Our legitimate interests include maintaining accurate clinical records, managing the clinic safely, protecting personal information, improving service quality and responding to complaints or legal claims. We consider whether these interests are proportionate and whether they could unfairly affect you.

​

Information about physical or mental health is special-category personal data. We normally process health information where this is necessary for psychological assessment, diagnosis or the provision or management of healthcare under Article 9(2)(h) UK GDPR and Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018. This processing is carried out by, or under the responsibility of, professionals who are subject to professional or legal duties of confidentiality.

 

In other circumstances, a different special-category condition may apply. For example, where necessary to safeguard a child or an individual at risk, we may rely on Article 9(2)(g) UK GDPR and Schedule 1, Part 2, paragraph 18 of the Data Protection Act 2018. Where information is necessary for legal claims, we may rely on Article 9(2)(f).

 

As a matter of clinical confidentiality, we will normally seek your permission before sharing substantive clinical records with another person or organisation where it is appropriate to do so. This permission to disclose confidential information is distinct from the lawful bases on which we process personal information under data protection law. There are circumstances in which confidential information may lawfully be disclosed without your permission, including where disclosure is necessary for safeguarding, to prevent serious harm, to respond to an emergency, to comply with a legal obligation or court order, or where another overriding legal or public-interest justification applies. We will disclose only information that is necessary and proportionate in the circumstances.

 

You are not generally required by law to provide personal information to us. However, certain identification, contact and assessment information is necessary for us to arrange and provide the service. If necessary information is not provided, we may be unable to offer or complete the service.

​​

4. Clinical confidentiality and sharing

​​

Clinical information is treated as confidential. Access within Everest is limited to people who reasonably need the information to provide or administer the service.

 

This may include:

• Clinicians, associates and authorised administrative staff,

• professionals providing confidential clinical supervision or quality assurance,

• providers supporting clinical records, email, document storage, appointments, questionnaires, psychometric testing, payments, transcription or other technology,

• GPs, schools, universities, employers or other professionals where you have authorised the sharing or there is another lawful reason,

• professional regulators, insurers, accountants or legal advisers and

• safeguarding services, emergency services, courts or public authorities where disclosure is necessary and lawful.

 

Important: We do not sell personal information.

​​

5. Children, parents and collateral informants

​​

Children and young people have rights over their own personal information. Where we collect information directly from a child or young person, we provide privacy and confidentiality information in a form appropriate to their age, maturity, understanding and communication needs. This may include our “Everest Clinic Privacy Notice for Children and Young People” alongside this full Privacy Notice.

 

When deciding whether a parent or another person may access a child’s information, we consider the child’s age, understanding and wishes, whether the requester has parental responsibility or another legal authority, the child’s wellbeing and best interests, safeguarding concerns, information relating to other people and any applicable legal restriction.

 

A person paying for or arranging an assessment does not automatically have an unrestricted right to the assessed person’s clinical record.

Parents, partners, relatives, teachers and other collateral informants may provide information during an assessment. Their name, relationship to the client, observations and questionnaire responses may become part of the clinical record and may be summarised in the assessment report.

 

An informant does not automatically have access to the client’s record. Equally, a client may request access to personal information about them, including information provided by another person. However, this does not necessarily mean that every original statement or document will be disclosed in full. Where information also identifies or relates to another person, we will consider the rights and confidentiality of everyone involved. We may provide the relevant information in an edited or summarised form, or redact or withhold information where permitted by law.

​​

6. Recordings, transcription and artificial intelligence

​​

Everest may use approved recording, transcription or artificial-intelligence tools to support clinical documentation and report preparation.

 

Our current relevant providers are Heidi Health, Plaud, OpenAI and Microsoft. Except where this notice specifically states that consent is used for an optional recording, using a transcription, documentation or artificial-intelligence tool does not change the underlying purpose or lawful basis for processing the clinical information. The lawful bases and special-category conditions described in section 3 continue to apply.

​

Where we make an optional audio or video recording of a session, we will explain the purpose before recording begins and obtain specific consent. For the recording itself, we rely on consent under Article 6(1)(a) UK GDPR and, where the recording contains special-category information, explicit consent under Article 9(2)(a).

 

You may refuse or withdraw consent to an optional recording without this affecting the clinical service available to you. If consent is withdrawn while the recording still exists, we will stop using and securely delete the recording unless there is a separate legal requirement to retain it. Information already lawfully incorporated into the substantive clinical record will continue to be processed under the lawful bases described in section 3.

 

Where the person being recorded is a child or young person, we will explain the proposed recording in a way that reflects their age, maturity, understanding and communication needs. We will take account of their wishes and capacity to understand the recording and, where required, obtain permission from a person with parental responsibility or other legal authority. We will not record a child or young person where doing so would be inappropriate in the circumstances.

 

Any transcript, summary or draft produced using technology is reviewed by the clinician before it is used in a clinical record or report. Diagnostic and clinical decisions are made by qualified clinicians and are not made solely by an automated system.

​​

7. Service providers and international transfers

​​

Everest uses carefully selected service providers to support the delivery and administration of its services. These providers may process information only for the agreed purpose and are required to protect it appropriately.

 

Our main provider categories include clinical-record and document-storage systems, email and communication services, booking and video-consultation platforms, questionnaire and psychometric providers, payment and accounting services, website hosting and security and transcription or clinical-documentation tools.

 

We use external organisations in different legal roles. Where an organisation acts as our data processor, it may process personal information only on our documented instructions and subject to an appropriate data-processing agreement. Some organisations, such as professional advisers, payment providers, insurers or regulators, may act as independent controllers for particular processing and are responsible for complying with their own data-protection obligations.

 

Some of our providers may process personal information, or permit access to it, outside the United Kingdom. Before making a restricted international transfer, we identify and document an appropriate transfer mechanism. Depending on the country and provider, this may include UK adequacy regulations or appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with any additional protections required in the circumstances.

 

You may ask us for further information about the transfer mechanism and safeguards applying to a particular provider by emailing privacy@everestclinic.co.uk.

​

8. How long we keep information

​

We keep information only for as long as it is reasonably needed for clinical, professional, legal, insurance, safeguarding and financial purposes.

​

Where information from a temporary recording or transcript has been checked for accuracy and the clinically relevant information has been incorporated into the substantive clinical record, the temporary recording or transcript will normally be securely deleted within one month, unless there is a lawful reason to retain it for longer. Other source documents, questionnaires, correspondence and clinical notes will be retained or deleted in accordance with our clinical-record retention arrangements and data-minimisation requirements.

 

Substantive clinical records include final clinical and diagnostic reports and other information that forms part of the formal record of the assessment or service provided.

​

Our principal retention periods are:

​