Privacy notice

Plexus Psychiatry is the trading name of GVN Private Ltd, a company registered in England and Wales (number 16179960), registered office C/O Sah Associates, 40 Wakefield Road, Dewsbury, West Yorkshire, WF12 8AT. We provide consultant-led psychiatric assessment and treatment online, and are registered with the Care Quality Commission (CQC).

We are the "controller" of your personal information: we decide how and why it is used, and we are responsible for it under UK data protection law - the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR). We are registered with the Information Commissioner's Office (ICO).

This notice covers patients, the parents and carers of patients under 18, people who give us information about a patient (such as a partner or parent describing someone's childhood), people who enquire or ask us to call them, and visitors to this website and our patient portal.

Our data protection lead is our Registered Manager, Dr Praveen Kumar Gandamaneni. You can contact them at hello@plexuspsychiatry.com, by phone on 07961 489450, or by post to 3 Crawthorne Road, Eastfield, Peterborough, PE1 4AA.

Health information, and information about ethnicity, religion or sexuality, is "special category" data under UK GDPR, and forensic history is "criminal offence" data. The law gives both extra protection, and so do we.

You do not have to give us any information. But we need enough to assess you safely, and some things are a condition of treatment - for example your GP's details before we prescribe, and proof of who you are. If you would rather not give something, tell us and we will explain what it would mean for your care.

• To assess you, reach a diagnosis and agree a treatment plan with you
• To write your assessment report, and letters to your GP and others involved in your care
• To prescribe and monitor medication safely, and to request shared care with your GP
• To book and run your appointments, send your questionnaires, and take payment
• To keep you and others safe, including safeguarding children and adults at risk
• To meet our legal and regulatory duties - to the CQC, the General Medical Council, HMRC and the courts
• To handle complaints, and to defend legal claims
• To check and improve the quality and safety of our care, for example through clinical audit carried out within the clinic
• To answer enquiries and call people back when they ask us to
• To keep our systems and website secure

We do not use your information for marketing, we do not sell it, and we do not use it to make decisions about you by computer alone.

The law only allows us to use personal information where we have a "lawful basis" under Article 6 of UK GDPR - and, for special category data such as health information, a further condition under Article 9 and the Data Protection Act 2018.

Separately from data protection law, doctors have a duty of confidentiality to their patients. We follow the General Medical Council's guidance on confidentiality as well as the law.

Your appointments take place on Microsoft Teams, using a meeting created only for your appointment. Calls are encrypted, and only people we invite can join.

With your agreement, we switch on Teams transcription, which turns what is said into text. Your consultant will ask you at the start of the appointment, and note your answer in your record. If you say no, the appointment goes ahead in exactly the same way and your consultant takes notes instead. You can ask for transcription to be stopped at any point.

The transcript is copied into your clinical record and used to write your report and letters accurately. It becomes part of your record, and is kept as your record is (section 13).

We do not make video or audio recordings of appointments. If you would like to record an appointment yourself, please tell us at the start - it is fine to ask.

Writing a full assessment report takes a consultant several hours. To make that time go further, your consultant may use an AI tool to prepare a first draft. This is how it works:

• The tool is given the transcript of your appointment, your questionnaire answers and the relevant parts of your record, and drafts the report in our standard format.
• It is instructed to use only what was actually said or recorded, and to leave a clear gap rather than guess where something was not covered.
• Your consultant reads the whole draft against the transcript, corrects it, completes it and signs it. Nothing is sent to you or anyone else until they have. The diagnosis and every clinical judgement are theirs.
• The AI makes no decisions about you. It does not diagnose, prescribe or decide anything, and it does not suggest a diagnosis for your consultant to approve.
• Where a report works through diagnostic criteria one by one, the tool sets out what was actually said under each one, and who said it. It does not say whether a criterion is met. Your consultant reads the evidence and writes that judgement themselves.
• The AI model is Claude, provided by Anthropic in the United States. Your information is sent to it securely for each draft. Under Anthropic's commercial terms it is not used to train their models, and Anthropic deletes it within 30 days.

If you would rather your report was written without AI assistance, tell us and your consultant will write it themselves. It will not affect your care.

