Clinical Partners Limited ("we") is committed to protecting and respecting your privacy.
Important information and who we are
Data controller
For the purposes of data protection laws, we are the “controller” of the processing of your personal data. This means that we decide why and how your personal information is processed. It also means that we are responsible to you under the law for that processing.
Clinical Partners Limited is a company registered in England and Wales under company number 07590254 and registered office at Unit 6, Chaldicott Barns, Tokes Lane, Semley, Wiltshire, SP7 9AW. Clinical Partners Limited is registered with the Information Commissioner’s Office (ICO) with registration number Z2868470. Notification details can be accessed by searching the Data Protection Public Register.
We are part of a group of companies made up of different legal entities, details of which can be provided on request.
We have appointed a data protection officer (DPO) who is responsible for overseeing questions in relation to this privacy notice. If you have any questions about this privacy notice, including any requests to exercise your legal rights, please contact the DPO using the details set out below.
Contact details
FAO Data Protection Officer
Email address: [email protected]
Postal address: Unit 6, Chaldicott Barns, Tokes Lane, Semley, Wiltshire, SP7 9AW
Telephone number: + 44 (0) 203 326 9160
This page sets out what you can expect from us when we process (collect, use, and store) your information.
This page is divided into the following sections:
- Patient Privacy Notice - for our patients who are currently receiving or having received our services.
- Website and Recipients of our mailing list - for visitors to our website, users of our web forms and telephone support lines and recipients of our mailing lists or service updates.
These privacy notices, along with our terms and conditions for use of our services, form the basis for our use of your personal data. Please read the notice relevant to your interaction with us.
For any help, support, or further guidance on this or any aspect of our use of your information, please contact [email protected].
Patient Privacy Notice
What is personal data?
Personal data is any information that can be used to identify a living individual, either on its own or in combination with other pieces of data.
Examples of personal data include your name and address, while health data is a special category of data that is legally afforded extra protection. Data processing includes the collection, use, and storage of data.
Information we collect about you
- If you are referred to us by a GP or take up our services through an Integrated Care Board's Right to Choose framework, we will collect information provided by healthcare professionals, such as your GP. This will include your contact details and a short, relevant summary of your health that led to the referral.
- You may choose to send us previous medical records or reports for your clinician to review. You may also need to have medical tests or complete questionnaires/psychometrics for the service you are seeking from us. This information will only be shared on a need-to-know basis.
- If you access our prescription services we will collect and hold a copy of your identity documentation.
How do we use your data?
We use the information you give to us to:
- Provide you with the treatment and health services you have requested, including psychiatry, psychotherapy, and psychologist appointments.
- Provide you with the information and services that you have requested from us.
- Provide you with information about other services we offer that are similar to those you have already received or enquired about.
- Notify you about changes to our services and the services of our therapists.
How long do we retain your data?
In line with our obligations under the UK GDPR, we will only keep your data in an identifiable form for as long as necessary to achieve the purposes for which it was collected, including compliance with our legal and regulatory obligations.
Specifically, our treatment records are classified as mental health records, and their retention periods outlined in the NHS Records Management Code as follows:
- For adults: We retain adult records for 20 years following your last appointment with Clinical Partners Ltd. If you pass away, these records will be kept for 10 years after your death.
- For children and young people: We'll keep your records until your 25th birthday, or your 26th birthday if you were 17 at the time of your last appointment. In the unfortunate event of your passing, we will keep your records for eight years after your death.
Please note in some cases, such as for complex care or shared agreements with an NHS Trust, a longer 20-year retention period may be applied to a child's records to ensure a complete historical record.
Sharing your data
We take care of your personal data and will only share it with third parties where absolutely needed. This will include:
- Continuing care: If your care needs to continue outside Clinical Partners (e.g., through a shared care arrangement or with a different titration provider), we will share your contact details, medical records, test results, and mental health background with the clinicians taking over your care.
- Service evaluation: To evaluate and continuously improve our healthcare services.
- Legal obligation: If we are under a duty to disclose or share your personal data to comply with any legal obligation, or to enforce or apply our website terms and conditions and other agreements, or to protect the rights, property, or safety of Clinical Partners limited, our clients, or others. This includes, without limitation, exchanging information with other companies and organisations for the purposes of fraud protection.
- Identity Confirmation Prescription Service: To ensure the safe, legal, and compliant dispensing of medications, we use a digital service that requires secure verification of your identity prior to issuing a prescription.
For this process, we engage Yoti Limited as a third-party data processor to verify and validate your electronic identity documentation. You can find out more about this company, the measures they take to protect your data and the logic involved in the algorithm here: Privacy at Yoti
Where appropriate, before disclosing personal data to a third party, we contractually require the third party to take adequate precautions to protect that personal data and to comply with applicable law.
