Privacy Notice

1. Who we are

Caledonian Psychiatry is the trading name of Edinburgh Psych Limited, a company registered in Scotland (company number SC761568) with its registered office at Edenbank House, 22 Crossgate, Cupar, Fife, KY15 5HW. We are a private psychiatric practice providing assessment and ongoing care for adults across Scotland.

For the purposes of UK data protection legislation (the UK General Data Protection Regulation and the Data Protection Act 2018), the data controller is:

2. What information we collect

We collect and process the following categories of personal data:

Personal information

• Full name, date of birth, address and contact details
• Emergency contact details
• GP name, practice and contact details
• Proof of identity (verified at the start of each consultation)
• Payment information (processed securely; we do not store card details)

Special category data (health data)

• Psychiatric and medical history
• Current symptoms, mental state examination findings and clinical observations
• Diagnostic assessments and formulations
• Medication history and current prescriptions
• Correspondence from other healthcare providers (e.g. GP letters, previous reports)
• Clinical notes, reports and management plans
• Risk assessments
• Collateral information provided by family members or other informants (with your knowledge)

Technical data

• Information generated through the use of our clinical records system (Semble)
• Secure video consultation connection data (consultations are never video-recorded; audio may be transcribed in real time with your consent, see section 6)

3. How we collect your information

We collect personal information in the following ways:

• Directly from you: when you contact us (including the enquiry form and the repeat-prescription request form on this website, where you provide your name, date of birth and the medication you are requesting so we can match you to your records), complete referral or registration forms, or during clinical consultations
• From your GP or other healthcare providers: with your consent, we may request clinical correspondence, medical records or previous assessment reports
• From informants: with your knowledge, we may gather collateral history from family members or other individuals relevant to your assessment
• From our clinical systems: data generated during the course of your care, including clinical notes and prescriptions

4. Why we process your information and our lawful bases

We process your personal data for the purposes set out below. For each purpose, we rely on one or more lawful bases under Articles 6 and 9 of the UK GDPR.

Because we process special category data (health data), we must also satisfy a condition under Article 9. For clinical care, our Article 9 condition is that processing is necessary for the provision of health care (Article 9(2)(h)), supplemented by Schedule 1, Part 1, Paragraph 2 of the Data Protection Act 2018.

Purpose	Lawful basis (Article 6)	Special category condition (Article 9)
Providing psychiatric assessment, diagnosis and treatment	Legitimate interests; consent	Provision of health care (Art. 9(2)(h))
Prescribing medication and issuing prescriptions to pharmacies	Legitimate interests; legal obligation	Provision of health care (Art. 9(2)(h))
Sharing clinical reports and correspondence with your GP	Consent; legitimate interests	Provision of health care (Art. 9(2)(h))
Maintaining accurate and complete clinical records	Legal obligation; legitimate interests	Provision of health care (Art. 9(2)(h))
Processing payments and financial administration	Performance of a contract; legitimate interests	N/A (not special category data)
Responding to enquiries and managing appointments	Consent; legitimate interests	N/A (unless health data involved)
Complying with regulatory requirements (e.g. Healthcare Improvement Scotland)	Legal obligation	Provision of health care (Art. 9(2)(h))
Protecting vital interests in an emergency (e.g. safeguarding, risk to life)	Vital interests	Vital interests (Art. 9(2)(c))

Where we rely on consent as a lawful basis, you have the right to withdraw consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

Where we rely on legitimate interests, our legitimate interest is the provision of safe, effective and person-centred psychiatric care. We have assessed that this does not override your rights and freedoms.

5. Who we share your information with

We may share your personal data with the following parties, and only to the extent necessary:

With your consent

• Your GP: clinical reports, diagnostic outcomes, medication recommendations and management plans are shared with your registered GP, with your consent. This is standard clinical practice and supports continuity of care.
• Other healthcare professionals: where relevant to your care and with your agreement, we may share information with other clinicians involved in your treatment.
• Family members or carers: only with your explicit consent.

Without your consent (where legally required or justified)

• Pharmacies: prescription information is sent to pharmacies to dispense your medication. This is a necessary part of treatment.
• Healthcare Improvement Scotland: as our regulatory body, HIS may require access to clinical records during inspections or investigations. This is a legal obligation.
• Courts or law enforcement: if required by law, court order or where necessary to protect vital interests.
• Safeguarding agencies: if there is a serious risk of harm to you or to others, we may be obliged to share information with relevant authorities. We will inform you of this where it is safe and appropriate to do so.

