Privacy and records policy
What information is used, why it is used, confidentiality limits, technical services, records and privacy requests.
Responsible clinic
Dr. Khalid Mental Health Clinic is professionally responsible for information it receives directly to organise services, provide care, maintain records and manage safety.
Information categories
Information may include identity and contact details, the person’s location during appointments, booking and payment information, medical, psychiatric and medication history, session notes, prescriptions, referrals, safety information and necessary administrative communications.
Purposes
Information is used to determine service suitability, organise appointments and payment, provide assessment and follow-up, maintain professional records, support continuity of care, verify prescriptions, manage risk, and respond to complaints or privacy requests.
Data minimisation and WhatsApp
Only necessary information should be sent through WhatsApp. It is an administrative channel for booking, payment, links and notices, not a place for lengthy clinical histories, unnecessary private images, or assessment and treatment outside appointments.
Clinically material information is documented in the appropriate clinic record; a WhatsApp chat is not treated as the sole clinical record. Identity images, reports, prescriptions or other sensitive documents should only be sent when requested for a defined purpose.
Confidentiality and its limits
Information is treated with professional confidentiality. The minimum necessary information may be shared when there is serious and imminent risk, a need to coordinate care, or a professional or legal obligation. This is explained when doing so is possible and safe.
Third-party services and international processing
The clinic uses services such as Google Calendar, Google Meet, WhatsApp and Cloudflare. These providers may process data in different countries under their own infrastructure and policies. Remote care carries this technical limitation. The clinic does not sell patient information or use it for advertising.
Records and retention
Clinical records are retained for the period needed for continuity of care and applicable professional or legal duties. Deletion may not be possible where a record must be kept for safety, documentation or professional defence. Duplicate administrative copies are reviewed and removed when there is no continuing legitimate need.
Security and limitations
Restricted access and practical safeguards are used to reduce unnecessary exposure, but no digital system is risk-free. Suspected unauthorised access is reviewed and proportionate action is taken, including notification where required and feasible.
Individual rights
A person may request access to key information, correction of an error, an appropriate copy of the record, restriction of unnecessary use, or submit a complaint. Responses are subject to identity verification, third-party rights and record-retention duties.
Minors and educational publication
Parental or guardian consent and the minor’s privacy are considered according to age, circumstances and applicable requirements. A case or consultation is not published for education without removing identifying details and obtaining required permission.
Privacy requests
Use the contact and complaints page and avoid including unnecessary clinical detail in the first message.