General Privacy Policy





This Fair Processing Privacy Notice explains how The Retreat York collects, uses, stores and shares personal data and how we maintain patient confidentiality when a patient is referred or treated at the centre.  

 1. Who Are We

 We are a private mental health provider that provides services in:

  • Autism and ADHD (adults and children)
  • Eating disorders
  • Therapy
  • PTSK and Trauma
  • Children Services

 2. Registration

 The Retreat York is a company registered in England and Wales. Our company number is 4325622.

For the purposes of this notice, The Retreat York is the data controller for all information it creates and receives. We are registered with the Information Commissioner’s Office (ICO) at:

 Our Registration Number is Z6470446.

  1. How we Collect information

To enable The Retreat York to provide a service to you we first need to collect information from you to diagnosis your situation. This is done through a number of ways:

  • When we interact with you directly face to face during our registration and consultation activities or when you are enquiring about a job or volunteer placement. We may also contact you by post, email or any other medium which is considered confidential;
  • When you interact with us through third parties;
  • When you interact with us over the phone or through our website. Our website collects general information on website pages you visit most often and the information you are most interested in. More information on this is listed below in the ‘Web Cookies Section’ below
  1. Why We Collect Information

We collect information from you to enable us to deliver a high-quality care and treatment service to you. This is because as we form a relationship with you it is important that we have a complete picture of your history and can do assessments to develop plans to improve care and treatment. Collecting information about you:

  •  Helps our staff (i.e. support workers, nurses, doctors, psychiatrists, psychologists and any other necessary professional required) to make informed and appropriate decisions and to ensure continuity of care across teams when making referrals and assessments to treat you;
  • To ensure the treatment provided to you is safe and effective;
  • To help us work effectively with other organisations who may be involved in your care;
  • To safeguard vulnerable children and adults who may be at risk of harm or where an incident has occurred and needs to be tracked;
  • To inform our professional bodies and commissioning bodies of the treatment and services we are providing to you (all data reports will be anonymised and will only show performance and progress updates by the Patient Group Service and Safety);
  • For research and audit purposes. (This will be in an anonymised format only where approval has not been sought from you);
  • To help us to plan our services for the centre (especially if we ask you to complete surveys/questionnaires about yourself);
  • To keep track of any volunteer arrangements that may be in place.

 5.What Data We Collect

 The data we collect includes:

  •  Personal information (, address, date of birth, GP details);
  • Contact information (email address, telephone/mobile number);
  • Health condition and status data (e.g. medical records/medical history and diagnostic and observational data);
  • Details of appointment with practitioners (i.e. dates and times);
  • Next of kin details and emergency contact details (this will be family members or those you define as your next of kin);
  • Referrals and assessment letters;
  • Details regarding medication and prescription records;
  • Exemption details if you do not pay NHS prescriptions;
  • Transaction and bank details;
  • Photographs and videos;
  • Consents to treatment.

 All medical information collected is classed as special category data and will be treated with the utmost care.


  1. Lawful Basis for Collecting Data

 The legal basis relied on to process your data is based on a need to fulfil a contract requirement with you as per Article 6(1)(b) (the processing is necessary for a contract) and Article 9(2)(a) (explicit consent) and 9(2)(h) (special category data) where the processing is necessary for the provision of health or social care treatment or ‘pursuant to contract with a health professional. This is because you have placed a request with us to provide a service to you.   

 Where information is required for us to pursue our legal obligations the legal purpose for processing the data will be Article 6(1)(c) (processing is necessary for a legal obligation) and Article 9(2)(b) (the processing is necessary for exercising specific rights as a data controller for sensitive data).

 However, we may also have ‘legitimate interests’ as a business to pursue which help us to achieve our vision and work arrangements for example employment arrangements, research analytics, improving services, complaints, legal claims etc. Where we process your information for a ‘legitimate interest ‘we will always make sure that your rights and freedoms are taken into account and will not process any information where an imbalance or privacy issue exists.

 Any other uses of data will be explained at the point of collection and will apply to all relevant statutory provisions.

