PRIVACY POLICY

 

NeuroRehab North East is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

  1. Who We Are

NeuroRehab North East is an independent practice providing specialist neuropsychology and neurorehabilitation services, including clinical assessment, treatment, and medico-legal reporting. Our registered practice details are as follows:

Trading name: NeuroRehab North East

Email: info@NRNE.co.uk 

Website: www.NRNE.co.uk

Telephone: (0191) 6408995

ICO registration number: ZC110313

Professional registration: All our clinicians are registered with the required statutory professional bodies.

For the purposes of UK GDPR, NeuroRehab North East is the Data Controller in respect of personal data collected via this website and in the course of providing clinical, therapeutic, and medico-legal services.

  1. What Data We Collect

Depending on the nature of your involvement with us (patient, referrer, instructing solicitor, or website visitor), we may collect and process the following categories of personal data.

The following outlines the main categories of data we collect; however, this list is not exhaustive. Additional information may be required where necessary to deliver our clinical, neurorehabilitation, or medico‑legal services:

From patients/clients:

  • Name, date of birth, address, and contact details.
  • NHS number (where applicable) and GP details.
  • Health and clinical information, including medical history, neurological, psychiatric, and psychological history, cognitive assessment results, neuroimaging and other clinical reports, medication, and disability-related information.
  • Information about family circumstances, education, and occupation relevant to assessment or rehabilitation.
  • Details of accidents, injuries, or incidents where assessment relates to litigation
  • Audio or video recordings of assessment sessions, where used for scoring, supervision, or clinical record purposes.
  • Emergency contact and next of kin details.
  • Appointment, attendance, and billing information.

From referrers, instructing solicitors, and third parties:

  • Name, job title, and professional contact details.
  • Referral letters, instructions, and case-related correspondence, which may include third-party information (e.g. about a patient, claimant, or litigant).

From all website visitors:

  • Technical data such as IP address, browser type, and usage data collected via cookies.

Health and clinical information described above constitutes special category data under UK GDPR. We handle this data with particular care and under strict confidentiality obligations, in line with HCPC Standards of Conduct, Performance and Ethics, the BPS Code of Ethics and Conduct, and Caldicott principles on the use of confidential patient information.

  1. How We Use Your Personal Data

We use personal data for the following purposes:

  • To assess, plan, and deliver neuropsychological services and neurorehabilitation.
  • To communicate with patients, referrers, and other professionals involved in a patient’s care
  • To prepare clinical and medico-legal reports for the purpose instructed
  • To fulfil our contractual, professional, and legal obligations
  • To maintain accurate clinical records
  • To safeguard patients and, where necessary, other individuals from harm
  • To respond to general enquiries and administer our services
  • To improve the functionality and content of this website

  1. Lawful Basis for Processing

General personal data is processed on the following lawful bases under Article 6 UK GDPR:

  • Contract: Where processing is necessary to perform a contract with you (or your instructing party) or take steps prior to entering into a contract
  • Legitimate interests: Where processing is necessary for our legitimate business interests, provided these are not overridden by your rights
  • Legal obligation: Where we are required to process data to comply with a legal, regulatory, or professional requirement
  • Consent: Where you have provided consent, for example by submitting an enquiry via this website

Special category (health) data is processed on the following bases under Article 9 UK GDPR and Schedule 1 of the Data Protection Act 2018:

  • Health or social care purposes (Article 9(2)(h)): Processing necessary for the provision of health care or treatment, undertaken by, or under the responsibility of, a health professional subject to a duty of confidentiality
  • Legal claims (Article 9(2)(f)): Where processing is necessary for the establishment, exercise, or defence of legal claims, including medico-legal assessment and reporting
  • Explicit consent (Article 9(2)(a)): Where required, for example for recording of sessions
  • Substantial public interest conditions, where applicable (e.g. safeguarding of children or vulnerable adults).

We use Pearson’s Q-interactive platform to administer, score and report on psychological assessments. Where personal data is processed through Q-interactive, we act as the data controller and Pearson acts as our data processor. We ensure that such processing is carried out in accordance with the UK General Data Protection Regulation (UK GDPR) and applicable data protection law, including having an appropriate lawful basis for processing and ensuring that appropriate contractual, technical and organisational safeguards are in place. Pearson processes personal data on our instructions and provides appropriate security measures in accordance with its data protection and privacy arrangements. Further information regarding Pearson’s Privacy Practices for Q-global & Q-interactive, can be found here. 

