top of page
Enquire

Privacy Notice

1. Who we are

​

JM Mental Health is a trading name of Atrom Mindcare Services Ltd (company number 10838475, formerly JM Mental Health Ltd). Atrom Mindcare Services Ltd is the controller of the personal information described in this notice. That means it decides how and why your information is used. It holds our registrations with the Information Commissioner’s Office (ICO) and the Care Quality Commission (CQC).

 

Atrom Mindcare Services Ltd provides consultant psychiatrist-led mental health care under two trading names:

  • JM Mental Health: clinic at 39A Regent Street, Leamington Spa, Warwickshire, CV32 5EE. We see adults, children and young people privately.

  • Atrom Mindcare: clinic at The Civic Building, 323 High Street, Epping, CM16 4BZ, and online appointments. We see adults, children and young people privately, and adults funded by the NHS through Right to Choose.

 

This notice explains what information we hold about you, why we hold it, who we share it with, how long we keep it and what rights you have. It applies to anyone who enquires with us, has appointments with us or receives care from us under the JM Mental Health name. That’s whether you pay for your care yourself or it’s funded by a medical insurer. It has been written in line with the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003.

 

Our details:

  • Controller: Atrom Mindcare Services Ltd, registered in England and Wales

  • Company number: 10838475

  • Former company name: JM Mental Health Ltd

  • Trading names: Atrom Mindcare; JM Mental Health

  • Registered office: 572-574 Romford Road, London, E12 5AF (not for patient post)

  • Postal address for patients: 39A Regent Street, Leamington Spa, Warwickshire, CV32 5EE

  • Atrom Mindcare clinic: The Civic Building (Regus), 323 High Street, Epping, CM16 4BZ, and online

  • JM Mental Health clinic: 39A Regent Street, Leamington Spa, Warwickshire, CV32 5EE

  • ICO registration number: ZA295571

  • CQC provider ID: 1-5443394642

 

This notice covers patients seen under the JM Mental Health name, including children and young people. Patients of Atrom Mindcare should read the Atrom Mindcare privacy notice, which is published on its website.

 

2. Our Data Protection Officer

 

We have appointed a Data Protection Officer (DPO) to oversee how we handle personal information. The DPO is also a point of contact for patients and the ICO.

You can contact our DPO directly about anything in this notice, including how to use your rights or make a complaint.

 

3. Information we collect

 

We collect only the information we need to arrange and provide your care and to run our service.

  • Identity and contact details: name, date of birth, address, email, telephone number, NHS number (to identify you accurately when we write to your GP) and emergency contact or next of kin.

  • Health and care information: referral information, medical and mental health history, assessment questionnaires and scores, consultation notes, diagnoses, treatment plans, prescriptions, reports and correspondence. This is special category data and we protect it accordingly.

  • Other sensitive information: where relevant to your care, information about your ethnicity, sexuality, religion or beliefs, or involvement with the criminal justice system. We only record this where it’s clinically relevant or you choose to tell us.

  • Insurance and payment details: insurer name, policy and authorisation numbers, invoices and payment records. Card payments are handled by our payment provider, and we don’t store full card numbers.

  • Enquiry and appointment information: what you tell us when you enquire, your appointment history and your communication preferences, and login details if you use an online patient account.

  • Call and video information: Video consultations aren’t recorded.

  • Website information: IP address, device and browser information, and cookie data (see section 13).

 

Information about other people. Some assessments, particularly for ADHD and autism, involve questionnaires or interviews with a family member, partner or someone who knew you as a child. We hold the information they provide as part of your clinical record, along with their name and relationship to you. If you’re asked to act as an informant, this notice also explains how we use your information.

 

4. Where we get your information from

 

Most information comes directly from you. We may also receive information from:

  • your GP or another health professional who refers you to us

  • your medical insurer, when it authorises or funds your treatment

  • previous healthcare providers, when you ask them to send us your records

  • family members, partners or others who provide informant information for your assessment

  • your employer or occupational health service, if they refer you with your agreement

  • a solicitor or court, where we’re instructed to provide a report with your agreement

 

5. How we use your information and our lawful bases

 

The law requires us to have a lawful basis under Article 6 of the UK GDPR for each use of personal information. For health and other special category data, we also need a condition under Article 9 and, where needed, Schedule 1 of the Data Protection Act 2018. We don’t rely on consent for your care itself, because we have professional and legal duties to keep accurate clinical records.

 

Here is each purpose, with its Article 6 basis and, where needed, its Article 9 condition.