  1. Who We Share Data With

We will never share any personal information with any third parties unless we have your explicit consent to do so. Organisations that we primarily share information with include:                

  • GPs and Health Care Professionals associated with your referral, assessment or treatment
  • Social and welfare organisations
  • NHS England Commissioning Teams (CCGs)
  • Suppliers and Providers (Private and Public) involved in your care
  • Other Healthcare Organisations

 Subject to stricter requirements data may be shared where there are exceptional circumstances and where we are required to share to comply with the law. These include:

  •  Local Authorities / Social Services
  • Education Establishments
  • Voluntary Providers
  • The Police

 This may be in respect of:

  •  To the extent that we are required to do so by law;
  • In connection with any legal proceedings or prospective legal proceedings;
  • A Court Order which is served upon us (if not challenged);
  • To prevent and detect crime, disorder and/or fraud;
  • Where it is required for ‘substantial public interest’;
  • To protect vulnerable children and adults;
  • For a life or death matter;
  • Where there is a risk of harm to another individual(s);
  • For health and safety purposes e.g. infectious diseases such as meningitis, measles etc.


  1. Research

 Research plays a pivotal role in the development of Health and Medical Care Services. At The Retreat York, we are very proactive in research studies and will always ask you for your explicit consent and advice before directly entering you into any medical trials as participant unless legislation permits otherwise. This reflects our true aims and values as an organisation.


  1. Text Reminders and Marketing

The Retreat does not participate in any direct marketing. However, we may send you text messages to remind you of your appointment if you have formally agreed to this beforehand. You can opt out of this service at any time. Please contact your clinician to update your choices asap so that we can ensure that we are sending you the right communication through the right format.


  1. Data Subject Legal Rights

 Under (UK GDPR), all patients and staff have certain legal rights in respect of their data. These include:

  •  A Right to Access to Information (Article 15): (Also known as a Data Subject Access Request (DSAR). If you want to find out what information is held about you then you can either submit a written Data Subject Access Request verbally or in writing to your Administration Lead. To ensure there is no confusion, we ask that you put in this writing to avoid any delays. All SARs are free and will be responded to within 30 days (i.e. 1 month) from the date we receive your request). Where the cost to produce your request is excessive a reasonable administrative charge may be requested to cover any disbursement costs. All costs will be advised upfront, where this applies. Please advise if you want to receive your information either physically or electronically and we will try to accommodate your request, where possible. Please note all requests for access to medical records will be processed under the Access to Health Records Act 1990.


  • A Right to Rectification (Article 16): You can request information to be rectified or updated about you where personal data is found to be inaccurate, incomplete or out of date.


  • A Right to Erasure (Article 17): (Also known as a ‘Right to be Forgotten’ (RTBF)). You can request data to be erased about you where it is no longer necessary for The Retreat York to retain your data, or where you have withdrawn consent or where there is no legal basis for us to keep the information. However, please note it is our policy not to delete data whilst you are still in our care or where the retention period in relation to our Corporate Retention Schedule has not been reached. All records are managed in accordance with the Records Management Code of Practice – Oct 2020.


  • A Right to Restriction (Article 18): You have a right to request your data be restricted where you have objected to, it is considered incorrect, the processing is regarded as unlawful or you have asked us to erase it.  However, such a request must be reasonable for us to consider it.


  • A Right to Data Portability (Article 20): You have the right to ask us to transfer your data to another service provider where we hold your data in a structured, common electronic format and where it is easily transferrable.


  • A Right to Object (Article 21): You have a right to object to how your data is processed where we are relying on a legitimate interest (or those of a third party) or where you consider your information is being misused. With all objections we will consider any legitimate reasons and will contact you formally with an outcome once we have finalised our decision. No personal information is used for direct marketing purposes without your consent upfront.


  • A Right to not be Subjected to Automated Decision Making, including Profiling (Article 22): You have the right not to be subjected to any automated decisions that may create legal effects or which may have a similar significant impact on you unless you have consented to it, it is necessary for the performance of a contract or it is otherwise permitted by law. Currently no automated decision is undertaken at The Retreat York.


  • A Right to Withdraw Consent: You have a right to withdraw your consent to any processing at any time where we have sought your explicit consent to do so. Simply contact us to make any relevant changes.


  • The Right to Make a Complaint: If you are unhappy about how your data has or is being processed or handled then you a right to make a complaint to the Information Commissioner’s Office (ICO).


