Privacy notice

Neurominds is committed to protecting your privacy and handling your information responsibly, in line with UK data protection law (the UK GDPR and the Data Protection Act 2018). This notice describes what we collect, why, and the rights you have over your information.

Who we are

Neurominds is the data controller for the personal information described in this notice. Our clinical work is led by HCPC-registered Clinical Psychologists, Dr Ryan Little and Dr Pardis Hashmezadeh.

Registered name, trading details and registered address: [registered details to confirm]. HCPC registration numbers: Dr Ryan Little PYL044848; Dr Pardis Hashmezadeh PYL044743. Information Commissioner's Office (ICO) data protection registration: [ICO no. to confirm].

What information we collect

We collect information you provide to us and information generated during your assessment. This may include:

• Identity and contact details, such as your name, date of birth, email address, phone number and postal address.
• Referral and intake information, including the reasons you are seeking an assessment and relevant background or developmental history.
• Special category health data, including questionnaire responses, clinical interview notes, assessment scores, any diagnoses, and reports we produce. This is more sensitive information that we treat with additional care.
• Information from third parties where relevant and with an appropriate lawful basis, for example a GP, a family member or another professional who supports your assessment.
• Documents you send us through the patient portal, such as earlier assessment reports, school reports or support plans. You can only upload documents when we have asked for them. Once sent, they are part of your clinical record: you cannot view, download or delete them in the portal, so if you send something by mistake, please tell us and we will deal with it.
• A record of when you sign in to the patient portal (the date and time, and whether it was on a phone, tablet or computer), so your clinician can see whether you have been able to get in. It is kept with your clinical record.
• Technical and usage information collected when you use our patient portal or website, as described in our cookies notice.

Our lawful basis

For general personal information, we rely on Article 6 of the UK GDPR. The lawful bases we rely on include the performance of a contract or steps taken at your request; our legitimate interests in operating and administering the clinic, keeping our systems secure, and managing enquiries and payments; and compliance with our legal obligations.

For special category health data, we rely on Article 9 of the UK GDPR. This is usually your explicit consent under Article 9(2)(a), and the provision of health care under Article 9(2)(h), which permits the processing of health data by, or under the responsibility of, a professional subject to a duty of confidentiality.

Do you have to provide your information?

Providing your information is necessary for us to carry out your assessment, as part of our agreement with you. If you choose not to provide certain information, we may be unable to carry out or complete your assessment safely.

Automated decision-making

We do not make decisions about you using solely automated means. While our platform scores questionnaires to support the assessment, your results, any diagnosis and your report are always reviewed and decided by a qualified clinician.

How we use your information

We use your information to:

• Assess your suitability for an assessment and arrange appointments.
• Carry out and record your assessment, including questionnaires, interviews and scoring.
• Produce and share your report and any related correspondence with your agreement.
• Communicate with you about your care and respond to your enquiries.
• Meet our professional, clinical governance, safeguarding and legal obligations.
• Maintain the security and proper functioning of our systems.

Who we share it with

Within our team. Your record is seen by the clinicians involved in your assessment, including colleagues who review the decision. Anyone else in our team who needs to look at it must record why; this is logged and checked. Our administrative staff support your clinicians with bookings, calls, messages and paperwork, so they can also see your record.

We do not sell your information. We share it only where necessary and with an appropriate lawful basis. This may include:

• Your GP or other professionals involved in your care, with your consent.
• Carefully selected service providers who process information on our behalf under written data-processing agreements. Our current processors are: our assessment platform, database and secure document storage (Supabase, hosted in London, United Kingdom); our website hosting and content delivery (Cloudflare); our email provider (Microsoft 365); and our card-payment provider (Stripe).
• Regulators, professional bodies or authorities where we are required to do so by law, or to protect someone from serious harm.

Where it's stored and for how long

Your information is stored on secure systems. Your core assessment data and documents are hosted by Supabase in London, United Kingdom. Some of our service providers (for example email and card payments) may process limited information outside the UK; where they do, this is protected by appropriate safeguards such as UK adequacy regulations or standard contractual protections. [Transfer details to confirm with each provider.]

Files you add in the portal before sending. When you add photos or files to send us, they are kept for a short time in your web browser's own storage on your device, so that nothing is lost if the page reloads (for example while your phone's camera is open). They stay on your device and are not sent anywhere until you press Send. They are deleted from your device when you send them, when you cancel, when you sign out, or after 24 hours, whichever comes first. Large photos are made smaller on your device before they are sent.

We keep clinical records in line with professional and legal retention requirements, and securely delete or anonymise them when they are no longer needed. Our specific retention periods, which follow recognised record-keeping standards (such as the Records Management Code of Practice and relevant professional guidance): [retention periods to confirm].

Your rights

Under UK data protection law you have rights over your personal information, including the right to:

• Be informed about how we use your information.
• Access a copy of the information we hold about you.
• Request that inaccurate information is corrected.
• Request erasure of your information in certain circumstances.
• Restrict or object to certain processing.
• Data portability in certain circumstances.
• Withdraw consent at any time, where we rely on consent, without affecting processing carried out before you withdrew it.

Some rights are qualified, particularly for clinical records we are required to retain. To exercise any of these rights, please contact us using the details below.

How to complain

If you have any concerns about how we handle your information, please contact us first so we can try to put things right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority, at ico.org.uk or by calling the ICO helpline. Raising a concern with us will not affect your care, and you can also see our complaints procedure.

Contact us

For any questions about this notice or your information, or to exercise your rights, please contact us. Data protection contact: [DPO/contact to confirm]. Email: [email to confirm]. Phone: [phone to confirm]. Postal address: [address to confirm]. You can also make an enquiry.

Last updated 3 October 2026 (draft)