⚠️ Draft policy — legal review required. This policy is a working draft prepared for The Thistle Clinic and has not yet been reviewed by a qualified legal or data protection professional. It must be reviewed and approved by a solicitor or data protection specialist before the website goes live and this policy is relied upon.
Who We Are
Thistle Psychiatry Ltd (trading as The Thistle Clinic) is the data controller for personal data collected through this website. Company number: 17237978. Registered address: 47 New Lakeside, Peterborough, PE7 8HU.
Regulatory Status
The Thistle Clinic currently provides diagnostic and assessment services only and does not provide prescribing services. Based on the current service model, CQC registration is not required at this stage. We are actively preparing for future CQC registration as our service develops.
What Data We Collect
Through this website, we may collect: your name, email address, and phone number; details of the assessment or service you are enquiring about; the content of any message you send us; and anonymised usage data via cookies (with your consent). If you go on to book an assessment, further clinical information is collected separately as part of that process — see "Enquiry Data vs Clinical Records" below.
Enquiry Data vs Clinical Records
Data submitted through the website's enquiry form and contact form is used only to respond to your enquiry and to arrange assessment information — it is not treated as part of your clinical record. If you proceed to book an assessment, your clinical and patient records are held separately in our clinical practice management system (WriteUpp), which has its own security, access controls, and retention rules appropriate to sensitive health data.
Lawful Basis for Processing
We process enquiry data on the basis of legitimate interests (responding to enquiries about our services) and, where you proceed to book an assessment, on the basis of taking steps prior to entering into a contract for services. Where we process special category data (health information) as part of a clinical assessment, we rely on Article 9(2)(h) UK GDPR — provision of health or social care — together with the duty of confidentiality owed to you as a patient.
How We Use Your Data
Your data is used to respond to enquiries, arrange and conduct assessments, and fulfil our clinical and administrative obligations. We do not sell your data, and we do not use it for marketing without your separate, explicit consent.
Data Retention
Enquiry form submissions that do not lead to a booking are retained for no longer than 12 months, then securely deleted. Clinical records for patients who proceed to assessment are retained in line with professional record-keeping requirements for private psychiatric practice — typically a minimum of 8 years for adults, and until a patient's 25th birthday for records relating to children, in line with standard NHS/professional retention guidance. Exact retention periods will be confirmed as part of legal review.
Confidentiality & Sensitive Health Data
Information about your health, including anything shared during a screening, assessment, or clinical correspondence, is treated as special category data under UK GDPR and handled with the strict confidentiality expected of a psychiatric practice. Access is limited to clinicians and staff directly involved in your care, and information is only shared with third parties (such as your GP) with your consent or where we have a legal obligation to do so.
Who We Share Data With
We may share data with: clinicians and administrative staff within Thistle Psychiatry Ltd; our clinical practice management provider (WriteUpp), acting as a data processor; and your GP or other healthcare professionals, but only with your consent or where necessary for your care or required by law. We do not sell or share your data for third-party marketing purposes.
Your Rights
Under UK GDPR and the Data Protection Act 2018, you have the right to: access the personal data we hold about you; request correction of inaccurate data; request erasure of your data in certain circumstances; restrict or object to certain processing; request a copy of your data in a portable format; and withdraw consent at any time where processing is based on consent. To exercise any of these rights, contact us using the details below.
Complaints
If you have concerns about how your data is handled, please contact us first so we can try to resolve the issue. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk or on 0303 123 1113.
Cookies
We use essential cookies to operate this website, and, with your consent, anonymised analytics cookies to help us understand how the site is used. You can choose "Essential Only" on the cookie banner to opt out of non-essential cookies.
Contact
For data protection queries, or to exercise any of the rights above: info@thethistleclinic.co.uk
