Privacy Notice
Privacy Notice for Clients, Service Users, Visitors and the Public
1 About Us
Psicon Ltd is an independent, psychology-led healthcare provider. We specialise in promoting psychological health and wellbeing for clients across the UK, with services predominantly based in Kent and Hampshire.
We offer a number of services to support a range of clients, from individuals and their families to corporations, including health care providers, employers, schools, universities and other centres of education, as well as the courts. We are also contracted to provide NHS services.
2 Introduction and Purpose
2.1 What is a Privacy Notice?
A Privacy Notice is a statement issued by Psicon Ltd to clients, service users, visitors and the public. It explains how we collect, use, retain, share and protect the personal information we hold.
It is sometimes also referred to as a Privacy Statement or Fair Processing Statement. At Psicon Ltd we pride ourselves on integrity and trust, and with upholding the highest standards of privacy and confidentiality, whether you are accessing one of our independent services or an NHS service. This Privacy Notice is part of our commitment to ensure that we process your personal information fairly and lawfully.
3 Who And What This Policy Applies To
This privacy notice applies to personal information we process on behalf of clients, service users, visitors and the public.
4 Definitions
Personal data
Any information relating to an identified, or identifiable living person.
This may include the individual’s:
· Name (including initials)
· Identification number
· Location data
· Online identifier, such as a username
It may also include factors specific to the individual’s physical, physiological, genetic, mental, economic, cultural or social identity.
Special category data
Personal data which is more sensitive and so needs more protection, including information about an individual’s:
· Racial or ethnic origin
· Political opinions
· Religious or philosophical beliefs
· Trade union membership
· Genetics
· Biometrics (such as fingerprints, retina and iris patterns), where used for identification purposes
· Health – physical or mental
· Sex life or sexual orientation
Processing
· Anything you do with personal data (collect, store, use, share, delete).
· Processing can be automated or manual.
Data subject
The identified or identifiable individual whose personal data is held or processed.
Data controller
The organisation (Psicon) that determines the purposes and the means of processing of personal data.
Data processor
An organisation that processes personal data on behalf of Psicon.
Personal data breach
A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.
Data Protection Officer (DPO):
The individual responsible for overseeing data protection strategy and implementation at Psicon (David Birkenshaw, Kaleidoscope Data Privacy Consultants).
5 Duties and Responsibilities
All Psicon staff are bound by strict confidentiality obligations and must comply with data protection law, including the UK GDPR and Data Protection Act 2018. Staff may only access your information where necessary for their role and must use it lawfully, fairly and securely. All staff are required to sign confidentiality agreements, complete mandatory information governance training, and follow organisational policies to protect your personal data. Information will only be shared where necessary for your care or where there is a lawful basis to do so.
6 How We Use Your Information
6.1 Who we are (Data Controller Details)
Psicon Ltd
Email: enquiries@psicon.co.uk
Telephone: 0330838 3105
Address: 15–17 New Dover Road, Canterbury, Kent CT1 3AS
6.2 What personal data we collect
We process two categories of personal information about you.
Standard personal data we may ask you for and hold includes:
· Name
· Date of Birth
· Post code
· Address
· NHS or Hospital/GP details
· Appointment dates and times
Special category data includes:
· Information about your physical and mental health (we may get this information from application forms you have filled in, from notes and reports about your health and any relevant treatment and care you have received from a third party).
· Information about a disability and/or your support needs.
· Information about your race, ethnic origin and religion (we may get this information from your treatment preferences to allow us to provide care that is tailored to your needs).
· Information about any criminal convictions and offences, ifrelevant.
6.3 How we collect your data
We collect personal information from you and from third parties, including anyone acting on your behalf, such as healthcare providers, case managers, solicitors or your employer.
6.4 How we collect data from you
Through your contact with us, including by phone, by email, through our websites, by post, by filling in application or other forms, or face to face (for example, in consultations, diagnosis and treatment).
Note that where you make contact with us via phone, we may record or monitor phone calls for security and training purposes.
6.5 How we collect data from other people / organisations
For all of our clients, we may collect information from:
· Your parent or guardian if you are under 18 years old.
· A family member, or someone else acting on your behalf.
· Your GP, and other health care professionals and health careproviders.
If we provide you with services through an insurance policy, we may collect information from your insurance provider.
If we provide you with occupational health services, we may collect information from:
· Your employer.
· Your employer’s insurance provider, if you are covered by an insurance policy that your employer has taken out.
