Privacy notice
Introduction
This privacy policy sets out how Healios uses and protects your personal information.
When we talk about “you” and “your personal information” in this privacy policy, we mean the individual whose personal information we are processing. This will primarily be the patient or prospective patient of our healthcare services but may also include other individuals such as those involved in the care of the patient (including a parent or guardian of a patient that is a young child) and anyone interested in our services and research (for example, mail list subscribers).
About Healios
Healios Limited (referred to as “Healios”, “we” or “us” in this policy) is a UK company, trading as Healios for NHS funded services and Melios for private healthcare services. We specialise in providing online mental health services to children, young people and adults. We provide our health services to NHS-funded patients and private patients. We also undertake our own research projects to better understand certain health conditions and related behaviours, to develop our services and to improve diagnosis, care and treatment outcomes for patients.
We are registered in England with registration number 08459279 and at registered address Vintage House, 36-37 Albert Embankment, London, Greater London, SE1 7TL.
The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act
2018 are data protection laws that apply to those processing personal information. Under these data protection laws, we are the controller for your information. A controller decides why and how personal information is used and shared. As a controller, we are responsible for ensuring that the personal information that we process is kept secure and is used appropriately and in accordance with the law.
Date of last review
March 2026
Our contact details
- Name: Healios Limited
- Address: Vintage House, 36-37 Albert Embankment, London, Greater London, SE1 7TL.
- General phone number: 0330 124 4222
- General enquiries email address:[email protected]
- Website for private patients: Melios
- Website for NHS-funded patients: Healios
Data Protection Officer contact details
We have appointed a Data Protection Officer who is responsible for monitoring our compliance with data protection requirements. You can contact them with queries or concerns relating to the use of your personal information using the above contact details or by emailing our Data Protection Officer at [email protected]
What personal information do we collect and how?
We may collect and use some or all of the following personal information about you, depending on the circumstances:
- Identity data including name, data of birth, and gender and pronoun preferences.
- Contact data including your postal address, email address and telephone number; next of kin details (including any support networks) and emergency contact details; and GP details.
- Financial information and/or insurance policy details (if you are a private patient paying for our services)
- Patient data including information about your health (such as medical conditions, prescription medication (including standard growth monitoring for children), allergies, medical requirements and medical history), results of tests and investigations (including psychological evaluations) and recordings of clinician sessions and related calls.
- Safeguarding status data (whether or not you are subject to any protection orders regarding your health, wellbeing and human rights).
- Other sensitive data such as information revealing racial or ethnic origin.
We collect personal information in a number of ways. This may include personal information (including information about your health) received:
- directly from you or your authorised representative, for example, when you contact us about our services
- from people who know you well such as friends, family members and carers
- from other health and care organisations involved in your care, for example, referral details from your GP (if you are an NHS funded patient)
- from education organisations where appropriate, for example, a child’s school (for our children’s assessment services)
As you interact with our website and client/patient portal, we will also collect usage and technical data about your equipment and use of our website and portal. We collect this personal information by using cookies and other similar technologies. Further details on this can be found in the cookies section below.
Where appropriate, we will also collect and use marketing and communications data including your preferences in receiving marketing from us and your communication preferences. You can find out more about our use of data for marketing below, including how to opt out.
Who do we share personal information with?
We may share your personal information with the following types of organisations:
- your insurance provider (if you are a private patient using medical insurance cover);
- third party data processors, such as IT system suppliers and payment processors;
- academic institutions such as universities and third parties with whom we are supporting health-related research to better understand certain health conditions and related behaviours, to develop our services and to improve diagnosis, care and treatment outcomes for patients; and
- carefully selected Health focussed organisations to improve diagnosis treatment, digital tools and health outcomes.
In some circumstances we are legally obliged to share information, such as when a court or regulator orders us to do so or where a public inquiry requires the information. We will also share information if the public good outweighs your right to confidentiality, such as where a serious crime has been committed or to protect children or vulnerable adults.
Is information transferred outside the UK?
We will primarily process and store your personal data in the United Kingdom.
However, there may be circumstances where your personal information is processed or stored outside of the UK. This is because we sometimes work with service providers or partners who are based outside of the UK or have servers outside of the UK. If we transfer your personal information outside of the UK, we will always ensure that it is in line with applicable data protection lawful mechanisms and
protected by appropriate safeguards as required by UK data protection laws (such as the International Data Transfer Agreement issued by the Information Commissioner’s Office).
