Privacy Policy
Privacy Policy
Privacy Notice
The Mindful Clinic
Last updated: September 2026
The Mindful Clinic respects your privacy and is committed to protecting your personal information. This Privacy Notice explains how we collect, use, store and protect your personal data when you contact us, enquire about our services, become a client, or use our website.
We handle personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable data protection legislation.
1. Who is responsible for your information?
The Mindful Clinic is the data controller responsible for your personal information.
If you have any questions about how your information is handled, please contact:
The Mindful Clinic
6 Quarry Street
Guildford
GU1 3UR
Email: talk@themindfulclinic.co.uk
Telephone: 07951 229556
2. What information do we collect?
Depending on the nature of your contact with us, we may collect:
-
Your name and contact details
-
Date of birth and relevant demographic information
-
Information provided when you enquire about or arrange an appointment
-
Information contained in referral, assessment and therapy forms
-
Information you provide during therapy sessions
-
Information relating to your mental health, physical health, neurodevelopmental needs and wellbeing
-
Information about medication or other treatment where relevant to your care
-
Information relating to safeguarding where relevant
-
Emergency contact details, where provided
-
Payment and invoicing information
-
Correspondence between you and The Mindful Clinic
-
Information relating to appointments and attendance
-
Information you provide through our website, including information submitted through contact forms
Some of the information you provide may constitute special category data, particularly information relating to your physical or mental health.
We only collect information that is relevant and reasonably necessary for the purposes described in this Privacy Notice.
3. How we collect your information
We may collect information:
-
Directly from you when you contact us or become a client
-
Through enquiry, referral, assessment or booking forms
-
During appointments and therapy sessions
-
From another professional where you have asked or authorised us to liaise with them
-
From your insurer, where you are accessing therapy through an insurance provider
-
From your GP or another healthcare professional where appropriate and lawful
-
Automatically when you use our website, through cookies and similar technologies
Where we receive information about you from another person or organisation, we will only use it where there is a lawful basis for doing so.
4. How we use your information
We may use your personal information to:
-
Respond to enquiries
-
Arrange and manage appointments
-
Provide psychological therapy and behavioural support
-
Assess your needs and plan appropriate support
-
Maintain appropriate clinical records
-
Communicate with you about your appointments and treatment
-
Process payments and manage accounts
-
Communicate with other professionals involved in your care where appropriate and lawful
-
Meet our professional, legal and regulatory obligations
-
Maintain appropriate records for insurance and legal purposes
-
Deal with complaints or concerns
-
Protect the safety and wellbeing of clients and others
-
Manage and improve the operation of The Mindful Clinic
-
Send information about our services where this is permitted by law
We will not use your personal information for purposes that are incompatible with those described above without first considering whether we have an appropriate lawful basis and, where required, providing you with additional information.
5. Our lawful bases for processing
We will only process your personal information where we have a lawful basis under data protection law.
Depending on the circumstances, this may include:
Performance of a contract
We may process your information where this is necessary to provide services you have requested, manage your appointments and administer our relationship with you.
Legal obligation
We may process information where necessary to comply with a legal or regulatory obligation.
Legitimate interests
We may process information where this is necessary for our legitimate business interests, such as managing and improving our services, maintaining appropriate business records, preventing fraud and protecting our business, provided that your rights and interests do not override those interests.
Consent
Where consent is the appropriate lawful basis, we will ask for your consent and explain what you are consenting to. You may withdraw consent at any time.
6. Health and other special category information
Information concerning your physical or mental health is treated as special category data under the UK GDPR.
Where we process health information as part of providing therapy or behavioural support, we will rely on an appropriate Article 9 condition in addition to our Article 6 lawful basis.
We will only process health information where it is necessary and proportionate for the purposes for which it is collected, and we will take appropriate measures to protect it.
We do not use your health information for advertising purposes.
7. Confidentiality
Confidentiality is an important part of the therapeutic relationship.
