Data Protection & Privacy Policy Statement
Information about how the clinic handles personal and health data.
1. Data Controller Information
Clear Thinking Clinic acts as the Data Controller responsible for your personal and health data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. Collection & Processing of Special Category Data
We collect and process personal details (such as your name, contact information, and appointment history) along with health data, including clinical notes, scheduling preferences, and messaging records.
The clinic's lawful basis for processing and its special-category condition require review for each purpose.
Contact the clinic for information about how your health data is processed.
3. Data Hosting & Data Residency
Hosting locations, service providers, and any international transfers must be confirmed before this notice is finalised.
4. Security & Encryption Controls
The application applies protections to sensitive clinical data:
- Message content, enquiry messages, appointment notes, and private clinical notes are encrypted by the application before database storage.
- Transport security, hosting, backups, and access to encryption keys must be verified operationally.
- Messages are not end-to-end encrypted; the application can decrypt their contents.
5. Data Retention & Your Rights
Retention: Retention periods depend on applicable requirements and require clinical and legal review.
Your Rights: Under UK GDPR, you have the right to request access to your data (Subject Access Request), request rectification of incorrect details, or request erasure (subject to statutory healthcare record retention rules).