PRIVACY POLICY
We are committed to protecting and respecting your privacy. This policy explains what personal information we collect about you, why we collect it, how we use and protect it, and the rights you have over it. Because we provide brain-related health services, some of the information we hold about you is particularly sensitive, and we take extra care with it, as explained below.
We collect, use and are responsible for certain personal information about you. When we do so, we are the ‘controller’ of that information and are regulated under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Our contact details
Name: Optiminds Brain Training
Address: 31a Tib Street, Manchester, M4 1LX, United Kingdom
Phone: 07985 122 359
Email: hello@optiminds.org
Website: www.optiminds.org
We are the controller for your information. A controller decides why and how your information is used and shared.
Data protection queries
If you have any questions or concerns about how we use your personal information, please contact us at hello@optiminds.org.
How we get your information and why we have it
Most of the personal information we hold is provided to us directly by you, in the following situations:
• You have enquired about, or joined the waiting list for, our services.
• You have booked or attended an assessment, QEEG brain map or neurofeedback session with us.
• You have completed intake forms, questionnaires or health history information to help us plan your training.
• You have contacted us for customer service, or made a complaint.
• You have contacted us through one of our social media channels.
• You have agreed to take part in a photo or video shoot.
• You have subscribed to our newsletter or updates.
• You have visited our website.
We may also receive information about you indirectly, for example:
• From a parent, guardian or carer providing information to support the care of a child or family member.
• From another health or care professional involved in your care, e.g. GP, Psychiatrist, Psychologist.
• When you browse our website and our cookies collect information (see ‘Cookies and other tracking technology’ below).
• From social media activity, such as when you ‘like’, share or follow our content, which may be matched with third party data from platforms such as Google and social media.
This website is not intended for use by children, and we do not knowingly collect information about children through it. Where a child attends our service, their information is provided and managed with the involvement of a parent or guardian.
What information we collect
Personal information
Personal information is any information that can be used to identify a living person. We currently collect and use the following personal information:
• Personal identifiers and contact details (for example, your name, address, email address and phone number).
• Date of birth and, where relevant, details of a parent, guardian or carer.
• Information about your devices, such as IP addresses, and how you browse our website.
• Payment and billing information relating to any services you purchase.
• Photographs or video, where you have agreed to take part in a photo or video shoot.
More sensitive information (special category data)
The UK GDPR gives extra protection to more sensitive information known as ‘special category data’. Information concerning your health falls into this category and is treated with the greatest care. Because our services involve assessing and training the brain, much of the information we hold is sensitive health information. We only collect what is relevant and necessary to provide your service safely and effectively.
We process the following more sensitive (special category) information:
• Data concerning your physical or mental health – for example your symptoms, conditions or diagnoses (such as ADHD, anxiety, autism, depression, PTSD, insomnia or migraine), relevant medical and medication history, and details of your appointments and progress.
• Your QEEG brain map data and results, and the training plans, session records and outcomes we produce as part of your neurofeedback or other supportive programme.
• Where you choose to share it as part of your health history, information that may reveal your racial or ethnic origin, religious or philosophical beliefs, or other special category information relevant to your care.
We may also, on rare occasions, process information relating to criminal offences, which is treated as similarly sensitive – for example if we are required to share information to protect someone from serious harm.
Who we share your information with
We do not sell your personal information. We may share it with the following types of organisations, and only where there is a lawful basis to do so:
• Contracted service providers who process information on our behalf – for example IT, systems administration and hosting, our QEEG and neurofeedback software providers, payment processing, booking and email systems, research and analytics, marketing and customer support. We only use providers who can offer adequate safeguards to keep your data secure.
• Other health or care professionals involved in your care (with your consent).
• Third party social media and advertising networks, so that we can advertise on their platforms (marketing information only, not your health data).
• Professional advisers who provide consultancy, banking, legal, insurance and accounting services.
• Public and government authorities and fraud prevention agencies, where required to investigate actual or suspected criminal activity, or other regulatory or legal matters.