Service providers

• Semble: our clinical records management system, which stores your medical records securely. Semble acts as a data processor on our behalf and is contractually bound to protect your data.
• Secure video platform: consultations are conducted via secure, encrypted video. No video recordings are made.
• Heidi Health: clinical transcription. With your consent, consultation audio is transcribed in real time to help produce accurate notes; the audio is not stored. Data is processed under UK data-residency arrangements.
• Payment processors: payment transactions are handled by secure third-party payment providers. We do not store your card details, and payment providers receive only the details needed to process the transaction. They never have access to your clinical records.
• Royal Mail: where medication is prescribed, controlled prescriptions are sent to you by Royal Mail Tracked 24, so that delivery is timely and any delay can be identified and followed up; non-controlled prescriptions are sent by standard post, unless they are posted together with a controlled prescription. Arranging tracked delivery requires us to enter your name, delivery address and mobile number into Royal Mail’s own postal platform, which processes these details in order to produce and track your item and, for your convenience, to send you the tracking number by SMS so that you can follow its progress. Royal Mail receives no medical or clinical information at any point: only the delivery details described above.
• Cloudflare: our website is hosted and protected by Cloudflare, which also provides the spam-protection check (Turnstile) on our website forms and our cookie-free visitor statistics. Cloudflare processes technical connection data (such as IP addresses) to deliver and secure the site. Information you type into our website forms passes through Cloudflare’s systems solely so that it can be delivered to us; Cloudflare acts as a data processor in doing so, does not use or retain the content of your submissions for its own purposes, and has no access to your clinical records.
• Resend: when you submit the enquiry form or the repeat-prescription request form on this website, your submission is delivered to our practice mailbox by Resend, an email delivery provider acting as a data processor on our behalf.
• Plausible Analytics: we use Plausible, a privacy-first, EU-hosted website analytics service, to measure how our website is used (see section 7). Plausible uses no cookies, stores no persistent identifiers and does not track visitors across other websites; visit data is aggregated and cannot be used to identify you. Plausible has no access to anything you submit through our forms and no access to clinical records.

We do not sell, rent or otherwise commercially share your personal data with any third party. We do not use your data for marketing purposes.

6. How we store and protect your information

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it.

• Clinical records are stored in Semble, a cloud-based clinical records system with encryption at rest and in transit, role-based access controls and regular security auditing.
• Video consultations are conducted using secure, encrypted platforms and are never video-recorded. With your consent, your psychiatrist uses a clinical transcription assistant (Heidi) during consultations: it transcribes the audio in real time to help produce accurate notes, and the audio itself is not stored. The notes form part of your clinical record in the usual way. If you would rather it was not used, just say so: your consultation goes ahead exactly as normal without it.
• Access to personal data is restricted to Dr David Crocker and authorised administrative staff, on a need-to-know basis.
• Electronic devices used in clinical care are protected with full-disk encryption, strong passwords and up-to-date security software.
• Physical records, where they exist, are stored securely with restricted access.

7. Our website: cookies, analytics and forms

This website does not use advertising, analytics or any other tracking cookies. Our security and hosting provider (Cloudflare) may set strictly necessary security cookies in limited circumstances (for example, during a bot-mitigation check); these are exempt from consent requirements and are not used to track you.

• Visitor statistics: we measure website traffic using Plausible Analytics, a privacy-first, EU-hosted analytics service that uses no cookies, no persistent identifiers and no cross-site tracking, and does not build profiles of individual visitors. It tells us, in aggregate, which pages are visited and which steps of the booking journey are completed, so that we can improve the website and our services. Our hosting provider, Cloudflare, also gives us aggregate cookie-free traffic statistics.
• Hosting and security: the website is served and protected by Cloudflare. Like any web host, Cloudflare processes technical connection data (such as your IP address and browser information) to deliver pages and defend against malicious traffic.
• Form spam protection: our enquiry and repeat-prescription forms use Cloudflare Turnstile to distinguish people from automated bots. Turnstile does not use cookies.
• Form delivery: information you submit through our website forms is sent to our practice mailbox by Resend, an email delivery provider acting as our data processor (see section 5).
• Fonts and assets: all fonts and images are served from our own domain, and viewing this website does not send your data to third-party font or advertising networks. The only third-party script loaded is the Plausible Analytics measurement script described above.

