Last updated: 25 August 2026 | Version: 01
1. Who we are
Brain & Mind Ltd (“Brain & Mind”, “we”, “us”, “our”) is a private neuropsychiatric/neuropsychological healthcare provider, registered in England and Wales under company number 11305217, with registered office at 167-169 Great Portland St, London, W1W 5PF.
We are the data controller for the personal information described in this notice.
Information Commissioner’s Office (ICO) registration number: ZA787018.
Contact for privacy queries: Cairstiona Benson — admin@brainmind.co.uk — 020 3303 0295 — 167-169 Great Portland St, London, W1W 5PF.
Brain & Mind Ltd has not appointed a statutory Data Protection Officer; privacy queries should be directed to the contact above.
This notice applies to individuals receiving clinical care or assessment directly from Brain & Mind, and to prospective patients and enquirers.
If your assessment or report has been arranged by a third party — such as a solicitor, insurer or employer — in connection with a legal or insurance claim, our separate Medicolegal Privacy Notice applies to that processing instead of this one. If you are also a patient of Brain & Mind in another context, both notices may be relevant to you.
A separate notice covers our employees and workers, and a separate notice covers general website visitors who are not patients or enquirers (see our Website & Cookies Notice).
Depending on your contact with us, we may collect:
Most of this information is provided by you directly or by a referring clinician. We will always try to make clear at the point of collection who has provided information about you where it did not come from you directly.
UK data protection law requires us to have a valid legal (“lawful”) basis for processing personal information, and — because health information is “special category data” — an additional condition permitting us to process it. The table below explains this in plain terms for each of the main things we do. The precise legal provisions (Article 6 and Article 9 of UK GDPR, and the Data Protection Act 2018) are set out in our internal Lawful Basis & Article 9 Schedule, available on request.
4.1 Enquiries and registration
We use your contact and enquiry details to respond to your enquiry and, if you go ahead, to register you as a patient and set up your record. This is necessary to take steps towards a contract with you (and, once you are a patient, to perform that contract). Where your enquiry itself discloses health information, we also rely on the health/social care condition described in section 5 below.
4.2 Clinical assessment, treatment and records
We use your health and clinical information to assess and treat you, and to create and maintain your clinical record, including letters to you, your GP or other professionals about your care. This is necessary to perform our contract with you to provide the healthcare service you have asked for (or, in limited circumstances, because it is in our legitimate interests to maintain accurate clinical records, for example after a course of treatment has ended). Because this involves health information, we also rely on the health/social care special category condition (section 5).
Note: where you are not personally the contracting party — for example, if your employer or insurer has arranged and is paying for your assessment — the legal basis for the clinical processing itself may instead be our legitimate interest in providing safe and appropriate healthcare, rather than contract. We will confirm the applicable basis for your particular arrangement on request.
4.3 AI-assisted clinical note-taking
Some consultations are documented with the help of an approved AI clinical scribe (“Heidi” or an equivalent approved tool), which listens to or transcribes the consultation to help the clinician produce accurate notes more efficiently.
4.4 Referrals to, and information from, other healthcare professionals
Where appropriate, we share relevant clinical information with other healthcare professionals involved in your care (for example when referring you on, or receiving records from a referring clinician). This is necessary for the provision of healthcare and relies on the health/social care special category condition.
4.5 Appointment scheduling
We use your identity and appointment details to arrange and manage your appointments. Where the fact or nature of an appointment itself reveals health information, we also rely on the health/social care condition.
4.6 Billing and payment
We use your name, contact and financial details to invoice you (or, where relevant, a third-party payer such as a health insurer or employer) and to receive payment. This is necessary to perform our contract with you or the paying party. Where we need to share case or clinical information with a billing or third-party payer to process payment, we only share what is necessary and rely on the same basis as the underlying service, together with our legitimate interest in being paid for services provided.
4.7 Recovering unpaid fees
If a payment is not made, we may use your identity, contact and financial information to recover the debt, including through a debt collection agency. We rely on our legitimate interest in recovering sums owed to us, having considered whether this is a proportionate way of doing so. Where establishing or pursuing a claim requires us to refer to health information, we additionally rely on the legal claims special category condition.
4.8 Complaints
If you raise a complaint, we use your identity, correspondence and any relevant clinical information to investigate and respond to it. We rely on our legitimate interest in resolving complaints properly (or, where relevant, a legal obligation to have a complaints process), and on the health/social care or legal claims condition where clinical information is involved.
4.9 Patient safety incidents and safeguarding
Where a patient safety incident occurs, or we have a safeguarding concern about you or another person, we use relevant health and safeguarding information to investigate and respond appropriately, including reporting to other agencies where we are required or entitled to do so. We rely on our legitimate interest in protecting patients and others (and, in some cases, a legal obligation), together with the applicable special category condition.
