Mind Right Limited (“Mind Right”, “we”, “us” or “our”) provides psychological rehabilitation and mental health services. Mind Right is a member of the handl Group.
Registered office: Matrix Park, Chorley, Lancashire, United Kingdom, PR7 7NA
Company number: 12880185 ICO registration number: ZA849540
Website: www.mindright.co.uk
Questions, information-rights requests and data protection complaints can be sent to Mind Right’s Data Protection Officer:
Email: jamie.robinson@mindright.co.uk
Post: Data Protection Officer, Mind Right Limited, Speed Medical House, Matrix Park, Chorley, Lancashire, PR7 7NA
For most processing described in this notice, Mind Right is the controller. This means Mind Right decides why and how personal information is used, for example when operating the website, managing enquiries and business relationships, carrying out marketing, handling complaints, maintaining security and meeting its own legal or professional obligations.
For some referral services, Mind Right may act as a processor on behalf of the organisation that instructed it. Where this applies, the instructing organisation is responsible for the main privacy information and for deciding how individuals’ rights are handled. Mind Right processes the relevant information under that organisation’s documented instructions and may still act as controller for its own legal, professional, security and clinical-governance obligations.
|
Clinical information: Please do not send detailed medical or clinical records through a general website contact form unless Mind Right has asked you to do so and has provided an approved secure route. Clinical and treatment information is subject to additional confidentiality safeguards and the Clinical Privacy Notice. |
In this notice, “Data Protection Legislation” means the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Data (Use and Access) Act 2025, the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), and any other applicable UK privacy legislation, in each case as amended or replaced from time to time.
Depending on how you interact with Mind Right, the information used may include:
Mind Right may receive personal information:
Mind Right only uses personal information where it has a lawful basis. Where special-category information is used, Mind Right also identifies an additional condition under Article 9 UK GDPR and, where required, Schedule 1 to the Data Protection Act 2018.
To respond to questions, arrange consultations, assess whether Mind Right can provide a service, receive and triage referrals, and communicate with the person or organisation making the enquiry.
Main lawful bases: taking steps at your request before entering into a contract; performance of a contract; legitimate interests in responding to enquiries and developing services. Where health information is involved, conditions may include health or social care, legal claims or explicit consent, depending on the circumstances.
To arrange, coordinate and quality-manage psychological rehabilitation, communicate with relevant stakeholders, administer appointments and reports, and manage contractual relationships.
Main lawful bases: performance of a contract; legitimate interests in delivering and managing services; legal obligations. Special-category conditions may include health or social care and legal claims. Where Mind Right acts as processor, the relevant controller determines the lawful basis and provides instructions.
To maintain appropriate clinical standards, protect individuals, investigate concerns, handle complaints, learn from incidents and defend or establish legal rights.
Main lawful bases: legal obligations; legitimate interests in quality, safety, accountability and the defence of claims. Special-category conditions may include health or social care, safeguarding and legal claims.
To manage customers, referrers, clinicians, suppliers and professional contacts; maintain records; carry out due diligence; administer contracts; process invoices; and obtain professional advice.
Main lawful bases: performance of a contract; legal obligations; legitimate interests in running Mind Right effectively and managing business relationships.
To operate and protect the website and systems, diagnose faults, prevent misuse, understand website performance and improve content and user experience.
Main lawful bases: legitimate interests in providing a secure and effective website; consent where required for non-essential cookies or similar technologies. Strictly necessary technologies are used as permitted by law.
To send relevant information about Mind Right’s services, events and developments, maintain marketing preferences and measure engagement.
Main lawful bases: consent or legitimate interests, as permitted by UK GDPR and PECR. You can object to direct marketing or unsubscribe at any time.
To comply with law, respond to regulators or law-enforcement bodies, protect confidential information, detect fraud or misuse, manage risks and establish, exercise or defend legal claims.
Main lawful bases: legal obligations and legitimate interests in protecting Mind Right, individuals and third parties. Special-category conditions may include legal claims and substantial public-interest conditions where applicable.
To assess enquiries and applications from prospective employees, workers, contractors and clinicians, carry out proportionate checks and communicate about opportunities.
Main lawful bases: taking steps before entering into a contract; legitimate interests in recruitment and maintaining a suitable professional network; legal obligations. A separate recruitment privacy notice may also apply.
Where Mind Right relies on legitimate interests, it considers whether the processing is necessary and balances those interests against the rights and reasonable expectations of the people concerned. Relevant interests include operating and improving services, managing professional and commercial relationships, maintaining clinical and information-security standards, protecting systems and confidential information, preventing fraud, and establishing or defending legal rights.