  • Assessment, diagnosis, treatment, prescribing and follow-up

    • Article 6: 6(1)(b), contract with you

    • Article 9: 9(2)(h), health care, with DPA 2018 Schedule 1 Part 1 paragraph 2

  • Arranging appointments, reminders and service communications

    • Article 6: 6(1)(b), contract with you

    • Article 9: 9(2)(h), health care

  • Invoicing, payments and accounting records

    • Article 6: 6(1)(b), contract; 6(1)(c), legal obligation (tax law)

    • Article 9: not normally needed

  • Arranging funding and sending reports to your medical insurer

    • Article 6: 6(1)(b), contract with you

    • Article 9: 9(2)(a), explicit consent, given through your insurer’s authorisation or our consent form

  • Using information from family or other informants in your assessment

    • Article 6: 6(1)(f), legitimate interests (an accurate and complete assessment)

    • Article 9: 9(2)(h), health care

  • Meeting regulatory duties (for example CQC, GMC, controlled drugs record keeping)

    • Article 6: 6(1)(c), legal obligation

    • Article 9: 9(2)(h), health care; 9(2)(i), public health, with Schedule 1 Part 1 paragraphs 2 and 3

  • Safeguarding children and adults at risk

    • Article 6: 6(1)(c), legal obligation, or 6(1)(f), legitimate interests

    • Article 9: 9(2)(g), substantial public interest, with Schedule 1 Part 2 paragraph 18

  • Clinical audit, quality improvement, incident and complaint handling

    • Article 6: 6(1)(f), legitimate interests

    • Article 9: 9(2)(h), health care

  • Establishing, exercising or defending legal claims

    • Article 6: 6(1)(f), legitimate interests

    • Article 9: 9(2)(f), legal claims

  • Newsletters and information about new services

    • Article 6: 6(1)(a), consent

    • Article 9: not used

  • Non-essential website cookies

    • Article 6: 6(1)(a), consent

    • Article 9: not used

 

Our legitimate interests. Where we rely on legitimate interests, these are: carrying out complete and clinically safe assessments; monitoring and improving the quality and safety of our care; handling complaints and incidents properly; protecting our patients, staff and service; and defending legal claims. We have assessed that these interests don’t override your rights. You can ask us for details of that assessment.

 

Do you have to give us your information? You don’t have to. But we can’t safely assess or treat you without your relevant health information and contact details. Your insurer may also not fund your care if you don’t agree to us sharing reports with it.

 

6. Confidentiality

 

As well as data protection law, everyone who works for us is bound by a duty of confidentiality and by professional codes, including GMC guidance on confidentiality. We’ll share your information for your direct care in ways you would reasonably expect, such as writing to your GP.

 

We’ll only share confidential information for other purposes if you agree, or where the law requires or permits it. Examples include a court order, a statutory duty to report, or where sharing is needed to prevent serious harm to you or someone else, including safeguarding concerns.

 

Your GP. We’ll normally send your GP a summary of your assessment and any treatment we start, because your GP holds your main medical record and needs to know about any medicines you take. Some treatments, such as ADHD medication under a shared care agreement, can’t continue without your GP’s involvement. If you don’t want us to contact your GP, please tell us before your first appointment so we can discuss what this means for your care.

 

7. Who we share your information with

 

We share only what’s necessary for the purpose, and we never sell your information.

 

Organisations involved in your care or funding:

  • your GP and other health professionals involved in your care, including whoever referred you

  • pharmacies, to dispense your prescriptions

  • your medical insurer, when it’s funding your care, limited to what it needs to authorise and pay for treatment

  • other providers, if you’re referred on or transfer your care, with your knowledge

  • your child’s school, only if you’ve agreed to this

 

Regulators and public bodies:

  • the Care Quality Commission, General Medical Council and other professional regulators, when they inspect us or investigate

  • safeguarding services, the police or the courts, where the law requires it or someone is at risk of serious harm (see section 6)

 

Our main suppliers (processors). These companies process information only on our instructions, under written contracts that require confidentiality and security. For a complete list, please contact us.

  • Cliniko: clinical records, appointment scheduling and online appointments

  • Microsoft 365: email and documents

  • Webex: clinic telephone system

  • Stripe: card payments

  • Wix.com: website hosting and online enquiry forms

  • The Geek Guys: IT support and security

  • Heidi Healthcare: AI transcription to help write consultation notes

​

National data opt-out. The national data opt-out lets you stop your confidential health information being used for research and planning. We don’t currently share confidential patient information for these purposes. We check this regularly and record it in our Record of Processing Activities. You can find out more at https://www.nhs.uk/your-nhs-data-matters/.

​

8. Technology, AI and automated decisions

 

No decision about your diagnosis, treatment or eligibility for our services is made solely by automated means. A person always makes clinical decisions, and a consultant psychiatrist confirms every diagnosis.

 

With your agreement, we may use Heidi Healthcare to help write up consultation notes. The professional who saw you reviews and approves every note. Audio is deleted after 30 days. You can ask us not to use it.

