Privacy Policy

Effective Date: 28/11/2024

Last reviewed: 23/08/2026

At Atrom Mindcare Services Ltd | Company No. 10838475 (referred to as “we”, “us” or “our”), we are committed to protecting your privacy and keeping your personal information safe. This Privacy Notice explains what information we collect about you, why we collect it, how we use it, who we may share it with, how long we keep it, and what rights you have. It applies to patients and service users who access our healthcare services, including online appointments, and has been prepared in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Information We Collect

We collect and use information about you when you contact us, book an appointment, use our website, or receive care from us. This may include:

Personal information: your name, contact details, address, date of birth, NHS number where applicable, and information provided when you create an account or book an appointment.
Health and care information: information you provide during consultations, clinical records, assessment information, prescriptions, reports, correspondence and other information relevant to your care.
Payment information: information needed to process payments for our services.
Technical information: IP address, browser type, device information and information collected through cookies or similar technologies.

2. How We Use Your Information

We use your personal data for the following purposes:

Managing your bookings and online appointments.
Providing healthcare services.
Processing payments for services.
Sending appointment reminders and communications regarding your treatment.
Compliance with legal and regulatory obligations.
Improving our website and services.

3. Legal Basis for Processing

We will only use your personal information where we have a lawful reason to do so. For patient care and healthcare administration, we usually rely on legal bases linked to providing healthcare, managing our service, meeting legal and regulatory duties, and protecting legitimate interests. We do not usually rely on UK GDPR consent for direct care because we may have professional, legal or regulatory duties to keep and use clinical records.

Healthcare and treatment: to provide assessment, diagnosis, treatment, prescriptions and ongoing care.
Legal and regulatory obligations: to meet requirements placed on us by law, regulators, commissioners and professional standards.
Contract and service administration: to manage appointments, payments, communications and service delivery.
Legitimate interests: to operate, manage, improve and protect our services, where this is appropriate and does not override your rights.
Consent: where consent is specifically required, for example for some optional communications or non-routine sharing that is not covered by another lawful basis.

Where we process special category data, including health information, we rely on UK GDPR Article 9 conditions such as the provision of healthcare or treatment, management of healthcare services, public interest in health, legal claims, or explicit consent where this is specifically required.

4. Sharing Your Information

We will only share your information where it is necessary, lawful and proportionate. This may include sharing information with:

Healthcare professionals and services involved in your care, where this is needed for safe and effective treatment.
Payment processors where needed to manage billing and payments securely.
Regulators, commissioners or public bodies where we are legally or professionally required to do so.
IT, security and administrative service providers who support our systems and services under appropriate confidentiality and data protection arrangements.
Legal or safeguarding purposes where this is required by law or necessary to protect you, another person, our staff, our services or our legal rights.

National Data Opt-Out for NHS-funded care

Atrom Mindcare Services Ltd reviews its data processing regularly to assess whether the national data opt-out applies. This is recorded in our Record of Processing Activities. We also assess new processing activities to decide whether the national data opt-out applies.

We do not currently share confidential patient information for planning or research purposes to which the national data opt-out applies. We review the confidential patient information we process to ensure it is not being used for these purposes unless there is a lawful basis to do so. You can find out more about the national data opt-out at https://www.nhs.uk/your-nhs-data-matters/.

5. Data Security

We implement appropriate technical and organisational measures to protect your data from unauthorised access, alteration, or disclosure. These measures include:

Encryption for data in transit and at rest.
Secure storage solutions.
Regular monitoring and audits of our systems.

6. Data Retention

We retain personal information and clinical records only for as long as we are required or permitted to keep them. Patient records are retained in line with the NHS Records Management Code of Practice and our Records Management, Retention and Secure Disposal Policy. When information reaches the end of its retention period, we securely dispose of it, delete it, or anonymise it where appropriate.

7. Your Rights

You have rights under data protection law. These include the right to:

Access your personal data.
Ask us to correct inaccurate or incomplete data.
Ask us to erase your data in certain circumstances.
Ask us to restrict processing in certain circumstances.
Object to certain processing activities.
Request data portability where this applies.

Some rights may not apply in every situation, for example where we need to keep clinical records to meet legal, regulatory, professional or healthcare obligations. To exercise your rights, please contact us using the details below.

8. Cookies

Our websites, https://www.atrommindcare.com use cookies to support website functionality, improve your experience and help us understand how the website is used.

What are cookies?

Cookies are small text files placed on your device when you visit a website. They help the website work properly and may remember your preferences. You can manage your cookie choices using our cookie banner or your browser settings.

Types of Cookies We Use

Necessary cookies: essential for website functionality.
Performance cookies: help us understand how visitors use the website.
Functional cookies: remember your preferences and settings.

Managing Cookies

You can manage or delete cookies through your browser settings and by using our cookie consent banner. For general information about cookies, visit www.allaboutcookies.org.

9. Changes to This Privacy Notice

We may update this Privacy Notice from time to time. Any updates will be posted on this page, and where necessary, we will notify you via email.

10. Complaints

If you have any concerns about how we handle your personal data, we encourage you to contact us first so we can address your concerns. You can reach us using the details in the "Contact Us" section below.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK’s independent authority for data protection.

Contact Details for the ICO:

Website: https://ico.org.uk/make-a-complaint
Telephone: 0303 123 1113
Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

11. Contact Us

If you have any questions or concerns about this Privacy Notice or how we use your personal data, please contact us at:

Atrom Mindcare Services Ltd | Company No. 10838475
Main ICO and CQC registered address: 39A Regent Street, Leamington Spa, Warwickshire, CV32 5EE
Atrom Mindcare site: The Civic Building - Regus, 323 High Street, Epping, CM16 4BZ
JM Mental Health site: 39A Regent Street, Leamington Spa, Warwickshire, CV32 5EE
ICO Registration Number: ZA295571
Email: contact@atrommindcare.com
Website: https://www.atrommindcare.com