Health information and other special-category data receive additional protection. Mind Right limits access to people who need the information for their role, applies clinical confidentiality and data-minimisation principles, and only shares the information where there is a lawful and appropriate reason. Clinicians and relevant healthcare professionals remain subject to their own professional confidentiality duties.
Mind Right may share information, where necessary and lawful, with:
Mind Right does not sell personal information. Service providers acting as processors are required to use information only for the agreed services and to apply appropriate security and confidentiality controls.
Personal information is primarily processed in the United Kingdom. Some approved service providers may process or make support access available from outside the UK. Where a restricted transfer takes place, Mind Right uses a lawful transfer mechanism, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another permitted safeguard or exception. You can contact the Data Protection Officer for more information about the safeguards used.
Mind Right keeps personal information only for as long as it is needed for the purpose for which it was collected, including legal, clinical, regulatory, accounting, security and claims requirements. The following periods are typical and may be extended where a legal hold, complaint, safeguarding matter, investigation or claim requires it:
|
Record type |
Typical retention approach |
|
General enquiries and correspondence |
Normally up to two years after the last meaningful contact, unless the enquiry develops into a service, contract, complaint or claim. |
|
Customer, supplier and business records |
Usually for the relationship and up to six years afterwards, reflecting contractual, accounting and legal-claims periods. |
|
Marketing records |
Until you opt out or the information is no longer relevant. A minimal suppression record may be retained to ensure the opt-out is respected. |
|
Website and cookie information |
For the period stated in the Cookie Policy or consent tool, subject to the settings of the approved service used and any security need. |
|
Data protection requests and complaints |
Usually for six years after closure, so Mind Right can evidence how the matter was handled. |
|
Recruitment information |
Normally up to six months after an unsuccessful application, unless a longer talent-pool period is agreed or records are required for a claim. |
|
Visitor and CCTV records |
Normally for a short period, generally no more than 30 days, unless an incident or investigation requires longer retention. |
|
Referral and clinical records |
In accordance with the relevant controller’s instructions, Mind Right’s clinical and records-retention requirements, and the separate Clinical Privacy Notice. |
Mind Right uses proportionate technical and organisational measures designed to protect personal information against accidental loss, unauthorised access, alteration, disclosure or destruction. These include access controls, staff confidentiality and training, secure systems and suppliers, incident-management procedures, and risk-based review of security controls. Access is limited to people who need the information for an authorised purpose.
No internet transmission or system can be guaranteed to be completely secure. Where a personal data breach creates a legal notification obligation, Mind Right will notify the appropriate regulator and affected individuals as required.
Depending on the circumstances, you may have the right to:
These rights are not absolute and may not apply in every case. Mind Right may need reasonable information to confirm your identity and understand the request. Requests are normally free of charge and will be answered without undue delay, usually within one month. The response period may be extended by up to two further months for a complex request or multiple requests; Mind Right will explain any extension.
Where Mind Right is acting only as a processor, it will normally pass the request to the relevant controller and support that controller in responding.
You can make a data protection complaint using the Data Protection Officer contact details in section 2. Mind Right will provide a clear route for complaints, acknowledge receipt within 30 days, make appropriate enquiries, keep you informed where necessary and communicate the outcome without undue delay.
You also have the right to complain to the Information Commissioner’s Office (ICO): www.ico.org.uk/make-a-complaint
ICO postal address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
ICO telephone: 0303 123 1113
Mind Right would welcome the opportunity to consider your concern first, but this does not affect your right to contact the ICO.
The website uses cookies and similar technologies. Essential technologies are used where necessary to operate and secure the website. Other technologies are used only where permitted by law and, where required, after you have made a choice through the website’s consent tool. The current Cookie Policy should identify the technologies used, their purposes, providers and duration. View the Mind Right Cookie Policy
The general website is primarily intended for adults and professional or business users. Where a referral concerns a child or young person, information should be provided by an authorised adult or professional through an approved route. Mind Right applies additional safeguards and takes the needs of children into account where it provides an online service likely to be used by them.
Mind Right does not currently use personal information covered by this notice to make decisions about people solely by automated means where the decision produces legal or similarly significant effects. If this changes, Mind Right will provide appropriate information about the logic involved, the likely consequences and the safeguards available.
Mind Right may update this notice to reflect changes in law, guidance, services, technology or business arrangements. The current version will be published on the website with its effective date. Where a change is material and Mind Right has an appropriate way to contact you, additional notice may be provided.
Please tell Mind Right if your contact details or other relevant personal information changes so that records can be kept accurate and current.