We also work with certain business partners and other organisations in developing and delivering our services to develop as a business and deliver the core services that we offer. Where this is the case, these partners with their associated privacy policies will be shared.
Further details about the specific third parties we engage can be provided on request.
Explaining the legal bases we rely on
The UK GDPR sets out several different reasons for which organisation may collect or process your personal data under its articles. We process your personal data under the following specific legal conditions.
The exact condition we rely on depends on how you engage with our services:
- If you are referred to us by an NHS organisation under the 'Right to Choose' framework: As we operate under the statutory obligations of the NHS in these cases, our lawful bases for processing your data are Article 6(1)(e) - Public Task (for the general processing of your personal data) and Article 9(2)(h) - Provision of Health or Social Care (for processing your special category data, such as health information).
- If you approach us directly as a private treatment provider: When you engage with us as a private healthcare provider under our standard terms and conditions, our lawful bases are Article 6(1)(b) - Contract (for the general processing of your personal data needed to fulfil our contractual obligations with you) and Article 9(2)(h) - Provision of Health or Social Care (for processing your special category data, such as health information).
By extension of this there may also be occasions where we are required to process your personal data in line with our legal responsibilities as a care provider. This is set out below.
- Article 6(1)(c) - Legal Obligation: We process your personal data when it is necessary for compliance with a legal obligation to which Clinical Partners is subject. This includes, but is not limited to:
- Fulfilling statutory and regulatory requirements related to safe prescribing, accurate patient record-keeping, and fraud prevention.
- Responding to formal requests from law enforcement or regulatory bodies (e.g., the General Medical Council).
- Compliance with any court order or legal proceeding.
We may also process your personal data using the following under the following UK GDPR conditions to help improve the service and care you receive over the course of our relationship with you:
- Article 6(1)(f) Legitimate Interest: We may process your data when it is necessary for our legitimate interests as a business. This could include, for instance, using your information to improve our services, tailor our communications to your needs and provide you updates and detail on our services and conduct essential business operations, such as handling complaints.
We always balance our interests against your privacy rights to ensure your data is protected and ensure your fundamental rights and freedoms outlined under the UK GDPR are not overridden. We will also not process your directly identifiable health data for this purpose.
Your rights over your data
You have the right to request:
- Access to the personal data we hold about you, free of charge. However, we hold the right to refuse requests that are unfounded or excessive.
- The correction of your personal data when incorrect, out of date, or incomplete.
- That we stop holding your personal data for direct marketing purposes.
- That we stop any consent-based processing of your personal data after you withdraw consent.
Where we use automated decision making for example in our prescription service to verify your identity documentation, you have the right to:
Receive meaningful information about the logic involved in the decision.
Request human intervention in the assessment process.
Obtain an explanation of the decision and subsequently challenge it.
If you would like us to stop holding your data, have concerns about the data we hold, or would like it transferred to another medical practitioner, please email [email protected] or call 0203 326 9160.
If we choose not to action your request, we will explain the reasons for our refusal. You have the right to complain about this refusal to the supervisory authority (ICO).
To protect the confidentiality of your information, we will ask you to verify your identity before proceeding with any request you make under this privacy notice. If you have asked someone else to submit a request on your behalf, we will ask them to prove they have your permission to act.
Where we store your data
We only store your healthcare information on secure servers located in the United Kingdom (UK) and European Economic Area (EEA), in line with our legal responsibilities to ensure your rights are protected.
Contacting the Regulator
If you feel that your data has not been handled correctly, or you are unhappy with our response to any request you have made to us regarding the use of your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO).
- You can contact them by calling 0303 123 1113.
- Or you can go online to www.ico.org.uk/concerns (this will open in a new window—please note we cannot be responsible for the content of external websites).
Questions?
If you have any questions about this policy, please contact our Data Protection Officer by calling 0203 326 9160 or emailing [email protected].
Notification of changes to privacy policy
We are continually improving our methods of communication and adding new features to this website. If we change our data protection practices, we will notify you on this page, so we encourage you to check this page frequently.
This privacy policy is governed by the Laws of England and is incorporated by reference into our Terms and Conditions of Service.
Website and Recipients of our mailing list Privacy Notice
How We Collect and Use Data from Our Website
When you interact with us, whether it's through our website, online (web) forms, the telephone lines displayed on our website or surveys we as an organisation will collect information relating to you.
We are committed to collecting only the data necessary for specific, legitimate purposes defined in law and wish to be transparent with all users of our website and telephone services over the processing of personal data that occurs.
We therefore would like to advise you on the following:
Website Analytics and Tracking
We use a service called Hotjar to better understand how users interact with our website. This helps us improve your experience by showing us things like which pages you spend the most time on and which links are most popular.
