3. What Information We Collect
We process two categories of personal information about you:
- Standard personal information (for example, information we use to contact you or identify you); and
- Special categories of information (for example, health information, information about your race, ethnic origin and religion.
We may collect and process the following types of personal data:
- Identity Data: Full name, date of birth, gender, NHS number
- Contact Data: Address, phone number, email
- Health Data (Special Category): psychiatric history and diagnoses; prescriptions and medication history; risk assessments and safeguarding concerns; referrals and correspondence with other clinicians.
- Financial Data: Payment details, insurance information
- Communication Data: Emails, appointment notes, feedback
4. Lawful Basis for Processing
We process your data under the following lawful bases:
- Consent: For sharing information with third parties or sending appointment reminders.
- Contract: To provide psychiatric services you’ve requested.
- Legal Obligation: For safeguarding, reporting serious concerns, or complying with healthcare regulations.
- Vital Interests: In emergencies where your safety or the safety of others is at risk.
- Legitimate Interests: For internal audits, service improvement, or anonymised research.
5. How We Use Your Information
We use your data to:
- Deliver personalised psychiatric care
- Maintain accurate clinical records
- Coordinate with other healthcare providers
- Manage appointments and billing
- Ensure safety and comply with legal duties
- Improve our services through anonymised analysis or feedback
Our Marketing
We may provide you with information about products, services, offers, and other news where we feel these may interest you.
Depending on what contact information you have given to us, we may contact you by email, post, or phone. We will only do this where you have consented to receiving such information from us.
Third Party Policies
Our website may contain links to websites owned by other organisations. If you follow a link to another website, these websites will have their own privacy policy. We suggest that you check the policies of any other websites before giving them your personal information as we cannot accept responsibility for any other website.
6. Sharing Your Information
To provide you with services we need to share your personal information with our medical team. Our medical team works with The Mind & Psychiatry Clinic as self-employed contractors.
We may need to share information with regulators: Healthcare Improvement Scotland, General Medical Council, the Information Commissioner’s Office and the Health Service Ombudsman.
With your agreement, information can be shared with relatives, partners or friends who act as a carer for you. We will only share information once the person you have asked us to share the information with has provided us with proof of their identity. We may share information with anyone you have given as an emergency contact, for example your next of kin.
There are some other rare occasions where we may share your data with other organisations.
- We may share information with the police, fire and rescue services if there is an immediate risk of harm to you or other people, or there is a legal requirement to do so e.g. the police have obtained a court order requiring us to provide information.
- We may share information with our professional advisors, including lawyers and accountants, if this is necessary to take and receive professional advice (including legal advice), or to bring or defend a legal claim or threatened claim.
- We may share information with our insurers and the insurers of other organisations where this is necessary to investigate insurance cover and to handle a claim or threatened claim.
- We may share information with individuals or organisations if we are legally required to, for example if this is specified in a warrant or court order.
- We may share information with pharmacies for prescriptions.
We will never sell your data or share it for commercial purposes.
7. Data Security
We take robust measures to protect your data:
- Encrypted electronic health records
- Email and messaging systems
- Confidentiality training for all staff
- Access controls and regular audits
Emails
If you choose to send us information via email, we cannot guarantee the security of this information until it is delivered to us.
8. Data Retention
We retain your data in line with legal and clinical guidelines:
- Adult psychiatric records: typically, 20 years after last contact
- Financial records: 6 years for tax and accounting
- Communications: up to 2 years unless required longer
9. Destruction Arrangements
Any paper containing any confidential information that is not required for data retention will be shredded. It will then be uplifted on an as required basis as confidential waste destruction.
The term ‘electronic records’ covers all online data processed by the clinic, including:
- EHR/Practice management systems
- Email and messaging platforms
- Cloud storage (OneDrive, SharePoint, Google Workspace, etc.)
- Telepsychiatry platforms
- Billing and invoicing systems
- Clinical notes, letters, assessments, risk plans
- Controlled drug prescribing records
- Staff HR and training records
- Backup and disaster recovery environments
Destruction Methods (Online Data)
Secure Deletion of Online Data
As a data processor, Semble will permanently delete information when requested by you as the data controller. When you request deletion of patient data, we delete all backups of the relevant data where possible. Where we are unable to fully delete data from all backup systems, it may be stored for up to 3 years maximum, during which time it is put “beyond use” in compliance with ICO guidance.
Cryptographic Erasure
Semble uses encryption key management for data protection:
- Database data: Encrypted using MongoDB managed KMS keys
- Documents: Encrypted using client-maintained KMS keys
- S3 storage: Encrypted using S3 managed keys
Semble report that they use robust encryption throughout the data lifecycle, our standard deletion process focuses on secure data deletion rather than cryptographic key destruction as the primary erasure method.