Questionnaire scores (for example PHQ-9 or GAD-7) are added up automatically and shown to your consultant. Where an answer suggests a risk to your safety, it is flagged to a clinician so it is not missed. Neither is a decision about you; both are there for a clinician to act on.

Your record is kept in our clinical record system, which we run ourselves on a dedicated server with IONOS in the UK or European Union. It is not held by a software company that could access it: the system is built on open-source software that we host, so no supplier has access to your record.

• Everyone who can open records signs in with their own account, and sees only what their role needs.
• Every change to a record is kept in a version history, so it is always clear who changed what, and when.
• All connections are encrypted, and the server is backed up regularly.
• You can see your appointments, questionnaires and messages in our patient portal.

For patients under 18, we usually hold information from and about parents or carers as well as the young person, and often from school, because an assessment for a child depends on it.

Young people aged 16 and 17, and younger children who understand what is involved (sometimes called "Gillick competence"), can make their own decisions about their care and their information. We may speak to a young person on their own. A parent's request to see a child's record is considered with the child's wishes and best interests in mind, and a competent young person can make requests about their own information.

We never share your information with your employer, school or anyone else without your agreement, except as set out in section 10.

Very rarely, the law or our professional duties require us to share information without your agreement, or even against your wishes. Examples are: where there is a serious risk of harm to you or someone else; where a child or an adult at risk needs protecting; where a court orders it; or to prevent or detect a serious crime.

We share only what is necessary, only with those who need it, and - unless it would put someone at risk - we tell you that we have done so.

We use a small number of companies to run our service. They act on our instructions only, under written contracts that require them to keep information secure and confidential and not to use it for their own purposes.

Stripe and Doctify also decide how to use some information for their own purposes, such as preventing fraud, and for that they are responsible under their own privacy notices.

Most of your information stays in the UK or the European Union, which UK law treats as giving equivalent protection. Where information goes to the United States - to Anthropic for AI drafting, and in some cases to Stripe - it is protected by safeguards recognised under UK law, which bind the recipient to UK standards. For Anthropic, that is the UK Addendum to the standard contractual clauses, which forms part of its data processing terms. You can ask us for a copy of the safeguards that apply.

There is no fixed legal period for private health records, so we follow the NHS Records Management Code of Practice, which independent providers use and the General Medical Council expects doctors to follow whether or not they work in the NHS:

When information is no longer needed, it is securely deleted, including from backups as they are replaced. Paper, if there is any, is shredded.

• Every connection to our systems is encrypted.
• Staff sign in with their own individual accounts.
• Access is limited to what each person's role needs, and changes to records are tracked.
• Everyone who works with us is bound by confidentiality, both by contract and by their professional registration.
• We keep our software up to date and our systems patched.
• If something ever goes wrong, we have a procedure to contain it, and we tell the ICO within 72 hours - and you, if you are at risk - where the law requires.

To use any of these rights, use the form in section 17 or contact us at hello@plexuspsychiatry.com. We may ask you to confirm who you are, to protect your information; the one-month time limit starts once we have. Where you have given consent for something, you can withdraw it at any time.

• Contact form and "Talk to us": we use what you send only to reply to you. It reaches us by email through Mailjet (section 11).
• If you came to our website from one of our adverts, a reference to that advert is sent with your enquiry, so we can tell which adverts work. It is not used for anything else.
• The free ADHD and autism questionnaires on this website run entirely in your browser. Your answers are not sent to us or stored anywhere.
• Patient reviews are shown by Doctify, which sees your IP address when they load.
• Our servers keep short security logs, including IP addresses, to protect against attacks.
• This website uses no advertising or analytics cookies. Our cookie statement has the details and lets you change your choices.

You have the right to complain to us about how we use your information. You can use the form below, email hello@plexuspsychiatry.com, phone 07961 489450, or write to us at 3 Crawthorne Road, Eastfield, Peterborough, PE1 4AA. We will acknowledge your complaint within 30 days, look into it, keep you updated, and tell you the outcome. The same form can be used to ask for a copy of your information, or to have it corrected.

If you are not satisfied, you can complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, phone 0303 123 1113, or write to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

Complaints about your care, rather than your information, follow our complaints procedure. Contact us and we will send you a copy.

We review this notice at least once a year, and whenever we change how we use information - for example, a new supplier. The version and date are at the top of the contents. If a change affects you significantly, we will tell you directly.