Hotjar uses cookies and other technologies to collect data about your device and browsing behaviour, such as your device’s IP address (stored in an anonymised form), screen size, browser type, and general location. This information is stored in a pseudonymised user profile. Neither we nor Hotjar will use this information to identify you as an individual. You can find more details in Hotjar’s privacy policy.
You have the right to opt out of Hotjar's data collection. You can do so by following this opt-out link. By submitting your personal data to us and/or using our website, you consent to our processing of your data in the ways described here.
Tracking of Calls to Our Phone Numbers
For visitors who call us from our website, we generate a unique reference number for each call. This functionality creates an identity marker for each call; it does not directly identify you as an individual but rather lists allows us to track areas of interest in our website and services.
Only authorised Clinical Partners staff can access and track the calls made to the numbers on our site with the sole purpose being to enable us to better understand which our services lead to calls to our phone numbers.
Web- Forms
In some areas of our website we offer call back services for anyone interested in hearing more from us. Where this is the case we utilise specific web forms that invite visitors to fill in their contact details and desired time for a call back.
In these instances we may again track this activity through the use of an identity marker that does not directly identify individuals. This allows us to understand which of our services are currently of interest to people and the uptake of our services.
Marketing Exclusion Audiences
As part of our commitment to responsible marketing we may process limited data (contact details and a generic listing of the service you receive from us through) to ensure we do not add you to mailing lists regarding or provide you with updates on our services that you are already utilising or not relevant for you.
As with all aspects of our marketing you may object to the use of your data for this purpose by contacting us. Similarly our service communications and updates sent for these purposes feature the opportunity for you to unsubscribe.
Our Legal Basis for Processing Your Data
To process your personal data, we rely on specific legal bases set out by data protection law.
- Legitimate Interests: We may process your data when it is necessary for our legitimate business interests, such as to improve our services and understand customer demand or ensure the security of our systems, as long as your fundamental rights and freedoms are not overridden.
- Consent: In specific situations, we will ask for your consent to collect and process your personal data. We will always make it clear which data is necessary for a particular service for example to receive our mailing lists and call back services.
Data We Collect
When you visit our website, we may collect the following types of data:
- Device and Browser Data: We collect information from the device and application you use to access our services. This includes your IP address, operating system, device type, and browser.
- Page Tags: We use third-party tracking services with cookies and page tags (web beacons) to collect data on website visitors, including usage and user statistics.
- Log Data: Our web servers keep log files that record data about each visit to our website. This includes your IP address, internet service provider, the files viewed on our site, operating system versions, time on site, device type, and timestamps.
- Telephone IDs: Where you telephone a clinical partners number we will generate a unique identifier for each call made to our telephone numbers listed in our advertised services.
Why We Collect This Data
We collect and process this data to:
Understand and plan for customer demand and interest, seeing which areas of our services are most required.
Ensure our website content is presented in the most effective way for you and your device.
Administer and manage our site.
Help with internal operations such as troubleshooting, testing, and data analysis.
Work with analytics and search engine providers that assist us in the improvement and optimisation of our site.
How Long We Retain Your Data
In line with our obligations under the UK GDPR, we will only keep your data in an identifiable form for as long as is necessary to achieve the specific purposes for which it was collected, including compliance with our legal and regulatory obligations. The length of time we keep your data will vary depending on the type of data and the purpose for which it was collected. For example, some data may need to be retained for a certain period to meet our legal record-keeping requirements, while other data, such as anonymous website analytics, may be retained indefinitely to help us track long-term trends.
Where Your Data is Stored
All information you provide to us is stored on our secure servers. Any payment transactions will be encrypted.
Please note that some of the data we collect may be transferred to, and stored at, a destination outside the UK and EEA. This data may be processed by staff operating outside the UK/EEA who work for us or one of our suppliers (such as Meta for advertising exclusion audiences).
To ensure your personal data remains protected during these transfers, we will only transfer data outside the UK/EEA where one of the following safeguards is in place:
- Adequacy Regulations: We transfer the data to a country that the UK has deemed to provide an adequate level of protection for personal data.
- Appropriate Safeguards: We ensure the transfer is governed by appropriate safeguards, primarily through the use of the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses (SCCs). These contracts legally bind the recipient to protect your data to the standard required by UK GDPR.
We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this privacy policy.
Cookies
Our website uses cookies to improve your experience and our services. A cookie is a small piece of data transferred from a web server to your web browser or hard drive when you visit a website. If your web browser is set to accept cookies, they will be stored in the web browser or hard drive until their expiration date is reached or you delete the cookies yourself. We will inform you if we use any cookies that collect your personal information and request your consent prior to doing so. You can remove cookies from your computer at any time and can also choose to disable cookies in your internet browser settings.