· If we provide you with legal services, we may collect information from your solicitor.
· If we provide you with an NHS service under one of our NHS contracts, we may collect information from public sector commissioners who are paying for the services we provide to you.
6.6 Why we use your data (Purpose of processing)
This privacy information sets out the purposes for which we process your personal information. We have also documented the legal reasons for which we may process your personal information.
6.7 Our lawful basis
Our lawful basis for processing your personal data depends on the context in which we use it. This may include processing that is necessary to provide health or care services, meet legal obligations, perform a contract, protect vital interests, carry out tasks in the public interest, or pursue legitimate interests where these are not overridden by your rights and freedoms. Where confidential health information is used or shared, the common law duty of confidentiality will also apply.
For special category personal data relating to health, our primary condition for processing is Article 9 (2)(h) UK GDPR (health or social care)
Other legitimate interests we may have in processing your data can include:
· It is necessary to establish, make or defend legal claims (for example if you are a client of our medico-legal service);
· It is necessary for a purpose designed to protect the public against dishonesty, malpractice or other seriously improper behaviour (for example, investigations in response to a safeguarding concern, a client’s complaint or a regulator telling us about an issue);
· It is in the public interest, in line with any laws that apply.
We will only ask for your consent to process personal information where consent is the appropriate lawful basis. If we need your consent, we will make this clear and explain what you are agreeing to. You can withdraw consent at any time, although this will not affect processing that has already taken place.
Use of Artificial Intelligence (AI)
As part of providing our services, we may use approved artificial intelligence (AI) software to assist with the transcription of clinical consultations and the preparation of clinical reports.
The AI software is used as a support tool only. Where AI is used, your personal information is processed securely and only for the purpose of supporting the delivery of your care. It does not make clinical decisions or determine the content of your report. All reports are reviewed, amended where necessary, and approved by the relevant clinician before they are finalised or shared.
We assess AI tools before they are introduced to ensure they meet our requirements for data protection, information security and appropriate clinical use, and we have appropriate contractual and technical safeguards in place to protect your personal information.
6.8 How we keep your data safe and secure
Psicon Ltd takes information security and the records management of your personal data very seriously, ensuring that your information is retained in secure electronic and paper records and access is restricted to only those who require it.
The Data Protection Act 2018 and UK GDPR regulate the processing of personal information. Strict principles govern our use of personal information and our duty to ensure it is kept safe and secure. Psicon Ltd is registered with the Information Commissioner's Office (ICO) Ref: Z7247557.
Confidentiality
Everyone working for Psicon limited is subject to the Common Law duty of confidentiality and data protection laws. Information provided in confidence will only be used for the purposes to which you consent, unless there are other circumstances covered by the law.
This is reinforced under our internal Confidentiality Policy, where all staff are required to protect your information, inform you of how your information will be used and allow you to decide if and how your information can be shared. This will be noted in your records.
All Psicon staff are required to undertake annual training in Data Security Awareness.
6.9 Who we share your data with
Some of our services rely on working closely with and coordinating care with other health care professionals or other professionals such as your employer’s occupational health department, your insurance provider, or your solicitor. To provide you with the best experience and treatment, we may share information about you with other professionals.
We may share your personal information with members of our group and third parties in connection with a significant corporate transaction or restructuring, including a merger, acquisition, asset sale, initial public offering or in the event of our insolvency. In such cases information will be anonymised where possible and only shared where necessary. Depending on the circumstances:
· To comply with our legal and regulatory obligations, or
· In other cases, for our legitimate interests or those of a third party, i.e. to protect, realise or grow the value in our business and assets.
For our NHS contracts
To provide healthcare services and manage your care, we may need to share information about you with other healthcare professionals and organisations involved in the delivery, administration, funding, monitoring, or regulation of your care.
Depending on the service you are accessing, this may include:
· GPs, consultants, clinicians, pharmacies, and other healthcare providers involved in your care;
· NHS England, Integrated Care Boards (ICBs), commissioners, and other authorised NHS bodies;
· Referrers, including healthcare professionals, schools, local authorities, employers, occupational health providers, insurers, or legal representatives;
· Regulatory, safeguarding, law enforcement, or government bodies where required by law or where necessary to protect you or others from harm;
· Approved third-party service providers and technology partners who process information on our behalf under contractual agreements.