Information you share with us will normally remain confidential. We may, however, need to disclose information where:
-
You give permission for us to do so
-
Disclosure is necessary for your care and is lawful and appropriate
-
We are required to do so by law or court order
-
There is a serious and proportionate concern regarding the safety of you or another person
-
Disclosure is necessary to comply with safeguarding obligations
-
We need to seek professional, legal or regulatory advice
Where possible and appropriate, we will discuss significant disclosures with you beforehand.
8. Who may receive your information?
We may share relevant personal information with:
-
IT, software and administrative service providers who support our business
-
Professional advisers, such as accountants, solicitors and insurers
-
HMRC or other authorities where legally required
-
Other healthcare or therapeutic professionals involved in your care, where appropriate and lawful
-
An insurer where you are receiving therapy through an insurance arrangement
-
Relevant professional or regulatory bodies where legally or professionally required
We do not sell your personal information.
We do not share your personal information with third parties for their own marketing purposes.
Where another organisation processes information on our behalf, we take appropriate steps to ensure that your information is handled securely and in accordance with applicable data protection law.
9. Keeping your information secure
We take appropriate technical and organisational measures to protect your personal information against loss, misuse, unauthorised access, alteration or disclosure.
Access to clinical information is restricted to those who have a legitimate need to access it.
We maintain appropriate confidentiality arrangements with individuals who may have access to personal information. Information is password protected.
If a personal data breach occurs, we will assess it and take appropriate action in accordance with our legal and regulatory obligations.
10. How long we keep your information
We retain personal information only for as long as it is reasonably necessary for the purposes for which it was collected, taking into account our professional, legal, insurance and regulatory obligations.
Clinical records are generally retained for seven years following the end of therapy, unless there is a lawful reason to retain them for longer or a different retention period is required for a particular type of record.
Financial and accounting records will be retained for the period required by applicable tax and accounting legislation.
When information is no longer required, it will be securely deleted or anonymised.
11. Your rights
Under data protection law, you may have the right to:
-
Request access to the personal information we hold about you
-
Ask us to correct inaccurate or incomplete information
-
Ask us to erase your information in certain circumstances
-
Ask us to restrict processing in certain circumstances
-
Request the transfer of certain information to another organisation
-
Withdraw consent where processing is based on consent
These rights are subject to certain legal exceptions and are not absolute.
If you would like to exercise any of your rights, please contact:
You will not normally have to pay a fee to exercise your data protection rights. We may charge a reasonable fee or refuse a request where the law permits us to do so, for example where a request is manifestly unfounded or excessive.
We will normally respond to a valid request within one month. Where a request is particularly complex or you have made multiple requests, this period may be extended where permitted by law. We will explain this to you if an extension is necessary.
12. Direct marketing
Where we send information about The Mindful Clinic's services, we will comply with applicable privacy and electronic marketing laws.
You can ask us to stop sending marketing communications at any time by contacting us or using the unsubscribe option where provided.
We do not sell or provide your personal information to third parties for their own marketing purposes.
13. Website cookies
Our website may use cookies and similar technologies to ensure that the website operates correctly, understand how visitors use the website and, where applicable, support website functionality or analytics.
The use of non-essential cookies will be managed in accordance with applicable privacy and electronic communications requirements.
You can adjust your cookie preferences through your browser and, where provided, through our website's cookie controls.
14. International transfers
Some of the technology and service providers we use may process personal information outside the UK.
Where personal information is transferred outside the UK, we will ensure that the transfer is made in accordance with applicable data protection legislation and that appropriate safeguards are in place where required.
15. Automated decision-making
We do not use your personal information to make decisions about you based solely on automated processing that produce legal or similarly significant effects.
16. Complaints
If you have any concerns about how we have handled your personal information, please contact us first so that we have an opportunity to resolve your concern.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent regulator for data protection.
You can contact the ICO through its website:
Information Commissioner's Office (ICO)
17. Changes to this Privacy Notice
We may update this Privacy Notice from time to time to reflect changes to our services, technology or legal and regulatory requirements.
The latest version will always be published on our website.
Last updated: September 2026