8. How long we keep your information

We retain clinical records in accordance with NHS Scotland records management guidance and professional obligations.

• Adult clinical records: retained for a minimum of 10 years from the date of last contact, or longer if clinically or legally necessary.
• Records involving controlled drugs prescribing: retained in accordance with relevant regulatory requirements.
• Financial records: retained for a minimum of 6 years in accordance with HMRC requirements.
• Enquiry and correspondence records: if you contact us but do not become a patient, your enquiry is moved to a secure archive after around 6 months, whatever it contains, and is not used for any other purpose. We archive these records rather than deleting them because enquiries to a psychiatric practice are often clinical in nature (describing symptoms, or asking whether our service is suitable), and professional standards may require us to show what was and was not advised. You have the right to ask us to delete your information at any time: contact admin@caledonianpsychiatry.co.uk and we will delete everything we can. Where an exchange contains clinical information we will usually need to keep that record, and if so we will tell you what we have kept and why. If you become a patient, your enquiry is not archived: it forms part of your clinical record.

At the end of the applicable retention period, records are securely deleted or destroyed in accordance with data protection law.

There is no need to include detailed medical history when first contacting us: that is best kept for your consultation. You can ask us to delete your enquiry at any time; if we need to keep part of it, we will explain why.

9. Your rights

Under UK data protection law, you have the following rights in relation to your personal data:

• Right of access: you have the right to request a copy of the personal data we hold about you (a subject access request). We will respond within one month.
• Right to rectification: you have the right to ask us to correct any inaccurate or incomplete personal data.
• Right to erasure: you have the right to ask us to delete your personal data in certain circumstances. Please note that we may be required to retain clinical records for the minimum retention period outlined above, even if you request erasure.
• Right to restriction of processing: you have the right to ask us to restrict how we use your data in certain circumstances.
• Right to data portability: you have the right to request that we transfer your data to another provider in a structured, commonly used, machine-readable format, where technically feasible.
• Right to object: you have the right to object to our processing of your personal data where we rely on legitimate interests as the lawful basis.
• Rights related to automated decision-making: we do not use automated decision-making or profiling in our clinical practice.

To exercise any of these rights, please contact us using the details provided at the top of this notice. We may need to verify your identity before processing your request.

10. Children and young people

Caledonian Psychiatry provides services to adults aged 18 and over only, and our website and booking system are not intended for children. If someone under 18 (or a parent or carer on their behalf) contacts us, we will explain that we cannot offer care and, where we can, point them towards suitable services. We do not keep such enquiries for longer than we need to, and the same approach described in section 8 applies: where an enquiry includes clinical information or our reply includes advice, we keep a record of that exchange in line with professional standards. Our safeguarding responsibilities may also mean we need to keep or act on information rather than delete it.

11. International data transfers

Your personal data is primarily stored and processed within the United Kingdom. Where any of our service providers process data outside the UK, we ensure that appropriate safeguards are in place, such as adequacy decisions or standard contractual clauses approved by the Information Commissioner’s Office.

12. Changes to this privacy notice

We may update this privacy notice from time to time to reflect changes in our practices, legal requirements or regulatory guidance. The date of the most recent update is shown at the top of this page. We encourage you to review this notice periodically.

Where changes are significant, we will make reasonable efforts to notify you directly (for example, by email if you are an existing patient).

13. How to make a complaint

If you are unhappy with how we have handled your personal data, we encourage you to contact us first so that we can try to resolve the matter:

If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

14. Regulatory oversight

Caledonian Psychiatry is regulated by Healthcare Improvement Scotland (HIS) as an independent healthcare provider. HIS may require access to personal data, including clinical records, as part of its regulatory and inspection functions. This processing is carried out under legal obligation.

All clinical care is delivered in accordance with the Health and Social Care Standards and the Healthcare Improvement Scotland Quality Framework.

You also have the right to raise concerns about any aspect of the service you have received (including how your personal information is handled in the course of your care) directly with Healthcare Improvement Scotland at any time. You do not need to complete our internal complaints process first, and you do not need to raise the matter with us beforehand.