For further information on the circumstances in which we transfer data outside of the
UK and the appropriate safeguards we have in place to ensure its protection, please contact us by email at [email protected].
What is our purpose and lawful basis for using your personal information?
Purpose and lawful basis
We will only use your personal information when the law allows us to. This may include the following circumstances:
- where we have obtained your consent – this must be freely given, specific, informed and unambiguous;
- where it is necessary to perform a contract we have with you, for example, the contract for the provision of our services to you if you are a private patient;
- where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests; and
- where we need to comply with a legal or regulatory obligation, for example where the NHS, public bodies or the courts use their powers to require the data.
For more sensitive data, such as your health information, we are required to have an additional lawful basis which is most likely to be one of the following:
- the processing is necessary for the purposes of medical diagnosis, the provision of healthcare or treatment and/or the management of our healthcare systems and services (Article 9(2)(h) of the UK GDPR)
- the processing is necessary for scientific research purposes or statistical purposes (Article 9(2)(j) of the UK GDPR)
The categories of personal information that we may process about you and our purposes for doing so are set out in the table below. The table also identifies our lawful basis for the processing and any condition for processing special categories of data, such as health information.
| Purpose of the processing | Categories of personal information that are relevant | Lawful basis for the processing | Additional lawful basis for special category data | Retention period |
| To provide our health and care services to you if you are an NHS funded patient | All personal information relating to your health and the provision of our healthcare services to you | Necessary for our legitimate interests to provide our services to you as a referred NHS patient (Article 6(1)(f)); or, as an RTC referred patient (Article 6(1)(c)) | Provision of healthcare or treatment (Article 9(2)(h) of the UK GDPR) | For adult patients (18 years plus), we will keep your care record for 8 years. For patients under 18, we will keep your data until your 25th birthday unless you were 17 when treatment ended, in which case we will keep your care record until your 26th birthday. |
| To provide our health and care services to you if you are a private patient | All personal information relating to your health and the provision of our healthcare services to you |
Necessary to perform our contract with you (Article 6(1)(b) of the UK GDPR) or OR Necessary for our legitimate interests to perform our services, for example, where our contract is not with the patient (Article 6(1)(f)) |
Provision of healthcare or treatment (Article 9(2)(h) of the UK GDPR) | For adult patients (18 years plus), we will keep your care record for 8 years. For patients under 18, we will keep your data until your 25th birthday unless you were 17 when treatment ended, in which case we will keep your care record until your 26th birthday. |
| To share your completed assessment report with your referring GP where you have been referred under the NHS Right to Choose scheme and have provided your explicit consent to this disclosure | All personal information contained in the assessment report, including identity and contact details, clinical history, assessment findings, and diagnosis or clinical outcome | Explicit consent (Article 6(1)(a) of the UK GDPR). This processing only takes place where the patient has given prior explicit consent. The referring GP is not a direct care provider in relation to the assessment services we deliver; implied consent is therefore not sufficient for this disclosure. Consent may be withdrawn at any time before the report is transmitted. | Explicit consent (Article 9(2)(a) of the UK GDPR). As the referring GP is not a direct care provider, Article 9(2)(h) does not apply to this specific disclosure. Explicit consent under Article 9(2)(a) is therefore the required special category condition. | Same as the main care record: 8 years for adults; until the patient’s 25th or 26th birthday for those treated as minors. Where consent is withheld or withdrawn before transmission, no report is shared and no additional retention obligation arises from this row. |
| To make an onward referral to a third-party healthcare provider or specialist service for ongoing care or treatment following your assessment, where clinically indicated | Identity and contact details; assessment report and clinical findings; diagnosis or clinical outcome; any other clinical information reasonably necessary to support continuity of care |
Explicit consent (Article 6(1)(a) of the UK GDPR) where the processing is consent-based OR Necessary for compliance with a legal obligation where a specific statutory duty to refer applies (Article 6(1)(c) of the UK GDPR). The applicable basis will be confirmed at the time of each referral. A data sharing agreement will be in place with the receiving organisation before any transfer takes place. |
Provision of healthcare or treatment (Article 9(2)(h) of the UK GDPR) where the referral is made by a health professional subject to an obligation of professional confidentiality OR Explicit consent (Article 9(2)(a) of the UK GDPR) where Article 9(2)(h) does not apply. The applicable condition will be confirmed at the time of each referral. |
Our record of the referral is retained as part of the main care record: 8 years for adults; until the patient’s 25th or 26th birthday for those treated as minors. The receiving organisation is an independent data controller and applies its own retention policy to data it holds. |