 

9. International transfers

 

We store your information in the UK. Some of our suppliers may process limited information outside the UK, for example to provide or support their service. Where this happens, we make sure the transfer is protected by UK adequacy regulations, for example for the European Economic Area or the UK-US data bridge, or by the ICO’s International Data Transfer Agreement or Addendum. You can ask our DPO for more information about these safeguards.

 

10. Children and young people

 

When we care for a child or young person, we usually work with the people who have parental responsibility. Young people who are able to understand their care can make their own decisions about it, including who sees their information. This is often from around age 12, and in law from 16. We’ll listen to their views about what we share with parents or carers, unless sharing is needed to keep them or someone else safe.

 

A young person who understands their rights can make a request for their own information. A parent can request information about their child where this is in the child’s best interests.

 

11. How long we keep your information, and how we protect it

 

We follow the retention periods in the Records Management Code of Practice for Health and Social Care, which is the recognised standard for health records in England. We also follow our own Records Management, Retention and Secure Disposal Policy.

  • Adult mental health records: 20 years after your last contact with us, or 8 years after death if sooner

  • Records of children and young people: until their 25th birthday, or their 26th if they were 17 when treatment ended

  • Invoices and payment records: 6 years after the end of the financial year (tax law)

  • Enquiries that don’t lead to an appointment: 12 months

  • Complaint files: 10 years after closure, as set out in the Code of Practice

 

At the end of the retention period, we securely delete or destroy the information, or anonymise it so it no longer identifies you.

 

Security. We protect your information with measures that include:

  • encryption in transit and at rest

  • role-based access, so staff see only what they need

  • multi-factor authentication

  • staff confidentiality agreements and annual data protection training

  • regular audit of who has accessed records

 

We complete the NHS Data Security and Protection Toolkit each year. If a personal data breach is likely to put you at high risk, we’ll tell you without undue delay.

 

12. Your rights and how to complain

 

You have the following rights. You don’t usually need to pay a fee. We’ll respond within one month, which can be extended by up to two further months for complex or numerous requests (we’ll tell you if so).

  • Access: to receive a copy of the information we hold about you. Some information may be withheld, for example where it could cause serious harm or identifies someone else who hasn’t agreed to its release.

  • Rectification: to have inaccurate information corrected. Where a clinical opinion is disputed, we may add your comments to the record rather than change it.

  • Erasure: to have information deleted in certain circumstances. This rarely applies to clinical records, which we must keep for the periods in section 11.

  • Restriction: to ask us to limit how we use your information while a concern is looked into.

  • Objection: to object to uses based on our legitimate interests. You can object to direct marketing at any time and we’ll stop.

  • Portability: to receive information you gave us in a portable format, where we rely on contract or consent and process it electronically.

  • Withdraw consent: where we rely on your consent, you can withdraw it at any time. This doesn’t affect anything we did before you withdrew it.

 

To use any of these rights, contact our DPO. We may ask for proof of identity, and for written authority if someone is acting on your behalf.

 

Complaints about how we use your information. You have the right to complain to us if you think we haven’t handled your personal information in line with data protection law. You can complain by email to our DPO (see section 2), by post to 39A Regent Street, Leamington Spa, CV32 5EE, or by telephone on 01926 803804. You don’t need to use any particular wording. We’ll acknowledge your complaint within 30 days, investigate it without undue delay and tell you the outcome.

 

You can also complain to the Information Commissioner’s Office:

  • Website: ico.org.uk/make-a-complaint

  • Telephone: 0303 123 1113

  • Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

 

The ICO normally expects you to raise your complaint with us first.

 

13. Cookies

 

Our website, www.jmmentalhealth.co.uk, uses cookies. Strictly necessary cookies are set because the site can’t work without them.

 

All other cookies are set only if you agree through our cookie banner. You can change your choice at any time using the cookie settings link at the bottom of every page.

  • Strictly necessary cookies: for security, page loading and remembering your cookie choice. These are set without consent.

  • Functional cookies: for remembering your preferences and settings. These are only set with your consent.

  • Analytics cookies: for understanding how visitors use the site, so we can improve it. These are only set with your consent.

 

We don’t use tracking pixels or advertising tools on pages where you send us an enquiry or give health information. You can also block or delete cookies through your browser settings.

 

14. Changes to this notice

 

We review this notice at least once a year and when our services or suppliers change. The latest version is always on this page. If we make significant changes, we’ll tell patients directly.

 

15. Contact us

​

  • Post: Atrom Mindcare Services Ltd, 39A Regent Street, Leamington Spa, Warwickshire, CV32 5EE

  • Registered office (not for patient post): 572-574 Romford Road, London, E12 5AF

  • Email: contact@atrommindcare.com

  • Telephone: 01926 803804

  • Data Protection Officer: Richard Newell, Your-DPO Ltd, atrommindcare.dpo@nhs.net 

 

Version 2.0 · Effective 22/10/2026 · Next review 21/10/2027

bottom of page