  1. Data Retention

We retain personal data only for as long as is necessary for the purposes for which it was collected, or as required by professional, regulatory, or legal obligations. As a general guide:

  • Adult clinical records are retained for a minimum of 8 years following the conclusion of treatment or discharge, in line with Department of Health and professional retention guidance
  • Records relating to children and young people are retained until the patient’s 25th birthday (or 26th if they were 17 at the conclusion of treatment), or for 8 years after the last contact, whichever is longer
  • Medico-legal reports and associated case files are retained in line with instructing solicitors’ requirements and relevant limitation periods, and in any event for a minimum of 8 years
  • Referrer and general correspondence data is retained for up to two years following the conclusion of any instruction
  • Website usage data is retained in accordance with our Cookie Policy

Where records are subject to a legal hold, ongoing litigation, or a specific professional indemnity requirement, we will retain them for as long as necessary to meet that requirement.

  1. Data Security

We take appropriate technical and organisational measures to protect personal data against accidental loss, destruction, alteration, unauthorised disclosure, or access. Clinical records are held on secure, access-controlled systems, and access is restricted to those directly involved in a patient’s care or file administration. Any use of cloud-based clinical record systems or transcription services is governed by data processing agreements requiring an equivalent standard of protection. Where any service provider stores data outside the UK, we ensure appropriate safeguards are in place, such as the UK’s International Data Transfer Addendum or an adequacy decision.

We do not routinely transfer personal data outside the UK. Where international transfers occur through third‑party processors (e.g., cloud storage providers), we ensure appropriate safeguards such as the UK International Data Transfer Addendum or an adequacy decision.

  1. Sharing Your Data

We do not sell, rent, or trade personal data. We may share data in the following circumstances:

  • With your GP or other treating clinicians, where relevant to your care and with appropriate consent or clinical justification.
  • With instructing solicitors, case managers, insurers, or other parties as directed by the terms of a referral or instruction.
  • With other members of a multidisciplinary team involved in rehabilitation, where appropriate and, where practicable, with consent.
  • With third-party service providers who process data on our behalf (e.g. secure cloud storage, transcription, or IT support), under data processing agreements.
  • With regulatory or professional bodies (e.g. HCPC, BPS) for the purposes of audit, supervision, or complaints, generally in anonymised or pseudonymised form where possible.
  • Where required by law, court order, safeguarding duty, or regulatory authority, including where there is a serious risk of harm to you or others.

  1. Children and Vulnerable Adults

Where we assess or treat adults who lack capacity, personal data is processed in accordance with the same principles set out in this policy, with consent or authority obtained from a parent, guardian, or person with appropriate legal authority where required. Our duty of confidentiality may, in limited circumstances, be overridden by a safeguarding duty to protect from harm, in accordance with relevant safeguarding legislation and guidance.

  1. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

  • The right to be informed about how your data is used,
  • The right of access to your personal data,
  • The right to rectification of inaccurate data,
  • The right to erasure (“the right to be forgotten”) in certain circumstances,
  • The right to restrict processing,
  • The right to data portability,
  • The right to object to processing,
  • The right to complain to us directly about how we have handled your personal data (see below).

Please note that some of these rights are subject to specific exemptions where they apply to health records. For example, access to health data may, in limited circumstances, be reviewed by an appropriate health professional before release, where disclosure could cause serious harm to the physical or mental health of the patient or another person.

To exercise any of these rights, please contact us at info@NRNE.co.uk. We will respond within one calendar month.

Right to Complain to NeuroRehab North East: If you believe that we have infringed your rights under UK data protection law, you have the right to complain to us directly in the first instance. You may do so by emailing info@NRNE.co.uk with details of your concern. We will acknowledge your complaint within 30 days of receipt, investigate the matter, and respond without undue delay, keeping you informed of progress and outcome throughout.

This does not affect your right to complain to the Information Commissioner’s Office (ICO) at any time, whether before, during, or after raising a complaint with us. You also have the right to lodge a complaint with the ICO at ico.org.uk or by telephone on 0303 123 1113. You may also raise concerns about our professional conduct with the HCPC or BPS.

  1. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal or similarly significant effects on you.

  1. Changes to This Policy

We may update this Privacy Policy from time to time. The date of the most recent revision will be shown at the top of this page. We encourage you to review this policy periodically.

  1. Contact Us

If you have any questions regarding this Privacy Policy or our data practices, please contact us at Info@NRNE.co.uk

 

Last updated: September 2026