Privacy notice

The information we collect

Depending on the circumstances, we may collect and use:

• Identity data — name, date of birth, gender (you’ve told us for correspondence purposes) and pronoun preferences
• Contact data — address, email, phone number, next of kin/emergency contacts, and GP details
• Financial information — including insurance details, for private patients paying for our services
• Health/patient data — medical history, conditions, medication, allergies, test and assessment results, and recordings of clinician sessions
• Safeguarding status — whether you’re subject to any protection order relating to your health, wellbeing, or human rights
• Equality monitoring data — ethnicity, religion or belief, gender identity (for NHS equality reporting), and disability status, which is always optional (see Equality monitoring below)

How we collect it:

• Directly from you, or someone acting on your behalf
• From people who know you well — family, friends, or carers
• From other health, care, or education organisations involved in your care (e.g. your GP, or a child’s school)
• Automatically, via cookies and similar technology when you use our website or patient portal (see Cookies, below)
• Your marketing and communication preferences, where relevant

How we use your information

We only use your personal information where the law allows. Most often, this is because:

• you’ve given consent — freely given, specific, informed, and unambiguous;
• it’s necessary to perform a contract with you (e.g. private treatment);
• it’s necessary for our legitimate interests, balanced against your rights; or
• we must comply with a legal or regulatory obligation.

Health information needs an additional “special category” condition under Article 9 UK GDPR — usually that processing is necessary for healthcare or treatment (Art 9(2)(h)) or for research and statistics (Art 9(2)(j)).

The table below sets out each purpose we use your information for, the categories of data involved, our lawful basis, and how long we keep it.

* Standard clinical retention: we keep adult records for 8 years after your last contact with us. Records for patients under 18 are kept until their 25th birthday (or 26th, if they were 17 when treatment ended).

† Article 6(1)(f) (legitimate interests) applies only where the person whose information we’re using isn’t the one who holds the contract with us — for example, where a parent or guardian holds a private contract on behalf of a child, or where someone else holds a contract on behalf of an adult.

Common law duty of confidentiality

Alongside data protection law, we also owe you a common law duty of confidentiality. Where we use health information for research without your consent, we either anonymise it first, or rely on approval from the NHS Health Research Authority’s Confidentiality Advisory Group (under section 251 of the NHS Act 2006) or another legally recognised basis.

National data opt-out

The national data opt-out lets you choose whether your confidential patient information is used for purposes beyond your individual care — such as research and planning. We apply this opt-out to our own use of your information for these purposes.

Wherever possible, information used for research and planning is anonymised. If you don’t opt out, we may use your information to help improve care, develop treatments, and support health research and planning. If you do opt out, your individual care isn’t affected. This opt-out doesn’t cover use of your data for insurance or marketing — we’d only do that with your specific agreement — and you can still take part in individual research studies by giving separate, explicit consent, even if you’ve registered a general opt-out.

Find out more or register your choice at nhs.uk/your-nhs-data-matters

Equality monitoring (PCREF)

Our NHS Standard Contract requires us to collect specific equality monitoring data, to help monitor and reduce inequalities in our services and meet NHS reporting requirements. All fields are optional — choosing “prefer not to say” doesn’t affect your care. We submit this data to NHS England in anonymised, aggregated form only. If you’re providing this information for a child or someone you care for, please take their own views into account where they’re able to express them.

Recording your assessment sessions

We record clinical assessment sessions, including video and audio, as part of your care. This helps our clinical team carry out a thorough and well-informed assessment — for example, by allowing another clinician to review relevant details, contribute a second opinion, or check something without asking you to repeat it. Recordings also support our clinical governance, helping us make sure assessments are carried out consistently and to the standards we expect, and provide an accurate record if any questions or concerns arise afterwards.

Recordings are kept for the same period as the rest of your clinical record (see the table above), and are protected with the same safeguards as your other health information. We may also use recordings for research, on the lawful basis and for the retention period set out above, and subject to the safeguards described in “Using your information for research” below.

Using your information for research

We may use your information for research where we have a lawful basis to do so, alongside our duty of confidentiality and the national data opt-out described above. We often anonymise data for research, for example to share statistics with organisations like NHS England, publish peer-reviewed results, or improve our own services.