Backup Retention Periods
- MongoDB Atlas backups: Retained for 13 months
- GCP backups: Hot storage for 365 days, then archived indefinitely
- AWS backups: Stored indefinitely
- Documents: Version control enabled with 1-month retention for deleted items
Access to Deleted Records for Medico-Legal Purposes
As the data controller, The Mind & Psychiatry Clinic retain legal responsibility for safeguarding patient data. Semble cannot continue to hold data without a valid contract, and data will be scheduled for permanent deletion upon contract termination. The Mind & Psychiatry Clinic would export data (available in JSON format) before account closure to meet our ongoing medico-legal obligations.
Destruction Certificates and Logs
For physical devices, Semble maintains certificates of destruction (retained for one year) when using E-Waste services. For digital data deletion, Semble maintains audit trails and data breach registers as part of their ISO 27001 compliance.
Subject Access Requests and Right to Erasure
As data controller, The Mind & Psychiatry Clinic are responsible for handling subject access requests (DSARs) and right to erasure requests from your patients. Semble, as data processor, have confirmed that they will:
- Assist in fulfilling these requests
- Provide tools within the system to help The Mind & Psychiatry Clinic exercise data subject rights
- Respond to The Mind & Psychiatry Clinic instructions without undue delay (typically within one month)
- Delete data upon your instruction as outlined above
Hardware Containing Online Data
If a member of staff leaves The Mind & Psychiatry Clinic they will no longer have access to the electronic medical record system, any email accounts containing online data or any shared drives where they could access online data.
Authorisation & Audit Trail
Every destruction event must be logged with:
- Date and time
- System or dataset
- Method used
- Staff member performing deletion
- Authorising manager (usually the Data Protection Lead or Clinic Director)
- Confirmation of success
- Any exceptions or failures
Staff Responsibilities
Clinicians
- Delete draft notes, duplicate files, and temporary documents
- Use only approved systems
- Report any failure to delete data
Admin Team
- Action scheduled deletions
- Maintain destruction logs
- Ensure cloud storage folders are managed
Data Protection Lead
- Approve destruction events
- Audit compliance
- Review provider deletion guarantees
- Update retention schedules
10. Your Rights
You have the right to access your information and to ask us to correct any mistakes and delete and restrict the use of your information. You also have the right to object to us using your information, to ask us to transfer of information you have provided, to withdraw permission you have given us to use your information and to ask us not to use automated decision-making which will affect you.
You have the following rights (certain exceptions apply):
You have the right to:
- Right of access: the right to make a written or verbal request for details of your personal information and a copy of that personal information. You can read more about this right here (https://ico.org.uk/your-data-matters/your-rightof-access).
- Right to rectification: the right to have inaccurate information about you corrected or removed. You also have the right to ask us to complete information you think is incomplete. You can read more about this right here (https://ico.org.uk/your-data-matters/your-right-to-get-your-data-corrected).
- Right to erasure (‘right to be forgotten’): the right to have certain personal information about you erased. You can read more about this right here (https://ico.org.uk/your-data-matters/your-right-to-get-your-data-deleted)
- Right to restriction of processing: the right to request that your personal information is only used for restricted purposes. You can read more about this right here (https://ico.org.uk/your-data-matters/your-right-to-limit-howorganisations-use-your-data/)
- Right to object: the right to object to processing of your personal information in cases where our processing is based on the performance of a task carried out in the public interest or we have let you know the processing is necessary for our or a third party’s legitimate interest. You can object to our use of your information for profiling purposes where it is in relation to direct marketing. You can read more about this right here (https://ico.org.uk/your-datamatters/the-right-to-object-to-the-use-of-your-data/)
- Right to data portability: the right to ask for the personal information you have made available to us to be transferred to you or a third party in machine-readable formats. You can read more about this right here (https://ico.org.uk/your-data-matters/your-right-to-data-portability/)
- Right to withdraw consent: the right to withdraw any consent you have previously given us to handle your personal information. If you withdraw your consent, this will not affect the lawfulness of our use of your personal information prior to the withdrawal of your consent and we will let you know if we will no longer be able to provide you your chosen product or service.
- Right in relation to automated decisions: you have the right not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you, unless it is necessary for entering into a contract with you, it is authorised by law or you have given your explicit consent. We will let you know when such decisions are made, the lawful grounds we rely on and the rights you have. You can read more about this right here (https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/rights-related-to-automated-decision-making-including-profiling/)
- Right to lodge a complaint with the Information Commissioner’s Office (ICO):
Address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
ICO Contact: https://ico.org.uk
Telephone: 0303 123 1113
ICO Scotland contact details
Email: Scotland@ico.org.uk
11. Changes to This Policy
We may update this policy to reflect changes in law or practice. The latest version will always be available on our website or in person at The Mind & Psychiatry Clinic.
12. Contact Us
If you have questions or concerns about your data, please contact:
The Mind & Psychiatry Clinic
6a Randolph Crescent
Edinburgh
EH37TH
