Privacy Notice
The following Privacy Notice tells you what you can expect us to do with your personal information. The OCD Treatment Clinic is registered with the Information Commissioner's Office (ICO) and adheres to the principles of the UK General Data Protection Regulation and the Data Protection Act 2018.
Contact details for the Data Controller of The OCD Treatment Clinic
Name: Dr Craig Govan
Title: Clinical Psychologist and Clinical Director at The OCD Treatment Clinic
Email: craig@ocdtreatment.co.uk
What information we collect, use, and why
We collect or use the following information from you to provide patient care and to offer mental health goods and services provided by us:
- Name, address, and contact details
- Your gender and sex
- Your pronoun preferences
- Your occupation and other relevant demographic information
- Your date of birth
- Details of legal guardians for those receiving treatment who are under the age of 18 and/or for those who have intellectual impairments which impact capacity to consent (e.g., dementia, learning disability)
- Emergency contact details
- Health information (including medical conditions, allergies, medical requirements and your medical history)
- Information about your care needs (including disabilities, home conditions, medication and dietary requirements and general care provisions)
- Test results (including psychological evaluations)
- Your payment details for the purposes of charging you for our services (including your card or bank information if you have subscribed to our subscription service)
- Insurance policy details (this is only if applicable if you are seeking reimbursement for our services through your insurance provider).
- Records of all our sessions together and interactions (which we refer to as 'case notes').
We may also collect the following information to provide patient care and mental health goods and services provided by us:
- Your racial or ethnic origin
- Your religious preferences, so that we can adapt treatment to your faith if preferred
- Health information, including information about your mental health
- Information about your personal and romantic relationships, both present and past
- Information about your sexual orientation
- Safeguarding information and any data about previous criminal offences.
We collect and may use the following personal information about you for market research and service evaluation purposes:
- Names and contact details (email address)
- Customer surveys you may complete about how satisfied you have been with our services
- Your age
- Your gender
- Your marketing preferences
Please note, we will not share your information with any third-party for marketing purposes. Your data for marketing and service evaluation purposes will only be used by The OCD Treatment Clinic. Your data will help us to identify and profile demographics which are more likely to use and/or benefit from our services, in addition to promoting some of our additional services we feel you may benefit from.
Lawful bases and data protection rights
Under UK data protection law, we must have a "lawful basis" for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO's website. Which lawful basis we rely on may affect your data protection rights which are set out below. You can find out more about your data protection rights and the exemptions which may apply on the ICO's website:
- Your right of access - You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for. You can read more about your right of access here: https://ico.org.uk/for-the-public/getting-copies-of-your-information-subject-access-request/
- Your right to rectification - You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete. You can read more about your right to rectification here: https://ico.org.uk/for-the-public/your-right-to-get-your-data-corrected/
- Your right to erasure - You have the right to ask us to delete your personal information. You can read more about the right to erasure here: https://ico.org.uk/for-the-public/your-right-to-get-your-data-deleted/
- Your right to restriction of processing - You have the right to ask us to limit how we can use your personal information. You can read more about this right on the ICO's website: https://ico.org.uk/for-the-public/your-right-to-limit-how-organisations-use-your-data/
- Your right to object to processing - You have the right to object to the processing of your personal data. You can read more about your right to objection on the ICO's website: https://ico.org.uk/for-the-public/the-right-to-object-to-the-use-of-your-data/
- Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you. You can read more about your data portability right on the ICO's website: https://ico.org.uk/for-the-public/your-right-to-data-portability/
- Your right to withdraw consent – When we use consent as our lawful basis you have the right to withdraw your consent at any time. You can read more about your right to withdraw consent on the ICO's website: https://ico.org.uk/for-the-public/does-an-organisation-need-my-consent/
If you make a request, we must respond to you without undue delay and in any event within one month. To make a data protection rights request, please contact us using the contact details for the nominated Data Controller at the top of this Privacy Notice.
Our lawful bases for collecting or using your personal information to provide patient care and mental health goods and services by us are:
- Vital interests – collecting or using the information is needed when someone's physical or mental health or wellbeing is at urgent or serious risk. This includes an urgent need for life-sustaining food, water, clothing or shelter. All of your data protection rights may apply, except the right to object and the right to portability.
Our lawful bases for collecting or using personal information to comply with legal requirements are:
- Vital interests – collecting or using the information is needed when someone's physical or mental health or wellbeing is at urgent or serious risk. This includes an urgent need for life-sustaining food, water, clothing or shelter. All of your data protection rights may apply, except the right to object and the right to portability.
Our lawful bases for collecting or using personal information for information updates, marketing or market research purposes are:
- Consent - we have permission when you begin engaging in any of our online services, communicate with us, or when you procure any of our services. The link to our Privacy Notice is made publicly available on our website at: www.ocdtreatment.co.uk. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
Where we get your personal information from
- Directly from you
- Family members or carers (only if you explicitly consent for us to obtain this or if i) we are treating a child under the age of 18, and/or ii) the person we are treating has an intellectual impairment which compromises their ability to consent to treatment
- Other health and care providers (only if you explicitly consent for us to obtain this)
- Social services (only if you explicitly consent for us to obtain this)
- Schools, colleges, universities or other education organisations (only if you explicitly consent for us to obtain this)
- Insurance companies (only if you are using an insurance company to pay for our services)
- Councils and other public sector organisations (only if you explicitly consent for us to obtain this)
How long we keep your personal information
In line with general guidance in the UK for the storage of mental health records, we will retain your information (including records of your sessions, known as 'case notes') for 20 years (or 10 years after death). The date to destroy your records will be determined by the last date of contact between you (the client) and your designated clinician offering you treatment at The OCD Treatment Clinic. The information we keep about you will be captured digitally and uploaded on to an encrypted and secure password protected cloud accessible by The OCD Treatment Clinic.
Others we may share your personal information with
- Insurance companies (only if you are paying for our services through an insurance company)
- Emergency services (only in the event of life-threatening emergency, in which emergency services may benefit from the information we hold about you)
- Clinical supervisors, external to The OCD Treatment Clinic, for the purposes of receiving clinical supervision. Clinical supervisors will also be registered mental health professionals, with appropriate indemnity insurance in place.
- Organisations we're legally and ethically obliged to share personal information with based on information you disclose to us (for example, the police).
Duty of confidentiality
We are subject to a common law duty of confidentiality at The OCD Treatment Clinic. However, there are circumstances and certain exceptions whereby we will share relevant health and care information about you. These exceptions are:
- you've provided us with your consent (we have taken it as implied to provide you with care and treatment, or you have given it explicitly for other uses)
- we have a legal requirement (including court orders) to collect, share or use the data
- on a case-by-case basis, the public interest to collect, share and use the data overrides the public interest served by protecting the duty of confidentiality (for example sharing information with the police to support the detection or prevention of serious crime).
- If in England or Wales – the requirements of The Health Service (Control of Patient Information) Regulations 2002 are satisfied.
- If in Scotland – we have the authority to share provided by the Chief Medical Officer for Scotland, the Chief Executive of NHS Scotland, the Public Benefit and Privacy Panel for Health and Social Care or other similar governance and scrutiny process.
How to complain
If you have any concerns about how The OCD Treatment Clinic has used your personal data, you can make a complaint to us by contacting the Data Controller. If you remain unhappy with how we've used your data after raising a complaint with us, you can also complain to the Information Commissioner's Office (ICO).
The ICO's address:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
Website: https://www.ico.org.uk/make-a-complaint