| To receive, store and process referral information sent to us by a referring GP in connection with an NHS Right to Choose referral, in order to assess eligibility and provide our assessment services | Identity and contact details; GP referral letter and any accompanying clinical notes; relevant medical history provided by the GP; safeguarding status where disclosed. Note: this information is received from the patient’s GP practice rather than directly from the patient, in accordance with Article 14 of the UK GDPR. |
Necessary for compliance with a legal obligation arising from our obligations under the NHS Standard Contract and Right to Choose framework (Article 6(1)(c) of the UK GDPR) OR Necessary for our legitimate interests to assess referrals and deliver our services (Article 6(1)(f) of the UK GDPR) |
Provision of healthcare or treatment (Article 9(2)(h) of the UK GDPR). This data is received from the referring GP practice; patients are informed of this in accordance with Article 14 UK GDPR. | For adult patients (18 years plus), we will keep your care record for 8 years. For patients under 18, we will keep your data until your 25th birthday unless you were 17 when treatment ended, in which case we will keep your care record until your 26th birthday. |
| For the purposes of quality assurance and improvement (including conducting peer reviews of consultations conducted by clinicians) and managing our healthcare systems and operations | All personal information relating to your health and the provision of our healthcare services to you, including call recordings and video/audio conversations of clinician sessions | Necessary for our legitimate interests – to maintain a high quality of service and to effectively manage our healthcare operations (Article 6(1)(f)) | Management of healthcare services (Article 9(2)(h) of the UK GDPR) | As above |
| To conduct clinical research | Your patient data (including health information) that relates to the relevant research, including recordings of clinical sessions. | Necessary for our legitimate interests – to engage in clinical research for the purposes of monitoring, improving and developing our services and treatment options (Article 6(1)(f)) | Scientific research purposes and statistical purposes (Article 9(2)(j) of the UK GDPR) | Up to 30 years, depending on the circumstances of our retention and the type of research |
| To conduct commercial research and service development | Your patient data (including health information) that relates to the relevant research, including recordings of clinical sessions. | Explicit consent (Article 6(1)(a) of the UK GDPR) where the processing is consent-based. This processing only takes place where the patient has given prior explicit consent. | Explicit consent (Article 9(2)(a) of the UK GDPR). This processing only takes place where the patient has given prior explicit consent. | Up to 30 years, depending on the circumstances of our retention and the type of research |
| For the purposes of communicating with you regarding queries, concerns and complaints regarding our healthcare services | Identity and contact details and any other personal information that is relevant to the query, concern or complaint | Necessary for our legitimate interests – to perform the services and ensure appropriate handling of concerns and complaints (Article 6(1)(f)) | Provision and management of healthcare services (Article 9(2)(h) of the UK GDPR) – this applies where the relevant communications include health information. | 10 years |
|
For the purposes of contacting family of patients in connection with our healthcare services, including in the event of an emergency |
Next of kin and emergency contact details including name, email address, phone number and relationship to the patient | Necessary for our legitimate interests – to perform the services and ensure patient safety (Article 6(1)(f)) | Provision and management of healthcare services (Article 9(2)(h) of the UK GDPR) | For adult patients (18 years plus), we will keep your care record for 8 years. For patients under 18, we will keep your data until your 25th birthday unless you were 17 when treatment ended, in which case we will keep your care record until your 26th birthday. |
| For the purposes of managing our contract with you, including for payment (where you are a private patient) | Identity and contact details, and financial information and/or insurer details in addition to your health information where you are paying for our services using your medical insurance. | Necessary to perform a contract with you (Article 6(1)(b) of the UK GDPR | Provision and management of healthcare services (Article 9(2)(h) of the UK GDPR) – this applies if we disclose your health information to your insurer (if applicable). | 6 years |
| To use data analytics to improve our website, services, customer relationships and experiences and to measure the effectiveness of our comms and marketing | Technical and usage data | Necessary for our legitimate interests – to keep our website up to date and to improve and develop our services. | N/A | 8 years |
| To provide information in relation to new/other services offered by Healios or to invite clients to participate in service development activities | Identity and contact details |
Necessary for our legitimate interests – to market services and associated activities to existing clients/ patients OR Consent – you have given your consent to our direct marketing activities |
N/A | 12 months |
Common law duty of confidentiality
In addition to ensuring that we have an appropriate lawful basis for the processing of your personal information, we must also satisfy the common law duty of confidentiality.
