Privacy Policy

Date last updated: 20/04/2026

This Privacy Notice covers how we collect, use and store your personal data and how that may affect you. It explains the rights you have over your personal data, with whom we may share your information with and how to contact us should the need arise.

Personal data and special category information

Personal data is defined by the UK General Data Protection Regulation (Regulation 2016/679) as ‘any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier. Personal data is, in simpler terms, any information about you that enables you to be identified.

In order for us to provide you with a service, we need to collect personal data about you, including health information, which is a special category of personal data. We are committed to ensuring that the information we collect, and use, is appropriate for the purpose of providing you with a service and does not constitute an invasion of your privacy. We will process (collect, store and use) the information you provide in a manner compatible with the Data Protection Act and UK GDPR.

We will also endeavour to keep your information accurate and up to date and not keep it for longer than is necessary or required by law.

What personal information do we collect?

Information we may collect in order to provide a service includes:

• Your full name
• Postal address including postcode
• Email address
• Telephone number
• Date of birth
• Gender
• Emergency contacts
• Information about medical or health conditions
• Racial or ethnic origin
• Reasons for referral and information supplied by your GP, medical advisor, NHS referrer or another referrer.
• The information supplied by you at first contact and in your assessment session, with additional information from professionals where applicable.
• Clinical assessments and plans relating to your treatment.
• Summaries of the content of therapy sessions.
• Copies of any letters or emails sent to you or received from you.
• Details of any contacts you have with us, such as sessions, video or telephone conversations

Why we collect data including Lawful Basis

We need to process your personal information in order to provide you with a healthcare service and to meet our obligations under the contract relating to that service. By ‘processing’ we mean we will collect, retain, disclose and delete information.

It is essential to collect and process your data in order to help us to:

• Confirm who you are and when we can contact you.
• Make decisions about your ongoing care and treatment.
• Ensure that we have accurate and up to date information in order to assess your needs and improve your care
• Allow us to investigate any complaints, claims and incidents.

The law

Legal basis

We are responsible for identifying and applying the appropriate lawful basis before processing any of your personal data. Below are the following lawful bases we rely upon:

• Consent – In cases where you have offered specific consent to do so for a certain processing operation, we will process your personal data.
• Contractual Necessity – We need to process your personal data pursuant to a contract you have entered, or have taken steps to enter into or that we have entered into with a third party whom you have instructed to contact us on your behalf.
• Legal Obligation – We need to process your personal data in order to comply with our overriding legal and regulatory commitments.
• Legitimate Interest – We process your personal data when we have a legitimate interest to do so. For example, this may be when we need to arrange for your care and treatment to be referred to organisation such as another service.

Where we need to process Special Category Data, such as health information, we will ensure that one or more of the following lawful bases for processing applies:

• Processing is necessary for the provision of health or social care treatment or the management of health or social care systems and services
• You have given explicit consent to the processing of those personal data for one or more specified purposes.
• Processing is necessary to protect the vital interests of you or of another natural person where you are physically or legally incapable of giving consent.
• Processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity.
• Processing is necessary for reasons of substantial public interest.
• Processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health.

We will only process your personal data for the original purpose for which it was collected. If we do intend to utilise your personal data for further processing, we shall contact you directly with information on the expanded purpose as well as any other relevant information to the nature of the processing.

How long will we keep your information?

Information is only stored for as long as is necessary to fulfil the purpose of which it was originally collected and in order to comply with our legal and regulatory obligations. We will keep your record for 7 years following discharge.

If you require further information about the retention of any of your personal data, please contact our DPO, whose contact details are listed below.

Who do we share information with?

Information is only shared with people involved in your health care. This may include:

• Therapists and practitioners engaged by us to carry out our services to you.
• Administrators involved in the booking of appointments and letter distribution
• Dedicated quality officers involved in local audits, the management of incidents and complaints including service user experience information.

We will only consider sharing your personal information with other organisations or professionals where we consider it an essential part of delivering effective care. We do share your information with consent; however, we can also share your information when there is another legal basis to do so. This includes sharing information for the prevention of harm to yourself or others, child protection, the prevention, investigation and detection of a serious crime, including terrorism, or a Court Order. In these circumstances, we will always do our best to notify you of the sharing of information and only share the minimum information required for the purpose.

We only share information with your family, friends or advocates with your explicit consent. You have the right to refuse/withdraw your consent to this sharing at any time.

Your rights

The Data Protection Act 2018 and General Data Protection Regulation (GDPR) empowers people with a variety of rights giving them control over their personal data processed by organisations. These rights are designed in a way to ensure that people are in the driving seat when it comes to how their personal data is handled.

Please see below for the rights available:

Right of Access

You have the right to request a copy of the personal data we hold on you as well as the following information:

• The Purpose of processing your personal data
• The categories of personal data concerned
• Any recipients to whom your personal data has been disclosed to
• The retention/envisioned retention period of your personal data
• The source of where we obtained your personal data if it was collected from a third-party

Right to Rectification

If you suspect that any of your personal data that we process is either inaccurate or incomplete, you may request that we correct or complete this data.

Right to Erasure (Right to be Forgotten)

In certain circumstances, you can ask for the data we hold about you to be erased from our records; however, there are exceptions to the right to erasure and HG Mind Works are legally required to maintain your records in accordance with the retention guidelines.

The Right to Restrict Processing

Alternative to the right of erasure outlined above, you may ask us to temporarily cease processing your personal data, but not erase it entirely from our systems. This is available to you when one of the following grounds apply:

• You contest the accuracy of your personal data
• You believe processing your personal data is unlawful
• You believe that your personal data is no longer required to be processed, but must still be retained as part of a legal process
• There has been a successful right to object to the request and the processing has been temporarily halted to reach a decision on the status of the processing.

The Right to Data Portability

You have the right to have the data we hold about you transferred to another organisation.

The Right to Object

The right to object allows you to request us to cease using your personal data at any time. A right to object can only be exercised if we are processing your personal data for one of the reasons listed below:

• For a task carried out in the public interest
• The exercise of official authority
• Under the “legitimate interest” lawful basis
• For scientific or historical research, or statistical purposes
• For direct marketing purposes

To make a request for access to your information please contact contact@hg-mindworks.com for more details. We may, if necessary, request a form of identification from the person making the request. Where the request is made by a representative we will ask for written consent signed by yourself.

You can find out more about your rights under the UK’s data protection laws at www.ico.org.uk

Data Protection Officer (DPO) and Contact

HG Mind Works is registered with the Information Commissioner’s Officer (ICO) under registration number ZB956952.

If you would like to contact the DPO in charge of addressing and managing data protection matters concerning your personal data and ensure continued compliance with any relevant data protection legislation please email contact@hg-mindworks.com  or telephone 0208 126 8767.

Complaints

If you wish to raise a complaint about how your personal data has been handled by us, please contact our team at contact@hg-mindworks.com who will be happy to assist you.

If you are in any way dissatisfied with the response to any concern raised you can raise this directly with the Information Commissioner’s Office:

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Helpline number: 0303 123 1113 | Website: https://www.ico.org.uk