Privacy Policy

We may collect and process the following categories of personal data:

Information you provide directly:

• Your name and contact details (email address, phone number)
• Information submitted through our booking or contact forms
• Medical and mental health history relevant to your consultation
• Any other information you choose to share with us during the booking process or consultations

Information collected through calendar integration:

• Calendar availability data obtained via Google Calendar API or Microsoft Graph API when you connect your calendar for appointment scheduling
• OAuth authentication tokens used to access your calendar on your behalf

Information collected automatically:

• Technical data such as your IP address, browser type, and operating system
• Usage data about how you navigate and interact with our website
• Cookie data (see the Cookies section below)

We use your personal data for the following purposes:

• To manage and confirm your appointment bookings
• To provide psychiatric consultations and related healthcare services
• To synchronise appointment schedules with your calendar via Google Calendar or Microsoft Outlook/365
• To communicate with you about your appointments, including reminders and follow-ups
• To respond to your enquiries and provide support
• To comply with our legal and regulatory obligations as a healthcare provider
• To improve our website and the services we offer

Under the UK General Data Protection Regulation (UK GDPR), we process your personal data on the following legal bases:

• Consent: Where you have given us clear consent to process your personal data for a specific purpose, such as connecting your calendar for appointment scheduling or providing health-related information through our booking forms
• Legitimate interests: Where processing is necessary for our legitimate interests in operating our practice and providing healthcare services, provided these interests do not override your fundamental rights and freedoms
• Legal obligation: Where we are required to process your data to comply with a legal obligation, such as maintaining clinical records as required by healthcare regulations
• Vital interests: In rare cases, where processing is necessary to protect your vital interests or those of another person

For special category data (such as health information), we process this data on the basis of your explicit consent and/or because it is necessary for the provision of healthcare services.

We use the following third-party services to operate our practice and website:

• Supabase: We use Supabase as our secure database platform to store booking information and related data. Supabase provides encryption at rest and in transit to protect your information
• Google Calendar API: If you or the practitioner uses Google Calendar, appointment details may be synced via the Google Calendar API. This is governed by Google's Privacy Policy
• Microsoft Graph API: If you or the practitioner uses Microsoft Outlook/365, appointment details may be synced via the Microsoft Graph API. This is governed by Microsoft's Privacy Statement

We only share the minimum data necessary with these services to fulfil the purposes described in this statement.

When you or the practitioner connects a Google or Microsoft calendar account to our booking system, we store OAuth authentication tokens securely. These tokens:

• Are stored securely in our database with appropriate encryption
• Are used solely for the purpose of reading calendar availability and creating appointment events
• Can be revoked at any time by disconnecting your calendar from our system or revoking access through your Google or Microsoft account settings
• Are never shared with any other parties beyond the relevant calendar service provider

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including:

• Clinical records: Retained in accordance with NHS and professional regulatory body guidelines, which typically require healthcare records to be kept for a minimum period after the last contact
• Booking and contact data: Retained for as long as you remain an active client, and for a reasonable period afterwards to handle any follow-up enquiries
• OAuth tokens: Retained only while the calendar integration is active. Tokens are deleted when the integration is disconnected

When your data is no longer required, it will be securely deleted or anonymised.

Under the UK GDPR, you have the following rights regarding your personal data:

• Right of access: You can request a copy of the personal data we hold about you
• Right to rectification: You can ask us to correct any inaccurate or incomplete data
• Right to erasure: You can ask us to delete your personal data in certain circumstances
• Right to restrict processing: You can ask us to limit how we use your data
• Right to data portability: You can request your data in a structured, commonly used format
• Right to object: You can object to our processing of your data where we rely on legitimate interests
• Right to withdraw consent: Where we process data based on your consent, you can withdraw that consent at any time

To exercise any of these rights, please contact us at info@yourmentalwellbeing.co.uk.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data protection rights have been breached. You can contact the ICO at ico.org.uk.

Our website uses cookies to improve your browsing experience. Cookies are small text files stored on your device when you visit a website.

We use the following types of cookies:

• Essential cookies: Required for the website to function properly, such as session management and security
• Functional cookies: Help us remember your preferences and provide enhanced features
• Analytics cookies: Help us understand how visitors use our website so we can improve it

You can manage your cookie preferences through your browser settings. Please note that disabling certain cookies may affect the functionality of our website.

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:

• Business name: Your Mental Wellbeing
• Website: yourmentalwellbeing.co.uk
• Email: info@yourmentalwellbeing.co.uk

We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. Any changes will be posted on this page with an updated revision date.

We encourage you to review this page periodically to stay informed about how we protect your information.