Links to other websites
This website may contain hyperlinks to websites that are not operated by us. These hyperlinks are provided for your reference and convenience only and do not imply any endorsement of the activities of such third-party websites or any association with their operators. We do not control these websites and are not responsible for their personal data practices. We urge you to review any privacy policy posted on any site you visit before using the site or providing any personal data about yourself.
Unsubscribing from Communications
If you do not wish to receive emails from us and want to be removed from our electronic mailing list, please email us with "email unsubscribe" in the subject heading. If you also wish to be removed from our postal marketing database, please let us know by emailing us with "mail unsubscribe" in the subject heading or writing to us at the address given below. You may unsubscribe by emailing [email protected].
Clinical Partners Imagery
The people featured in the images used on our website and marketing materials are models and do not have any direct connection to Clinical Partners or any specific mental health condition.
Use of your Data for Research
As part of our commitment to service improvement and supporting the advancement of health care in our specialist treatment areas we will from time to time participate in research activity.
The type of research we conduct
As part of our commitment to service improvement and supporting the advancement of healthcare in our specialist treatment areas, we will from time to time participate in research activity.
This will include the following:
- Internal Service Improvement: Clinical Partners undertakes internal activities focused on improving clinical pathways and better understanding trends in patient data. For this purpose, we process your data under the basis of Legitimate Interests. We aggregate and anonymise patient data prior to conducting analysis, which means you will not be identifiable from the resulting dataset.
- External Health Research: We may partner with third-party research institutions to conduct specific research projects to gain further insights into our treatments. This processing falls into two categories:
- Identifiable Studies (Consent-Based): If we identify you as a potential participant in a study involving your identifiable personal data, we will provide you with information about the specific research project and ask for your informed consent prior to using your data. You are under no obligation to take part in the study.
- HRA-Approved Studies (Public Interest/Non-Identifiable Data): Where a research study relies on non-identifiable or pseudonymised data and is considered to be of substantial public interest, we will ensure that the study has obtained the necessary ethical and legal approvals, including Health Research Authority (HRA) Approval.
Our Legal Basis for Processing Your Data
To process your personal data for research, we rely on the following legal bases:
Legitimate Interests: We may process your data when it is necessary for our legitimate interests as a business or those of a third party, provided your fundamental rights and freedoms are not overridden. This includes using your information to improve and develop our service offerings.
- Consent: We rely on your explicit consent when you volunteer to participate in a specific research study involving your identifiable data.
- Public Task: We rely on Public Task when processing is necessary to conduct research that is considered to be of substantial public interest and has received HRA Approval.
For special category data such as health information, we rely on the following legal bases:
- Processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes
- Explicit Consent
If you are taking part in a specific research study, please read this privacy notice alongside any informed consent forms, study specific privacy notices, and/or study documents that are provided to you in relation to the collection, use, and transfer of your personal data for the stated research purpose.
Data We Collect
If you choose to take part in a research study, the entity which is conducting the research related activity with us will collect personal data about you including your name, contact information and further details about your treatment. Please refer to the research study documentation for further information about the type of data collected in the study.
For research undertaken internally, we aggregate and anonymise patient data prior to conducting analysis, which means you will not be directly identifiable from the data set.
How Long We Retain Your Data
If you choose to take part in a research study with our external partners, details of how long your data will be retained in identifiable format will be provided in the study specific documentation ascertaining your consent.
For research undertaken internally, we may store our anonymised datasets indefinitely to allow for long-term trend analysis, historical comparisons, and future studies without the need to recollect or re-anonymise the data.
Where Your Data is Stored
If you choose to take part in a research study with our external partners, details of where the data will be stored will be detailed in the study specific documentation.
For our internal research activities, We only store your healthcare information on servers located in the UK.
Your Rights in relation to Research
When we use your data for research or to improve our services, you have the following rights:
1. If You Take Part in a Specific Research Study
- Right to Stop: If you volunteer to take part in a specific clinical study and give your consent, you have the right to withdraw your consent at any time.
- What this means: We will stop using your data for the study from that point forward. Withdrawing consent will not affect your ongoing medical care or the lawfulness of any research done before you withdrew.
2. If We Use Your Data for Public Interest Research or Service Improvement
- Right to Object: You have the right to object to us using your data for general public health research (approved by groups like the HRA) or for our own internal service improvement and evaluation.
- What this means: If you object, we will stop using your data for these purposes. However, because this research is often carried out for essential public health reasons or legal requirements, we may sometimes have the right to continue processing your data if we can demonstrate that the compelling public interest in conducting the research outweighs your objection.
Last updated: 17 December 2025