Healios is working with a specialist company called Canary Speech to help us build tools that can better identify neurodevelopmental conditions. To do this, we have shared a set of audio recordings from clinical sessions with them. These recordings have been stripped of all unnecessary personal details, though some biometric data must remain to ensure the research’s validity.

Canary Speech is acting as our data processor, which means they are working strictly on our behalf under a formal contract. They must follow strict rules to keep your information safe. All of their work happens within the UK, and your data is not sent anywhere else.

Once Canary Speech finishes their research, they will permanently delete the original audio recordings. They only keep the technical data (such as statistical patterns) that they created during their study.

We are processing this information to help improve our diagnostic tools and provide better support for people with neurodevelopmental conditions. This is allowed under data protection laws for research purposes.

If you have any questions about this research or would like to exercise your data rights, please email our Data Protection Officer at [email protected].

Who we share your information with 

We may share your personal information with:

• your GP and other healthcare professionals directly involved in your care;
• your insurer, if you’re a private patient using medical insurance;
• data processors acting on our instructions — such as IT and payment suppliers — who don’t use your information for their own purposes;
• academic and research partners, where we’re supporting health-related research; and
• carefully selected health-focused organisations, to improve diagnosis, treatment, and outcomes.

We’ll also share information where legally required — for example, if a court, regulator, or public inquiry orders it, or where the public interest outweighs your right to confidentiality, such as preventing a serious crime or protecting a child or vulnerable adult.

Is your information transferred outside the UK?

We primarily process and store your personal information in the UK. Where we work with service providers based outside the UK, we put appropriate safeguards in place first — such as UK adequacy regulations or an International Data Transfer Agreement issued by the ICO. Contact our DPO for details of the safeguards that apply to a specific transfer.

Your data protection rights

Under data protection law, you have the right to:

• Access — ask us for a copy of your personal information
• Rectification — ask us to correct or complete information you believe is inaccurate or incomplete
• Erasure — ask us to delete your information in certain circumstances
• Restriction — ask us to limit how we use your information in certain circumstances
• Object — object to our use of your information in certain circumstances
• Portability — ask us to transfer information you’ve given us to you or another organisation, in certain circumstances

These rights are free to exercise, and we aim to respond within one month. We may ask for proof of identity, or further information about your request, so we can respond safely and efficiently. Contact us using the details above to make a request.

If we’ve relied on your consent for a specific use of your information, you can withdraw it at any time. This won’t affect the lawfulness of anything we did before you withdrew it.

Opting out of marketing

You can unsubscribe from marketing at any time using the “unsubscribe” link in our emails, or by emailing our DPO at [email protected]. You can’t opt out of service-related emails — such as those about your account or care — as these are necessary for us to deliver our services to you.

How to complain

If you’re unhappy with how we’ve used your personal information, please contact our DPO in the first instance, using the details above. If you’re still not satisfied, you can complain to the Information Commissioner’s Office (ICO):

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113

ICO website: https://www.ico.org.uk

Retention and security

Retention periods for each purpose are set out in the table above, informed by guidance from NHS England and NHS Scotland, and relevant professional bodies. At the end of the relevant period, we either securely destroy your information or anonymise it for further use, such as service improvement or research.

We use appropriate technical and organisational measures to protect your information from loss, misuse, or unauthorised access, and we limit access to those who need it. Anyone processing your data on our behalf is contractually bound by confidentiality obligations. We have procedures in place to detect, investigate, and — where legally required — report any personal data breach to you and the ICO.

Cookies

If you visit our website, we use cookies to run the site and to provide a more personalised experience. Cookies are small pieces of text downloaded to your device when you visit a website, which let the site remember your preferences or past actions. We always ask for your consent before placing a cookie, except where it’s strictly necessary for the website to function. You can manage your preferences at any time via our cookie management platform, or by emailing [email protected] with any queries.

Strictly Necessary Cookies

We have two cookies that we use which are necessary to run our site. The purpose of these cookies is outlined below:

Preferences Cookies

We operate the following cookies which allow you to set preferences regarding the use of our site:

Analytical Cookies

We use the following cookies to analyse visitors to our website:

Advertising cookies

We use the following cookies for advertising:

Where you’ve consented to non-essential cookies, you can withdraw that consent at any time via our cookie management platform.

Changes to this notice

We may update this notice from time to time. The latest version will always be available on our website, with the review date shown at the top.