This may include demographic information (such as name, address, postcode, date of birth, NHS number and contact details), information relating to disabilities or long-term conditions, referral and appointment information, and other information relevant to the services provided. Only the information necessary for these purposes will be shared.
We will only share information where there is a lawful basis to do so and in accordance with applicable data protection legislation, including the UK GDPR, the Data Protection Act 2018, and the common law duty of confidentiality.
Where appropriate, we will seek your consent before sharing information. However, there are circumstances where we may share information without consent, including where this is necessary for the provision of healthcare, required under a legal orcontractual obligation, necessary to protect you or another person from serious harm, or otherwise permitted by law.
For services delivered under NHS contracts, we may be required to share information with NHS England, Integrated Care Boards (ICBs), and other authorised NHS bodies for purposes including direct care, commissioning, service monitoring, statutory reporting, audit, service planning, and healthcare improvement activities.
Data Processors
Psicon uses a number of carefully selected third-party providers to support the delivery of our services. These providers are contractually required to protect your information and only process it in accordance with our instructions and applicable data protection laws.
A current list oforganisations that process personal data on our behalf is available upon request. This may include providers of clinical systems, telephony services, video consultation platforms, secure communications, document management, data hosting, analytics, and other technology services that support the delivery of our services.
For SmartSurvey
We may provide you/your child’s school with the option of submitting an electronic questionnaire through a third party, SmartSurvey. In accordance with the GDPR storage limitation principle, the personal data submitted will be stored by the third party, SmartSurvey, for as long as is necessary for the purpose for which thatinformation is processed. Please see our SmartSurvey Privacy Policy, and Security Statement.
Once your questionnaire or your child’s questionnaire has been received by Psicon Ltd via SmartSurvey, the data will be deleted from the live SmartSurvey environment in accordance with our retention arrangements, and entered into our patient record system, which is securely hosted and accessed using multi-factor authentication. Responses to this questionnaire will be kept on this secure online system.
NHS National Opt-Out
We are required to share certain information about the services we provide with NHS England and other authorised NHS bodies. This is a legal requirement and helps with the planning, monitoring and improvement of health services.
This type of data sharing does not require yourconsent. The National Data Opt-Out does not apply where your information is used for your individual care or where we are legally required to process or share your information.
However, you have a choice about whether your information is used for purposes beyond your direct care, such as research and service planning. This is known as the National Data Opt-Out. You can find out more or set your preference at www.nhs.uk/your-nhs-data-matters or by calling 0300 303 5678.
6.10 International transfers
Most of our processing of personal data takes place within the United Kingdom. Some of our data processors and service providers may be located outside the United Kingdom, which means your personal data maybe transferred internationally. Where this happens, we ensure the transfer complies with UK data protection law. This may include transferring data to a country covered by adequacy regulations or using appropriate safeguards such as the UK International Data Transfer Agreement or other approved contractual mechanisms.
Where personal data is transferred internationally, we ensure appropriate contractual, technical, and organisational safeguards are in place to protect your information and comply with applicable data protection laws.
6.11 Automated decision-making /profiling
We do not use your personal data to make decisions about you based solely on automated processing (including profiling) that produce legal or similarly significant effects.
6.12 How long we keep your data (Retention)
We keep your personal information in line with set periods based on the following criteria:
· How long you have been a client with us;
· How long it is reasonable to keep records to show we have met the obligations we have to you and by law;
· Any periods for keeping information which are set by law or recommended by regulators, professional bodies or associations.
If you would like more information on how long we will keep your information for, please contact enquiries@psicon.co.uk
6.13 Your data protection rights
You have the certain rights in relation to your personal information listed below:
· The right to be informed: an organisation’s obligation to be transparent of how they use an individual’s personal data (Privacy Notice).
· The right of access; allows individuals to obtain a copy of their personal data (Subject Access).
· The right to rectification: an individual can request that inaccurate or incomplete personal data is corrected.
· The right to erasure: an individual can request the deletion or removal of personal data that is no longer necessary for the purposes of processing. (Right to be forgotten).
· The right to restrict processing: an organisation must stop processing or erase data if the individual's interests override the organisation's legitimate grounds for processing data (where the organisation relies on its legitimate interests as a reason for processing data).
· The right to data portability: allows individuals to obtain and transmit their personal data to another controller.
· The right to object: an individual can request a stop to their data being processed if processing is based on public interest or legitimate interest.
· Rights in relation to automated decision making and profiling: an individual can request not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them, unless overridden by legal requirements.
