Privacy policy
Last updated: October 6, 2026
Introduction
At Hay Neurodevelopmental Service, we are committed to protecting your privacy and ensuring that your personal data is
handled securely and in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act
2018. This policy explains how we collect, use, store, and protect your personal data and outlines your rights regarding your
information.
At Hay Neurodevelopmental Service, we are committed to protecting your privacy and ensuring that your personal data is
handled securely and in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act
2018. This policy explains how we collect, use, store, and protect your personal data and outlines your rights regarding your
information.
What Information We Collect
• We may collect the following types of personal data:
• Personal details: Name, date of birth, contact information (address, email, phone number).
• Health-related data: Medical history, diagnostic results, treatment records, prescriptions, referrals, and notes from
consultations.
• Payment details: Information for processing payments (if applicable).
• Communication records: Emails, appointment reminders, or feedback provided by you.
This data includes special category data under UK GDPR, specifically health information.
• We may collect the following types of personal data:
• Personal details: Name, date of birth, contact information (address, email, phone number).
• Health-related data: Medical history, diagnostic results, treatment records, prescriptions, referrals, and notes from
consultations.
• Payment details: Information for processing payments (if applicable).
• Communication records: Emails, appointment reminders, or feedback provided by you.
This data includes special category data under UK GDPR, specifically health information.
Lawful Basis for Processing
• We process your data under the following lawful bases as defined by the UK GDPR.
• Article 6(1)(b): Processing is necessary for the performance of a contract with you (e.g., providing healthcare services).
• Article 6(1)(c): Processing is necessary for compliance with a legal obligation (e.g., maintaining accurate medical
records).
• Article 6(1)(f): Processing is necessary for our legitimate interests (e.g., managing our business).
• Article 9(2)(h): Processing of special category data is necessary for the provision of health or social care.
• We process your data under the following lawful bases as defined by the UK GDPR.
• Article 6(1)(b): Processing is necessary for the performance of a contract with you (e.g., providing healthcare services).
• Article 6(1)(c): Processing is necessary for compliance with a legal obligation (e.g., maintaining accurate medical
records).
• Article 6(1)(f): Processing is necessary for our legitimate interests (e.g., managing our business).
• Article 9(2)(h): Processing of special category data is necessary for the provision of health or social care.
How We Use Your Information
We use your data to:
• Schedule and manage appointments.
• Provide appropriate medical care and treatment.
• Communicate with you regarding your care, including appointment reminders.
• Process payments and issue invoices (if applicable).
• Maintain accurate medical records for continuity of care.
We use your data to:
• Schedule and manage appointments.
• Provide appropriate medical care and treatment.
• Communicate with you regarding your care, including appointment reminders.
• Process payments and issue invoices (if applicable).
• Maintain accurate medical records for continuity of care.
5. Data Storage & Security
• Your data is stored securely in compliance with UK GDPR guidelines. We implement appropriate technical and
organisational measures to prevent unauthorised access, loss, or misuse of your information.
• Electronic records are stored in secure, encrypted systems with access controls.
• Paper records (where used) are kept in locked, access-controlled locations
• Data retention: Records are retained for a minimum of 8 years after the last treatment (or longer if required by law) and
securely deleted when no longer needed
• We have procedures in place for data breaches, including notification to the ICO within 72 hours when required.
6. Sharing of Information
• We do not share your data with third parties without your explicit consent, except in the following circumstances:
• When required by law or regulatory bodies.
• When necessary for your treatment (e.g., referrals to specialists, communication with your GP).
• If you have provided consent to share information with insurers or third-party healthcare providers.
• All third parties are vetted for GDPR compliance, and data-sharing agreements are in place
• We will never sell your data to third parties.
7. Your Rights
Under UK GDPR, you have the following rights regarding your data:
• Access: Request a copy of the personal data we hold about you.
• Correction: Request corrections to inaccurate or incomplete data.
• Deletion: Request that we delete your personal data, subject to legal and professional record-keeping obligations.
• Restriction: Ask us to restrict the processing of your data in certain circumstances.
• Objection: Object to us processing your data for specific purposes.
• Data portability: Request that we transfer your data to another provider where applicable.
• Complaints: Lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data rights have
been violated.
To exercise your rights, please contact us at drhay@haynds.co.uk
8. Contact Information
If you have any questions or concerns about this Privacy & Data Protection Policy, or if you wish to make a data request, please
contact:
Hay Neurodevelopmental Service
Data Protection Officer : Dr Rosie Hay
Drhay@haynds.co.uk
9. Updates to This Policy
We may update this policy from time to time to reflect changes in legal requirements or our practices. We encourage you to
review it periodically.