Privacy Policy

All prospective clients are asked to agree to the privacy policy and terms and conditions on submitting a referral.  This highlights the circumstances in which the data will be shared and confidentiality breached. The Privacy Policy is also available on the service’s website and is worded below.

On 25 May 2018 the law changed with regard to how organisations have to protect people’s ‘data’ (personal details and records) and this is called the General Data  Protection Regulation or GDPR (2018). The following summary highlights how GDPR is being implemented, by explaining why confidential information is held and how this is protected.  Further information about GDPR can be found at https://ico.org.uk.

The purpose of collecting and processing your data is to provide you with a service (mental health care).  It is assumed that by engaging with the service you are consenting to records being kept.  Keeping records is an essential component of healthcare, which aids in understanding how best to help and forms the basis of any reports needed. The lawful basis under which your data is processed is legitimate interest. The data collected may be described as ‘special category data’ and this is processed under the conditions highlighted by GDPR Article 9”(2)h.

Your confidentiality Is maintained at all times (i.e. your Information is not shared), unless you have explicitly consented, or there are exceptional circumstances such as risk to yourself or others. In these circumstances, other services such as your GP or police may be contacted without your consent as this is a recognised professional obligation.

Consultation notes and questionnaires will be held for varying lengths of time depending on the content (and then carefully disposed of).  Some records may be held indefinitely, e.g. if there were any issues of concern that could lead to police investigation in the future.  Your records will be kept for 30 years after the conclusion of our contact in line with the following guidance form the Scottish Government: www.gov.scot/publications/scottish-government-records-management-nhs-code-practice-scotland-version-2-1-january-2012/pages/7. 

The clinical recording systems of the service are electronic; therefore, the use of paper-based information is likely to be limited. Any information recorded on paper will be securely stored in a locked filing cabinet. Confidential digital information will be stored in a secure cloud service offering high levels of security. Confidential information sent by your clinician via the internet will be securely sent through Proton Mail with end-to-end encryption. Any letters sent to professionals such as GPs, by surface mail, will be clearly marked Confidential. All electronic devices (e.g. computer, laptop, and phone) used to access stored information will themselves be password protected. 

Right of access, a ‘subject access request’ or SAR can be made for copies of records, and these will be provided within 1 calendar month of the request being made. Requests must be submitted in line with the service’s SAR policy.

The practice uses Heidi AI Scribe, a secure, UK-based artificial intelligence tool designed to support clinicians in documenting consultations. Heidi AI transcribes verbal interactions into structured clinical notes, enabling clinicians to focus more fully on patient care. All identifiable data remains within the practice and is not used for external model training. Transcribed data is retained on the Heidi platform for a maximum of five days to allow for clinician review, after which it is permanently deleted. Use of Heidi AI is optional for clinicians, and patient consent is always obtained prior to use. Further details can be found in the practice’s dedicated Heidi AI Policy.

Data Protection Complaints

Where an individual wishes to make a complaint about how The St Andrews Practice uses their personal information, information regarding the complaints process is provided both in the practice waiting area on the practice website.