Privacy Notice – Child Mental Health Clinic Ltd (CMHC)
Last updated: June 2026
CMHC is a private clinic based in Camberley, Surrey, offering tailored mental health assessments and treatments for children, young people, and their families.
This Privacy Notice outlines how Child Mental Health Clinic Ltd (“CMHC”) collects, uses, stores, and shares personal information in accordance with the UK General Data Protection Regulation, the Data Protection Act 2018 and other applicable privacy legislation.
We are committed to protecting the privacy and confidentiality of patients, families, website users, job applicants, staff, contractors and volunteers. This Privacy Notice should be read alongside CMHC’s Terms and Conditions and any service-specific information provided by the Clinic.
Registered Office
Unit 3, Ilex House, 94 Holly Road, Twickenham, TW1 4HF
For questions about how we handle personal data, please contact our Data Protection Lead using the details below:
Child Mental Health Clinic
Unit 303, Basepoint Business Centre (Camberley),
377–399 London Road,
Camberley,
GU15 3HL
Email: admin@cmhclinic.co.uk
Phone: +44 7818 262986
What Information We Collect
We collect and process personal data to provide safe, effective, and high-quality care. Information may be collected at enquiry, referral, assessment, and throughout the course of treatment. This may include:
• Patient’s name, date of birth, address, and contact details
• Details of parents/guardians (for minors) or individuals with parental responsibility
• GP and school and other professional information
• Details provided through referrals, assessments, online forms, and questionnaires
• Clinical notes, prescriptions, diagnostic test results, and correspondence
• Appointment, consent, authorisation, payment and administrative records
This information is essential for clinical decision-making, safeguarding, and administrative purposes. Without this data, we would not be able to deliver safe mental health services.
We may also collect personal information relating to staff, contractors, job applicants and volunteers, including identity, qualifications, references, DBS checks, professional registration and employment or payment information. This is to fulfil our legal, contractual, and safeguarding responsibilities.
Lawful Basis for Processing Your Data
CMHC collects and processes your personal and health data under specific lawful bases as defined by the UK GDPR:
• Article 6(1)(b) – performance of a contract or steps before entering into a contract;
• Article 6(1)(c) – compliance with a legal obligation;
• Article 6(1)(f) – legitimate interests, where not overridden by individual rights;
• Article 9(2)(h) – provision of health or social care;
• Article 9(2)(f) – establishment, exercise or defence of legal claims;
• Article 9(2)(g) – substantial public interest, where applicable, including safeguarding.
Where we rely on consent for specific activities, consent may be withdrawn at any time. This will not affect processing already carried out and may affect our ability to provide certain services.
Confidentiality and Information Governance
We are committed to protecting the privacy and confidentiality of all individuals who use our services and follows professional standards, including those set by the General Medical Council. Personal data is accessed strictly on a need-to-know basis and is only shared in accordance with lawful, clinical, or safeguarding requirements.
How We Store and Protect Your Data
CMHC uses secure, encrypted systems to store all personal and health-related data. Data may be held in both digital and paper formats. We use the following platforms:
• ClinicOffice – a secure clinical management system (pioneersoftware.co.uk)
• Microsoft Cloud – for secure file storage and communication
• Egress – encrypted email service for secure exchange of sensitive data
We use appropriate safeguards, including secure access controls, password protection, encryption where appropriate and regular review of data handling processes. No electronic system can be guaranteed to be completely secure, but we take reasonable steps to protect personal data from unauthorised access, loss, misuse or disclosure.
How Long We Keep Your Data
We retain personal and clinical records only for as long as necessary, and in accordance with applicable legal, professional and healthcare record retention guidance.
• For children and young people, records are kept until their 25th birthday, or 26th birthday if they were 17 at their last appointment.
• In rare cases where we provide services to adults, their records are kept for 20 years after their last contact.
• After the death of a patient, we retain records for 8 to 10 years, depending on the case.
• Some data may be retained longer where required for legal, regulatory, safeguarding, insurance or clinical governance reasons.
Sharing Your Data
CMHC will only share personal data where there is an appropriate lawful basis and where sharing is necessary, proportionate and relevant. We may share your data with:
• GPs, schools, or clinicians involved in the child’s care
• Regulatory authorities (e.g. CQC, Police, NHS) where we are legally obliged
• Safeguarding agencies, local authorities or emergency services where there is a concern about risk or harm
• Legal, insurance or professional advisers where necessary
Where possible and appropriate, we will seek consent before sharing information. However, information may be shared without consent where required by law, for safeguarding, where there is a serious risk of harm, or where another lawful basis applies.
Families may ask us to limit sharing. We will consider such requests carefully but may not be able to agree where sharing is necessary for safe care, safeguarding, legal compliance or professional obligations.
Website Users
When you use our website or online forms, we may collect information such as IP address, browser type, device information, pages visited, time spent on the website and information submitted through forms.
We may use cookies and analytics tools to improve website functionality, understand how visitors use our website and improve our services. Cookies can usually be disabled through browser settings. Where required, further information will be provided through our Cookie Policy or cookie settings.
External Links and Imagery
Our website may contain links to external websites. CMHC is not responsible for the content, security or privacy practices of external sites.
Images of people used on our website or marketing materials are stock or model images unless otherwise stated. They are not real patients and do not represent actual users of CMHC services.
International Transfers
Some systems or service providers used by CMHC may process or store data outside the United Kingdom. Where this occurs, we will take reasonable steps to ensure appropriate safeguards are in place in accordance with UK data protection law.
Marketing and Unsubscribing
CMHC may occasionally send service-related updates or information that may be relevant to families or professionals. We will only send marketing communications where we have an appropriate lawful basis.
To stop receiving marketing communications, please email admin@cmhclinic.co.uk and include “Unsubscribe” in the subject line.
Your Rights
Under the UK GDPR and the Data Protection Act 2018, you may have the right to:
• Access: You can request a copy of the personal data we hold about you.
• Correction: You can ask us to correct any inaccurate or incomplete information.
• Erasure: You can request deletion of your personal data where appropriate. Please note, we are legally required to retain medical records and cannot delete or alter them. However, if you disagree with information in your records, you may ask for your views to be added to the record.
• Object to Processing: You may object if we are using your data based on legitimate interest or for direct marketing.
• Restrict Processing: You can ask us to pause use of your data in certain situations (e.g. if you contest its accuracy or object to its use).
• Data Portability: You can request that your data be transferred to you or another party in a readable format.
• Withdraw Consent: Where we rely on consent, you can withdraw it at any time. This won’t affect past use, but it may impact services we can provide.
To exercise your rights or make a Data Subject Access Request, please email admin@cmhclinic.co.uk. We may need to verify your identity before releasing information.
Updates to This Notice
CMHC may update this Privacy Notice from time to time to reflect changes in our services, systems, legal obligations or regulatory guidance. The latest version will be available on our website. We recommend checking this notice periodically to stay informed about how we handle personal data.
Complaints or Concerns
If you have any questions or concerns about how your personal data is being handled, please contact us:
Email: admin@cmhclinic.co.uk
Phone: +44 7818 262986
Post:
Child Mental Health Clinic Ltd
Unit 303, Basepoint Business Centre
377–399 London Road
Camberley
GU15 3HL
You also have the right to lodge a complaint with the Information Commissioner’s Office:
Website: www.ico.org.uk/concerns
Phone: 0303 123 1113