In our use of health and care information, we satisfy the common law duty of confidentiality because:
- we have a legal obligation to collect, use and/or share the data (for example, if a court order requires us to disclose it); and/or
- for specific individual cases, we have assessed that the public interest to share the data overrides the public interest served by protecting the duty of confidentiality (for example sharing information with the police to support the detection or prevention of serious crime). This will always be considered on a case by case basis, with careful assessment of whether it is appropriate to share the particular information, balanced against the public interest in maintaining a confidential health service.
National data opt-out
The national data opt-out allows patients to choose if they do not want their confidential patient information to be used for purposes beyond their individual care and treatment, namely for research and planning purposes.
We apply the national data opt out to our use of confidential patient information for research and planning purposes.
The information collected about you when you use health and care services can be used and provided to other organisations for planning and research purposes (ie purposes beyond your individual care), for instance to help with:
- improving the quality and standards of care provided
- research into the development of new treatments
- preventing illness and diseases
- monitoring safety
- planning services
This will only take place when there is a clear lawful basis to use this information. All these uses help to provide better health and care for you, your family and future generations. Confidential health and care information is only used like this when allowed by law.
Whenever possible data used for research and planning is anonymised, so that you cannot be identified and your confidential information is not accessed.
You have a choice about whether you want your confidential information to be used in this way. If you are happy with this use of information you do not need to do anything. If you do choose to opt out your confidential information will still be used to support your individual care.
To find out more or to register your choice to opt out, please visit www.nhs.uk/your-nhs-data-matters.
You can change your mind about your choice at any time. Even if you have registered a national data opt-out, you can agree to take part in our research projects by giving your explicit consent.
Data being used or shared for purposes beyond individual care does not include your data being shared with insurance companies or used for marketing purposes and data would only be used in this way with your specific agreement.
Using your information for research
We may use your personal information for health innovation research purposes where we have a lawful basis to do so. This is subject to our common law duty of confidentiality and the NHS national data opt in, as described above.
We may anonymise your personal information for use in research. This means it can no longer identify you and will cease to be personal information. For example, we may anonymise and aggregate personal data to:
- collect statistics on certain symptoms and conditions and share that medical data with organisations such as NHS England or NHS Scotland;
- publish research results in peer reviewed journals; and
- use research outcomes in our services.
Right To Choose
For information on the Right To Choose pathway click here.
What are your data protection rights?
Under data protection law, you have rights including:
Your right of access – You have the right to ask us for copies of your personal information (known as a subject access request).
Your right to rectification – You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances.
Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances.
Your right to object to processing – You have the right to object to the processing of your personal information in certain circumstances.
Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.
You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.
Please contact us using the contact details provided above if you wish to make a request.
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal information (or to exercise any of your other rights). This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
Consent
In any circumstances where we have relied on consent as our lawful basis to process your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law. This will not affect the lawfulness of any processing carried out before you withdrew your consent.
Opting out of marketing
You may unsubscribe from our marketing communications by clicking on the “unsubscribe” link at the bottom of our emails or emailing the Data Protection Officer at [email protected].
Please note that clients/patients cannot opt-out of receiving emails related to their account or service with Healios. These are necessary for administrative and client service purposes.
How long do we store your personal information and how do we ensure it is secure?
Retention
Our data retention period, which is the length of time we hold your personal information, is informed by the Department of Health, NHS England and professional bodies such as the British Medical Association and The Health and Care Professions Council. Please refer to the table above for our specific retention periods or contact us if you require any further detail.
At the end of the relevant retention period, we will review the information and, unless we have a lawful basis for an extended or further retention period, we will destroy it in line with the recommendations of the above bodies.
Prior to destroying your information, we may choose to anonymise it so that we can retain the information for future use in a way that you can no longer be identified. We might keep and use this anonymised data to help improve and develop our services as well as helping with health research.
Data Security
We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
How do I complain?
If you have any concerns about our use of your personal information, you can make a complaint to us using the contact details provided above, for example, by emailing our DPO at [email protected].
Following this, if you are still unhappy with how we have used your data, you can then complain to the ICO.
