Dementech Neurosciences

Dementech Privacy Notice

This notice explains how Dementech Limited (trading as Dementech Neurosciences) collects, uses, shares and protects personal information about patients, their families and carers, clinical trial participants, staff and website visitors. Version 2.0, replacing the November 2019 notice. 

Who we are 

Dementech Limited is the data controller for the personal information described in this notice. 

• Registered office and clinic: Lister House, 11-12 Wimpole Street, London W1G 9ST 

• Company number: 10367905 

• ICO registration number: ZA273216 

• CQC location ID: 1-4250705069 (regulated activities: diagnostic and screening procedures; treatment of disease, disorder or injury) 

• Telephone: 0203 848 4500 

• Email: [email protected] 

We are registered with the Care Quality Commission and provide specialist neurology, psychiatry, psychology and cardiology services. We see both adults and children, privately and on behalf of the NHS, and we also conduct clinical trials as a research site for pharmaceutical and academic sponsors. 

Data Protection Officer: Anca Florescu, Practice Manager – [email protected] 

Caldicott Guardian (responsible for protecting the confidentiality of patient information): Dr Lucio D’Anna, Lead Specialist 

Senior Information Risk Owner: Mathieu du Boscq de Beaumont, General Manager 

Information we collect 

Patients. Name, date of birth, address, contact details, NHS number, GP details, next of kin, emergency contacts, and – because we provide healthcare – information about your health: symptoms, medical history, medication, test results, assessments, diagnoses, treatment and correspondence about your care. For some conditions we may hold information about family history, lifestyle, education or employment where it is relevant to your assessment. 

Parents, carers and family members. Contact details and, where you are involved in a patient’s care, information you give us about the patient. For children we also record who holds parental responsibility. 

People who pay for care. Billing and payment details, and insurer membership details where an insurer is paying. Card details are handled by our payment provider and are not stored by us. 

Clinical trial participants. The information set out in the participant information sheet and consent form for the study you join. Trial data is held under a study number rather than your name wherever possible. 

Staff, contractors and applicants. Recruitment, employment, professional registration, DBS, training, payroll and absence records. Staff receive a separate staff privacy notice. 

Website visitors and enquirers. Name, email, phone number and the content of any enquiry you send us, plus the technical data described under Website and cookies. 

We collect this information from you, from the person referring you (for example your GP or an NHS service), from other organisations involved in your care, and from the tests and assessments we carry out. 

Why we use your information and our lawful basis 

UK GDPR requires us to have a lawful basis for using personal information, and an additional condition for using health information. 

Purpose	Lawful basis (Article 6)	Condition for health data (Article 9)
Assessing, diagnosing and treating you	Contract (private patients); public task (NHS-commissioned care)	Provision of health care, Art 9(2)(h), under a duty of confidentiality
Managing appointments and communicating with you	Contract; public task	Provision of health care, Art 9(2)(h)
Writing to your GP and other clinicians involved in your care	Contract; public task; legal obligation	Provision of health care, Art 9(2)(h)
Invoicing, payment and insurer claims	Contract; legal obligation (tax and accounting law)	Provision of health care, Art 9(2)(h), where a diagnosis appears on an invoice
Safeguarding children and adults at risk	Legal obligation; public task	Substantial public interest – safeguarding, DPA 2018 Schedule 1
Reporting to regulators (CQC, MHRA) and responding to complaints	Legal obligation; legitimate interests	Legal claims and regulatory purposes, Art 9(2)(f) and (g)
Clinical audit and service improvement	Legitimate interests; public task	Management of health care systems, Art 9(2)(h)
Clinical research and trials	Your explicit consent to take part; public task	Explicit consent, Art 9(2)(a); research, Art 9(2)(j)
Responding to website and telephone enquiries	Legitimate interests	Provision of health care, where you tell us about your health
Employing staff	Contract; legal obligation	Employment law, Art 9(2)(b)

We do not use your information for marketing without asking you first, and we do not sell personal information. We do not make decisions about your care using automated decision-making. Where clinicians use software tools to help draft letters or reports, a clinician reviews and approves every document. 

Who we share information with 

We share information only where it is needed for your care, where the law requires it, or where you have agreed. 

• Your GP – we write to your GP after assessments and when treatment changes, so that your NHS record is complete and prescribing can be shared safely. Tell us if you do not want us to, and we will explain any risks of not doing so. 

• Other clinicians and services involved in your care – for example a referring NHS service, hospitals, pharmacies, laboratories (such as The Doctors Laboratory for blood tests) and therapists, where you have been referred to or by them. 

• NHS organisations – where the NHS has commissioned your care, we share information with the commissioning Integrated Care Board and NHS England as required by the contract, including anonymised activity and outcome data. 

• Insurers and other payers – the information needed to confirm cover and process a claim, where an insurer is paying for your care. 

• Our suppliers (data processors) – companies that provide our clinical record system (Jelly Software Ltd), email and document storage (Google Workspace), NHSmail, payment processing, IT support, confidential waste disposal and professional advisers. They act on our instructions under written contracts and cannot use your information for their own purposes. 

• Regulators and authorities – the Care Quality Commission, the General Medical Council and other professional regulators, the Medicines and Healthcare products Regulatory Agency, HM Revenue and Customs, the police and courts, where the law requires or permits it. 