Our safeguarding processing is flagged internally for specific legal/data protection review, given the range of circumstances safeguarding concerns can involve; this section will be refined once that review is complete.
4.10 Service quality and improvement
We may review case information to monitor and improve the quality of our services. Where this involves health information, we rely on the health/social care condition (management of healthcare services) together with our legitimate interest in service improvement.
4.11 Research
If we ever wish to use patient information for research purposes, we will only do so on an appropriate legal basis and special category condition (which may include seeking your specific consent), following a data protection impact assessment, and we will tell you separately before this happens.
4.12 Legal advice, regulatory compliance and other administrative purposes
We may also process personal information — including, occasionally, health information — where necessary to obtain legal advice, to meet a regulatory or governance obligation, or to establish, exercise or defend legal claims relating to our business generally. We rely on our legitimate interest in doing so and/or a legal obligation, together with the legal claims special category condition where health information is involved, and we maintain a legitimate interests assessment where appropriate.
Health information about you is “special category data” under UK GDPR, which means we need to meet an additional legal condition, on top of the legal basis described above, before we can process it. In almost all cases relating to your care, we rely on the condition covering the provision of health or social care and the management of health services (Article 9(2)(h) of UK GDPR, together with the corresponding condition in the Data Protection Act 2018). Where information is occasionally needed in connection with legal claims — for example when recovering unpaid fees or defending a claim against us — we instead (or additionally) rely on the legal claims condition (Article 9(2)(f)). Our separate Medicolegal Privacy Notice explains the position that applies to medicolegal assessments and reports specifically.
We do not rely on your consent as the basis for providing you with ordinary clinical care — agreeing to be treated is not the same thing as “consent” in the data protection sense, and the appropriate basis is instead our contract with you and the health/social care condition described above.
We may ask for your specific consent in narrower circumstances, such as certain marketing communications, optional services, or particular uses of your information where you have a genuine choice and can withdraw that consent at any time without it affecting your care. Where we rely on consent, you can withdraw it at any time by contacting us using the details in section 12.
7. Confidentiality
Having a lawful basis under data protection law is not the only protection that applies to your information. We also owe you duties of confidentiality under the common law, our clinicians’ professional standards (including applicable GMC or equivalent professional body requirements), and our contractual arrangements. Before we disclose confidential clinical information to anyone, we consider both whether we have a data protection basis to do so and whether we are permitted, under our duty of confidentiality, to make that disclosure to that recipient for that purpose.
8. Who we share your information with
We may share your information with:
We only share what is necessary for the purpose in question, and we have contracts in place with our suppliers that require them to protect your information appropriately.
9. International transfers
Heidi, our AI clinical scribe supplier, has confirmed that for UK customers, consultation data is stored in the UK, and that the processing involved in producing transcripts and clinical notes is carried out only on UK or European Economic Area (EEA) infrastructure — it is not carried out on infrastructure outside the UK/EEA for that workflow. Because the UK has an adequacy decision covering EEA countries, no additional transfer safeguard is required for that EEA-based processing. Heidi maintains a public list of its sub-processors at https://trust.heidihealth.com/subprocessors; where a sub-processor operates outside the UK/EEA in connection with other, non-clinical functionality, Heidi relies on the UK International Data Transfer Agreement or the EU Standard Contractual Clauses with the UK Addendum, as appropriate. We reviewed this position with Heidi in August 2026 and will check it again at our next scheduled review of this notice, or sooner if we are notified of a change.
10. How long we keep your information
We keep your information for as long as necessary for the purposes described in this notice, and in line with our Data Retention Policy, which takes account of applicable professional and legal retention requirements (for example, medical records are generally kept for longer than routine administrative correspondence). E.g. adult clinical records: 8 years from last contact.
11. Your rights
Subject to certain exemptions, you have the right to:
We do not use automated decision-making or profiling that produces legal or similarly significant effects about you.
To exercise any of these rights, contact us using the details in section 12. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or 0303 123 1113, although we would welcome the opportunity to address your concern directly first.
12. How to contact us
If you have any questions about this notice or how we use your information, or wish to exercise any of your rights, please contact:
Cairstiona Benson — admin@brainmind.co.uk — 020 3303 0295 — 167-169 Great Portland Street, London, W1W 5PF.
13. Changes to this notice
We may update this notice from time to time, for example when we introduce a new service, system or AI tool, use information for a new purpose, or the law changes. We will publish the current version on our website and update the “last updated” date above. Please check back periodically.