Privacy Policy

Effective date: Nov 2025

Controller: Elixir Medics Ltd, Limited company, The Priory, Start Hill, Thremhall Park, Bishop's Stortford CM22 7WE.

Contact: admin@elixirmedics.co.uk

Data Protection Lead: Dr Sandeep Bansal

Contact and complaints

Privacy contact: admin@elixirmedics.co.uk
You can complain to the Information Commissioner’s Office (ICO) if you’re unhappy with our response.

What this notice covers

This notice explains how Elixir Medics collects and uses your personal data when you enquire about, receive, or pay for our services.

What information we collect

We may collect:

• Your contact details (name, DOB, address, email, phone)
• Information about your health and mental health (e.g., assessments, care plans, session notes, risk information)
• Appointment and correspondence details
• Billing and payment status information
• If you use our website: basic technical/cookie information (see Cookies section)

Why we use your information

We use your information to:

• Provide assessment and treatment
• Arrange and manage appointments
• Communicate with you about your care
• Keep appropriate clinical records
• Manage risk and safeguarding where necessary
• Process payments and maintain financial records
• Meet legal and regulatory obligations

Our legal bases

For general personal data, we rely on lawful bases such as contract, legal obligation, vital interests (emergencies), and legitimate interests (clinic administration).
For health/mental health information (special category data), we generally rely on the health or social care condition for assessment/treatment and management of health services, subject to professional confidentiality safeguards.
In some situations we may ask for your consent (for example, specific non-routine disclosures).

Who we share information with

We only share information when necessary and proportionate, such as:

• With clinicians within Elixir Medics involved in your care
• With your GP or other providers with your consent or where clinically necessary
• With safeguarding agencies, local authority, or police where required by law or necessary to prevent serious harm
• With trusted service providers who support our operations (e.g., practice systems, video consultation, IT, accounting). These providers must protect your data and only use it on our instructions.

How we keep your data safe

We use organisational and technical measures such as restricted access, secure systems, encryption where appropriate, staff training, and secure disposal.

How long we keep your data

We keep your information only as long as necessary. As a baseline, many health/care records are commonly retained for around 8 years after last treatment, with longer retention often applying for children/young people.)
Our current retention schedule is:

• Adult clinical records: [8 years after last contact]
• Children/young people: [until 25th birthday]
• Finance records: [6 years]

Your rights

You have rights including:

• Access to your data (Subject Access Request)
• Correction of inaccurate data
• Restrict/ object in certain circumstances
• Data portability in some cases
• Complaints to the ICO

Breaches

If a breach creates a high risk to your rights and freedoms, we will inform you without undue delay. We also report certain breaches to the ICO within required timeframes.

Cookies (website)

We use cookies/analytics [describe tools: e.g., “Google Analytics” / “privacy-friendly analytics”]. You can manage cookies via [cookie banner / browser settings].
(If you use analytics/ads, add explicit details and a cookie policy.)

Contact and complaints

Privacy contact: info@elixirmedics.co.uk

You can complain to the Information Commissioner’s Office (ICO) if you’re unhappy with our response.