The ICO’s address is:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AFHelpline number: 0303 123 1113
ICO website: https://www.ico.org.uk
What cookies do we use?
If you are a visitor to our website, Healios will also process personal information using cookies.
We use cookies on our website to enable us to run the website and to provide a more personalised service to you. This section describes how we use cookies and your options in regard to them.
What are cookies?
Cookies are a small piece of text which is downloaded on a device (such as a computer or mobile phone) when a user accesses a website. The cookies allow the website to understand the user’s preferences or past actions.
We use a number of these cookies as outlined below. We will always ask for your consent before placing these cookies on your device, except where the cookie is necessary in order for our website to function.
These are called ‘strictly necessary’ cookies.
All other cookies can be controlled via our cookie management system, which is available on our website pages.
We have outlined below the types of cookies we use, their purpose and how long the cookie is kept on your device.
Where you have consented to the use of cookies that are not strictly necessary cookies, you may withdraw this consent at any time by using our cookie management platform.
You may also contact us at [email protected] if you have any queries regarding our use of cookies.
Strictly Necessary Cookies
We have two cookies that we use which are necessary to run our site. The purpose of these cookies is outlined below:
|
Name of Cookie |
Purpose |
Duration |
Third party? |
|
cookiehub .www.Healios.org.uk |
Used by Healios to store information about whether visitors have given or declined the use of cookie categories used on the site. |
365 days |
No |
|
VISITOR_INFO1_LIVE .youtube.com |
A cookie that YouTube sets that measures your bandwidth to determine whether you get the new player interface or the old. |
180 days |
Yes |
Preferences Cookies
We operate the following cookies which allow you to set preferences regarding the use of our site:
|
Name of Cookie and host name |
Purpose |
Duration |
Third Party? |
|
Lang .ads.linkedin.com |
Session-based cookie that remembers the user’s selected language version of a website. |
Session |
Yes |
|
lidc .linkedin.com |
Used by LinkedIn for routing. |
1 day |
Yes |
|
CONSENT .youtube.com |
Used by Google to store user consent preferences |
6109 days, 9 hours |
Yes |
Analytical Cookies
We use the following cookies to analyse visitors to our website:
| Name of Cookie and host name | Purpose | Duration | Third Party? |
|---|---|---|---|
|
_ga .www.Healios.org.uk |
Contains a unique identifier used by Google Analytics to determine that two distinct hits belong to the same user across browsing sessions. | 730 days | No |
|
_gid .www.Healios.org.uk |
Contains a unique identifier used by Google Analytics to determine that two distinct hits belong to the same user across browsing sessions. | 1 day | No |
| _gat_gtag_UA_xxxxxxxxx .www.Healios.org.uk | These cookies are set by Google Analytics which is a simple tool that helps us measure how users interact with our website. As a user navigates between web pages, Google Analytics records information about the page a user has visited, for example the URL of the page. The cookies themselves are used to ‘remember’ what a user has done on previous pages and interactions with our website. | 1 Hour | No |
|
YSC .youtube.com |
This cookie is set by YouTube video service on pages with YouTube embedded videos to track views. | Session | Yes |
Advertising
We use the following cookies for advertising:
|
Name of Cookie and host name |
Purpose |
Duration |
Third Party? |
|
fbp .www.Healios.org.uk |
Facebook Pixel advertising first-party cookie. Used by Facebook to track visits across websites to deliver a series of advertisement products such as real time bidding from third party advertisers |
90 days |
No |
|
fr .facebook.com |
Used by Facebook to deliver a series of advertisement products such as real time bidding from third party advertisers. |
90 days |
Yes |
|
UserMatchHistory .linkedin.com |
Contains a unique identifier used by LinkedIn to determine that two distinct hits belong to the same user across browsing sessions. |
30 days |
Yes |
|
bscookie .www.linkedin.com |
Used by the social networking service, LinkedIn, for tracking the use of embedded services |
730 days, 12 hours |
Yes |
|
IDE .doubleclick.net / |
Used by Google’s DoubleClick to serve targeted advertisements that are relevant to users across the web. Targeted advertisements may be displayed to users based on previous visits to a website. These cookies measure the conversion rate of ads presented to the user. |
390 days |
Yes |
|
AnalyticsSyncHistory .linkedin.com |
Used by LinkedIn to store information about the time a sync with the lms_analytics cookie took place for users in the Designated Countries |
30 days |
Yes |