• Safeguarding – local authority safeguarding teams where we have concerns about the safety of a child or an adult at risk. We will tell you unless doing so would put someone at risk. 

• Research sponsors – for clinical trials, the study sponsor, its contract research organisation, ethics committees and regulators, as described in the participant information sheet. We share identifiable information only where the study consent covers it. 

We do not routinely transfer personal information outside the UK. Some suppliers (for example our website enquiry system) may process limited contact details outside the UK; where they do, we rely on UK adequacy regulations or the International Data Transfer Agreement and standard contractual clauses. 

If the NHS has referred you to us 

When we provide care on behalf of the NHS, we act under an NHS contract and your information is handled in the same way as it would be in any NHS service. 

• We receive your referral through the NHS e-Referral Service or directly from the referring service, and we return assessment reports and discharge summaries to your GP and the referrer. 

• We use your NHS number to make sure your records are correctly matched, and we may look up your details on the NHS Personal Demographics Service. 

• We share activity, waiting-time and outcome data with the commissioning Integrated Care Board and NHS England. Wherever possible this is anonymised or pseudonymised. 

• We follow the NHS Records Management Code of Practice for how long we keep your records. 

• You can opt out of your confidential patient information being used for research and planning through the NHS National Data Opt-out. We respect your choice. 

• Our compliance with NHS data security standards is published each year on the NHS Data Security and Protection Toolkit. 

Children and young people 

We see children and young people for neurology, neurodevelopmental and mental health assessments. 

• For a child under 16, a person with parental responsibility normally consents to care and can access the child’s records. We will ask for evidence of parental responsibility where it is unclear, and we will not share information with a parent where the law or the child’s welfare prevents it. 

• A young person of any age who has enough understanding to make a decision about their own care (sometimes called Gillick competence) can consent to treatment and can ask us to keep information confidential from their parents. We will discuss this with the young person. 

• Young people aged 16 and 17 are presumed able to consent to their own treatment. 

• Where it helps a child’s education, and with the consent of a person with parental responsibility, we may share assessment reports with the child’s school, local authority or an Education, Health and Care needs assessment. 

• We keep children’s records until their 25th birthday, or their 26th birthday if they were 17 when treatment ended. 

This notice is written for adults. If you are a young person and would like help understanding it, please ask your clinician or contact us. 

How long we keep your information 

We keep records for as long as the NHS Records Management Code of Practice and other laws require, then securely delete or destroy them. 

Type of record	How long we keep it
Adult patient records	8 years after last contact (20 years for mental health records)
Children’s records	Until the child’s 25th birthday
Clinical trial records	25 years after the trial ends
Financial records	6 years plus the current year
Staff records	6 years after employment ends

If you ask us to delete information before these periods end, we will explain whether we can, as we usually have a legal duty to keep health records. 

How we keep your information safe 

• Your clinical record is held in a secure, cloud-based clinical system (JellyPx) with named user accounts, role-based access and a full audit trail of who has viewed or changed your record. 

• We are paperless: documents you give us are scanned into your record and the paper is destroyed as confidential waste. 

• Email with NHS organisations is sent through NHSmail. Other email and documents are held in Google Workspace with two-step verification. 

• All staff sign confidentiality agreements, complete annual data security training and are subject to professional codes of conduct. 

• We complete the NHS Data Security and Protection Toolkit every year and are registered with the Information Commissioner’s Office. 

• We have procedures for reporting and investigating any data security incident, and we will tell you and the ICO if an incident is likely to affect your rights. 

Your rights 

You have the right to: 

• Access a copy of the information we hold about you (a subject access request). 

• Correct information that is inaccurate or incomplete. Clinical opinions cannot be changed, but you can ask for your disagreement to be recorded. 

• Delete information in some circumstances. This rarely applies to health records, which we must keep by law, but we will always consider your request. 

• Restrict or object to how we use your information, including asking us not to share your record with a particular person or organisation. 

• Receive information you gave us in a portable electronic format, where we rely on contract or consent. 

• Withdraw consent at any time where we rely on it, for example for research or marketing. 

• Complain to the Information Commissioner’s Office. 

To exercise any of these rights, contact our Data Protection Officer using the details at the end of this notice. We do not charge a fee. We will respond within one month, and we will ask you to confirm your identity before releasing information. If you are asking on behalf of someone else, we will need their written authority or evidence of your legal right to act for them. 

Website and cookies 

When you visit dementech.com our systems record technical information such as your IP address, browser type and the pages you view. We use essential cookies to make the site work and, with your consent, analytics cookies to understand how it is used. You can manage cookies through the banner on our site or your browser settings. Enquiries sent through our website forms are held in our enquiry management system for 12 months unless you become a patient. 

Questions, complaints and changes 

If you have a question or concern about how we use your information, please contact us first and we will do our best to resolve it. 

• Data Protection Officer: Anca Florescu, Dementech Limited, Lister House, 11-12 Wimpole Street, London W1G 9ST – [email protected] – 0203 848 4500 

You also have the right to complain to the Information Commissioner’s Office: ico.org.uk, 0303 123 1113, or Wycliffe House, Water Lane, Wilmslow SK9 5AF. 

We review this notice at least once a year and whenever our services change. The date at the top shows when it was last updated. Significant changes will be highlighted on our website and in clinic. 

Version 2.0 – approved by the Senior Information Risk Owner, 26 October 2026. Supersedes version 1.0 (November 2019).