All data subject right queries will be handled within 30 days (i.e. 1 month) of receiving such a request.


  1. Employment Data

All personal data submitted for employment and administration purposes i.e. applying for a job role at The Retreat York will be processed on the basis of  Article 9(2)(b) (i.e. the processing is necessary for the Performance of a Contract) of the UK General Data Protection Regulations 2016 (GDPR). If we do not offer you a role then your data will be kept for 6 months before it is securely destroyed onsite. Any other use of your data will be explained to you at the point of collection in respect of any other relevant statutory provisions.   

  1. CCTV Images

The Retreat York has surveillance cameras onsite to monitor the security and safety of the estate as well as our staff and patients. The Retreat York has CCTV surveillance provision across its estate which is maintained by our outsourced security provider SWAT. All CCTV footage is retained for 30 days.

 13. Retention of Data

All data held by The Retreat York is retained in respect of our Corporate Retention Schedule.


  1. a) Non-accepted or withdrawn referrals: These are retained for a period of 2 years from the date of the initial referral pr withdrawal.


  1. b) Medical Files and Assessments: All patient data will be retained for a period of 20 years from the date of your discharge from the centre.


  1. Security of Personal Information

As a business we take the protection of personal data very seriously. Appropriate technical and organisational measures have been implemented to protect people’s personal data from unauthorised access, abuse, loss, theft, alteration and misuse. All data is stored on secure servers and cloud-based solutions which have encrypted back up data measures in place. All data uses SSL encryption for data to be encrypted at rest and transfer. Access to data is protected through role based access controls, authorised personnel, password management tools, data encryption and two factor authentications, where practical.  

 Information that is collected by The Retreat York may be stored (including back ups) and processed and transferred between any of the countries in the EU in accordance with this Privacy Policy. No personal data is transferred outside of the European Economic Area.


  1. Cross Data Border Transfers

As a general rule, we do not transfer or process personal data outside the European Economic Area unless we have your specific consent to do so or where the nature of the processing requires it (for example, because you have chosen to use an email or other communications service which routes data outside the EEA).

 In addition, any approved personal information that is submitted for publication on our website will also be published on the internet making it available around the world.


  1. Website Cookies Policy

Our Website uses technology called ‘cookies’ to enable us to deliver a better user browser experience and to help us understand your preferences and habits. This involves a cookie file being placed on your device each time you visit our website. Cookies do not contain any person-identifiable information.

 The Retreat York uses three types of cookies:

 Session Cookies: These enable the tracking of your movement across the website and save information to make life easier. For instance, a session cookie might save an item to your shopping basket, which without would force you to order the item again separately.

 Persistent Cookies:  These enable your preferences and settings to be saved each time you visit our website. This enables you to use the site faster and reduces the need to re-enter data.

 Third Party Cookies:  These enable us to track your user activity outside the website and optimise campaigns and analytics better.

 All cookies can be disabled online but you are advised that this will limit the service you receive online. For more information on this please review our Cookie Policy online.


  1. Log Files

 For the purpose of error capture and analysis, we capture log files which contain information about you and/or your computer. This includes: 

  • Computer name
  • Operating System version
  • Browser version
  • IP address

 No data processing or transformation is undertaken with this data. We do however analyse usage of the site to ensure our pages and services are relevant and current and that information can be delivered effectively.


  1. Complaints

The Retreat York aims to meet the highest of standards when collecting and using personal data. As a business we treat all complaints we receive very seriously. We encourage anyone to bring concerns to our attention if they think we are using their data in an unfair or misleading way.  


  1. Contact Us (Data Protection Officer)

If you have any queries about exercising your data subject rights or how your data is being processed and handled then please contact our Data Protection Officer at:


107 Heslington Road


YO10 5BN




  1. Information Commissioner’s Office (ICO)

The Information Commissioner’s Office (ICO) is the UK’s independent supervisory authority responsible for overseeing all data protection issues. If you are still dissatisfied with how your data is being processed or handled by us following our complaint procedure then you can submit a complaint to the Information Commissioner’s Office (ICO) to ask for an independent review at the following address:

 Information Commissioner’s Office                            

Wycliffe House, Water Lane
Wilmslow, Cheshire

 Telephone: 0303 123 1113 (local rate) or 01625 545 745

Fax: 01625 524 510



Last Updated: 15th June 2021

News & Updates

What is Mindfulness?

