1. Purpose and introduction
Different Minds (ADHD ASD Norfolk) Ltd is committed to protecting the privacy, confidentiality and security of personal information entrusted to us by patients, parents, carers, staff and other individuals. As a CQC-registered independent neurodevelopmental healthcare provider, we process sensitive clinical information and comply with the UK General Data Protection Regulation (UK GDPR), Data Protection Act 2018 and applicable duties of medical confidentiality. This notice explains how information is collected, used, shared, retained and protected.
2. Data controller and contact details
Different Minds (ADHD ASD Norfolk) Ltd, 124 Thorpe Road, Norwich, Norfolk NR1 1RS. CQC provider registration: 1-24125361868. Registered Manager and Information Governance Lead: Mr G Boulter MSc. Questions and requests about personal data should be addressed to the Information Governance Lead at the clinic address or via the clinic’s published contact channels.
3. Categories of personal data
We may process names, dates of birth, addresses, contact details, NHS numbers, GP details, parental responsibility information, payment and appointment records; medical and developmental histories; screening questionnaires, school and informant observations, diagnostic findings, reports, prescribing records, monitoring observations, clinical notes, safeguarding records and correspondence. We may also receive information from teachers, SENDCos, family members, employers and other healthcare professionals. Website enquiries and limited technical usage information may also be collected.
4. Purposes of processing
We use information to respond to enquiries, register patients, schedule appointments, conduct ADHD and ASD screening and diagnostic assessments, evaluate supporting evidence, prepare reports, prescribe and monitor medication where appropriate, communicate with professionals, safeguard individuals, maintain clinical records, manage payments and complaints, investigate incidents and meet legal and regulatory obligations. We do not sell patient data.
5. Lawful bases and special category data
Depending on the purpose, our Article 6 UK GDPR lawful bases may include contract (6(1)(b)), legal obligation (6(1)(c)), legitimate interests (6(1)(f)), vital interests (6(1)(d)) or consent (6(1)(a)) where appropriate. Clinical health information is special category data generally processed under Article 9(2)(h), together with relevant Data Protection Act 2018 conditions for healthcare. Other conditions may apply to safeguarding or legal claims. Consent to treatment or confidential disclosure is distinct from UK GDPR consent.
7. Children, young people and parental responsibility
We consider the child’s age, understanding, competence, wishes, best interests, relevant court orders and safeguarding circumstances. Parental responsibility does not create an unrestricted right to all confidential information in a child’s record. Where parents are separated or court proceedings are ongoing, requests are considered impartially against legal and professional requirements, including third-party confidentiality.
8. Subject access requests
Individuals may request their personal data under Article 15 UK GDPR, including personal data within clinical notes, reports, relevant emails, meeting records and paper records. We normally respond within one calendar month; where legally permitted, complex or numerous requests may be extended by up to two months with notice during the initial period. Identity or authority may be verified where necessary. Third-party information and certain health information may require redaction or withholding under applicable exemptions. A request does not automatically entitle an applicant to every complete document.
9. Data security
We use proportionate technical and organisational safeguards including restricted permissions, appropriate authentication, secure electronic and paper storage, confidentiality requirements, staff training, secure disposal, incident reporting and review of security risks. Staff access is based on their roles and legitimate needs.
10. Retention and disposal
Information is retained only as long as necessary for care, legal, regulatory and professional obligations. Specific retention periods are governed by the clinic’s approved retention schedule and may vary for adults, children, safeguarding, prescribing and administrative records. Records are securely deleted, destroyed or anonymised when no longer needed and lawful to dispose of. Erasure requests are considered individually; clinical records may need to be retained despite such a request.
11. Processors and international transfers
External providers may support clinical record systems, secure email, booking, payments, IT or transcription. Appropriate contracts and safeguards will be used where they process data on our behalf. Where restricted transfers occur outside the UK, we will apply the required adequacy arrangements or appropriate safeguards under UK GDPR. Details of applicable transfers can be requested.
12. Clinical recording and transcription
Any clinical audio recording, speech-to-text or similar technology must follow clinic recording and consent procedures, confidentiality obligations and documented risk assessment. Patients will be informed of recording and necessary authorisation obtained. Recordings and transcripts will not be repurposed without an appropriate lawful basis.
13. Safeguarding disclosures
Information may be disclosed without consent where necessary and lawful to protect a child or adult at risk, respond to serious threats to safety, comply with court orders or statutory duties, or support safeguarding investigations. Such disclosures will be assessed, minimised and documented.
14. Personal data breaches
Suspected breaches must be reported and investigated promptly. We will contain incidents, assess risk, document decisions and take corrective action. Where required, the ICO will be notified without undue delay and, where feasible, within 72 hours of awareness; individuals will be informed without undue delay where the breach is likely to result in a high risk to their rights and freedoms, subject to lawful exceptions.
15. Individual rights
Subject to legal conditions and exemptions, individuals have rights to be informed, access data, rectify inaccuracies, erase data, restrict processing, data portability, object to certain processing and protections relating to qualifying solely automated decisions. Requests should be directed to the Information Governance Lead. Disagreement with a clinical opinion does not automatically render the opinion inaccurate; relevant concerns may be added to the record.
17. Complaints
Privacy concerns should be raised with the Information Governance Lead at 124 Thorpe Road, Norwich, Norfolk NR1 1RS. Individuals may also complain to the Information Commissioner’s Office (ICO), telephone 0303 123 1113, website https://ico.org.uk. Contacting the clinic first is encouraged but not compulsory.
18. Responsibilities and review
All clinicians, employees, associates and contractors must comply with confidentiality and information handling obligations. The Information Governance Lead oversees privacy requests, incidents, awareness and policy review. This document will be reviewed at least annually and following material changes in law, systems or service delivery.
19. Approval
Approved by: Graham Boulter
Registered Manager and Information Governance Lead
Date: 26 October 2026