Please note that your rights are not absolute, and we will let you know in our correspondence with you how we will be able to complywith your request.
If you make a request, we will ask you to confirm your identity if we need to and provide some information that will help us deal with your request. If we cannot meet your request, we will explain why.
To make a request in relation to your subject access rights, please contact
subjectaccessrequest@psicon.co.uk
6.14 Right to withdraw consent
When the lawful basis used is consent, you can withdraw your consent by emailing enquiries@psicon.co.uk. Once we have received your withdrawal, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another lawful basis for doing so.
The national data opt-out enables patients to opt out from the use of their data for research or planning purposes. In line with the recommendations, the Caldicott Guardian and the Data Protection Officer will remove anyone who has opted out from any data disclosures for purposes beyond individual care.
Patients can view or change their national data opt-out choice at any time by using the online service at www.nhs.uk/your-nhs-data-matters or by calling 0300 303 5678.
6.15 Research Projects
Psicon Ltd may from time to time engage in or run research projects aimed at contributing to the wider field of promoting psychological health and wellbeing. If you are involved in any research with us, we will always clearly explain what we intend to do with your personal data and ask for your consent before we process your personal data.
In these circumstances, the research will be ethically approved by the relevant authorities, and any personal data will be anonymised. It may be that your personal data is combined with other people's information for research and statistical purposes. You cannot be identified from this information, and we will only share informationin line with legal agreements which set out an agreed and limited purpose, and prevent the information being used for another purpose or commercial gain.
6.16 Right to complain
PsiconLtd is committed to handling personal data in a fair, lawful and transparent manner. Individuals have the right to raise concerns about how their personal data has been processed.
In line with the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025), Psicon has established a formal process for managing data protection complaints.
A data protection complaint is any expression of dissatisfaction relating to how Psicon has collected, used, stored, shared or otherwise processed personal data.
Psicon will accept and act upon complaints received through any channel, including informal routes where it is clear that a concern about personal data handling is being raised.
Howto Make a Data Protection Complaint
Individuals may raise a data protection complaint using any of the following methods:
· Email: feedback@psicon.co.uk
· Telephone: 0330 838 3105
· Client Experience Team, Psicon Ltd, 15 New Dover Road, Canterbury, Kent, CT1 3AS
· Via any member of Psicon staff
Or you can contact our Data Protection Officer at Psicon (Kaleidoscope Consultants):
Data Protection Officer
Email: dpo.psicon@kdpc.uk
Right to Escalate to the Information Commissioner’s Office (ICO)
Individuals are encouraged to raise their concerns with Psicon first so that we can investigate and resolve the matter.
However, individuals have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at any time:
· Website: https://ico.org.uk
· Phone: 0303 123 1113
· Wycliffe House, Water Ln, Wilmslow SK9 5AF
Complaints Policy
Please refer to the Psicon Complaints and Concerns Policy which can be downloaded from here: https://www.psicon.co.uk/legal/complaints-concerns
6.17 Changes to this notice
If our privacy notice changes in any way, we will publish an updated version. Regularly reviewing the notice will help you stay aware of what information we collect, how we use it, and when we may share it.
6.18 Privacy information in relation to our website
We may process information about your use of our website and services, known as usage data. This may include your IP address, approximate geographical location, browser type and version, operating system, referral source, length of visit, page views, website navigation paths, and information about the timing, frequency and pattern of your service use. We use this information to analyse and improve our website and services, based on our legitimate interests in monitoring and improving them.
We may process information contained in any enquiry you submit to us regarding goods and/or services ("enquiry data”). The enquiry data may be processed for the purposes of offering a service. The enquiry data may be processed for the purposes of communicating with you and record-keeping. The legal basis for this processing is our legitimate interests, namely the proper administration of our website and services and communications with users.
We may process information contained in or relating to any communication that you send to us ("correspondence data”). This can also include CV’s and/or job applications submitted through our website. The legal basis for this processing is our legitimate interests, namely the proper administration of our recruitment processes. Although we will not hold your personal information once a job vacancy recruitment process has been completed, unless we seek your prior consent to do so.
6.19 Further information
Psicon Ltd will handle your personal information in ways that respect your rights and promotes your health and wellbeing. However, if you have any concerns about privacy and confidentiality, or want to know more about the arrangements that Psicon Ltd has put in place to follow the outlined commitment please contact Psicon Ltd:
· Tel: 0330 838 3105