What is Mindfulness?

Mindfulness is one of the most effective ways to build mental strength. Learn more about how you can incorporate mindful activities into your life in our blog.

What is Online/Video Therapy?

Our online therapy service allows us to offer help and support to people not able to access our York-based service face-to-face. Online therapy is a developing area for counselling and psychotherapy, and is also known as webcam counselling, e-therapy, web therapy, internet therapy and distance therapy. This service allows you all the benefits of face-to-face sessions with a therapist, via your personal computer and from the comfort of your home. 

Our skilled counsellors, psychologists and therapists will listen to you in a non-judgmental way in a private, confidential setting. They can help you with your current difficulties, past experiences or anxieties about your future with the aim of helping you improve the quality of your life and relationships.

What is Post-Traumatic Stress Disorder?

Any one of us can experience something that we find traumatic. This could be something recent that has happened to us or it could be from our earlier years. Either way, around 30% of people who experience something traumatic go on to develop symptoms of Post-Traumatic Stress Disorder (PTSD). Traumatic events can vary widely, from road traffic or other accidents, involvement in military combat, near death experiences, or some form of abuse as a child or adult.

PTSD is a name given to a range of symptoms that someone may experience. Often, when we experience a situation that is traumatic, we may at first feel quite numb, but later experience symptoms such as:

  • Nightmares or frightening thoughts
  • Re-living the traumatic event, often termed ‘flashbacks’
  • Avoidance of reminders of the event and of talking about it
  • Irritability or outbursts of anger
  • Hyper vigilance and alertness to possible danger
  • Problems with concentration and memory.

These are all symptoms of PTSD and are usually very distressing to us.

What is Autism?

Autism is a lifelong developmental disability that affects how a person communicates with and relates to other people, and how they experience the world around them.

It is a spectrum condition, which means that, while all people with autism share certain difficulties, their condition will affect them in different ways.

Some people with autism can live relatively independent lives, but others may have accompanying learning disabilities and need a lifetime of specialist support.

What is Attention Deficit Hyperactivity Disorder (ADHD)?

Attention Deficit Hyperactivity Disorder (ADHD) is a group of behavioural symptoms that include:

  • Inattentiveness – most people with ADHD will have a short attention span and may be easily distracted.
  • Hyperactivity – there is likely to be some restlessness, fidgeting or overactivity. This can also lead to difficulties in sleeping and increased anxiety.
  • Impulsiveness – people with ADHD may do things without thought for the consequences, without very much reflection and without having a plan.

Some adults will have ADHD without it being diagnosed at a younger age. Those who are diagnosed at a young age are likely to continue to experience problems, though the symptoms might reduce.

What therapies do you offer?

We offer a range of individual and group therapies in line with NICE (National Institute for Health and Care Excellence) guidance. All of our therapists are highly trained, experienced and committed to continued professional development. Many therapists have training in more than one therapy modality, and are therefore in the best position to offer tailored, individualised therapy to meet your needs, drawing from the most up to date, evidence-based interventions.

Our therapies are usually delivered face to face, in relaxing therapy rooms. However if you are unable to come to The Retreat for your appointments, whatever the reason, we may be able to offer you an appointment via video link, using a secure platform called VSEE. 

How do I access the service?

All therapies are accessed via our Initial Therapies Assessment. 

To refer yourself to our general therapies service, or just to talk to us about whether we can help, please call us on 01904 412551.

Is the service confidential?

All our services are confidential, and our therapists and clinicians follow professional codes of conduct which include principles around confidentiality. This means we will not disclose information about you to a third party without your consent, unless we had significant concern for either your safety or the safety of someone else. We would make every attempt to discuss this with you if the situation arose.

Can I get involved in The Retreat?

We welcome representation from people who have finished their therapy or support within our services. There are a number of ways you can get involved, from joining us at information sharing events, helping us raise the profile of our services through the media, or consulting with us to help develop new service or recruit new staff. Please contact us for more information. 

Get in Touch. Talk to us.

If you need to speak to us, we are here to help. Our team of qualified therapists are at your service in person, or via a video call.

Heslington Rd, York, YO10 5BN

Call Us: 01904 412 551