In some circumstances we may be legally obliged to share information, or may share it where the public interest in doing so outweighs your right to confidentiality – for example where a serious crime has been committed, where there is a serious risk to you, staff or the public, or to protect a child or vulnerable adult. Any such decision is made carefully on a case-by-case basis.
Is your information transferred outside the UK?
Your information is stored and processed in the United Kingdom. Where we transfer personal information to a country outside the UK/EEA, we make sure it is protected either by an adequacy decision from the UK Government, or by appropriate safeguards such as standard contractual clauses.
Our lawful basis for using your information
Under the UK GDPR we must have a lawful basis for using your personal information. Depending on what we are doing, we rely on one or more of the following.
For personal information
• Consent – where you have given us clear consent to use your information for a specific purpose (for example, marketing emails or website cookies). You can withdraw your consent at any time.
• Contract – where using your information is necessary for a contract we have with you, or to take steps at your request before entering into a contract (for example, arranging and delivering your sessions and taking payment).
• Legal obligation – where we must use your information to comply with the law.
• Vital interests – where using your information is necessary to protect someone’s life.
• Legitimate interests – where using your information is necessary for our legitimate interests (such as running and improving our service), provided these do not override your rights.
For more sensitive (special category) information
To use special category information, such as your health and QEEG data, we also need an additional condition. We rely on:
• Explicit consent – you give us your clear, specific and informed consent to process your health information for the purpose of assessing your needs and providing your QEEG brain mapping and neurofeedback programme. You can withdraw this consent at any time (see ‘Your data protection rights’ below), although this may mean we are unable to continue providing the service.
• Health or social care – where processing is necessary for the provision of health care and carried out under the responsibility of a health professional.
Duty of confidentiality
Because we handle health information, we also owe you a common law duty of confidentiality. We satisfy this duty because you have provided us with your consent to use your information to provide and manage your care, or, in rare cases, because we have a legal requirement or an overriding public interest to share it.
What we do with your information
We use the information you give us in order to:
• Assess your needs, produce your QEEG brain map, and design and deliver a personalised neurotherapy training plan.
• Manage your appointments, monitor your progress and keep records of your care.
• Process contracts, payments and financial information relating to your services.
• Respond to your enquiries, customer service requests and complaints.
• Manage attendance at events.
• Produce marketing materials where you have agreed, for example by signing a release form.
• Send you news, events, services or offers you have chosen to receive, and make marketing more relevant to you (for example by matching cookie data with advertising platforms such as Google and social media).
• Improve the design, style and functionality of our website.
• Respond to comments and messages via our social media channels, run any competitions or offers, gather feedback and conduct market research.
How we store your information and for how long
Your information is securely stored by Optiminds Brain Training on systems based in the United Kingdom. We use strict procedures and security features to prevent unauthorised access. Please note that no transmission of information over the internet is ever completely secure; although we do our best to protect your information, any transmission to our website is at your own risk.
We keep your personal information only for as long as necessary for the purposes described in this policy and to meet our legal obligations. We keep client health and QEEG records for 8 years after your last appointment.
Once information is no longer needed, we securely dispose of it – for example by shredding paper records and permanently deleting electronic records.
Your data protection rights
Under data protection law, you have rights including:
• Your right of access – to ask us for copies of your personal information (a ‘subject access request’).
• Your right to rectification – to ask us to correct information you think is inaccurate, or complete information you think is incomplete.
• Your right to erasure – to ask us to erase your personal information in certain circumstances.
• Your right to restriction of processing – to ask us to restrict the processing of your information in certain circumstances.
• Your right to object to processing – to object to our processing of your information in certain circumstances.
• Your right to data portability – to ask us to transfer the information you gave us to another organisation, or to you, in certain circumstances.
• Your right to withdraw consent – where we rely on your consent (including your explicit consent to process your health information), you can withdraw it at any time by contacting us.
You are not required to pay a charge to exercise your rights. If you make a request, we have one month to respond. Please contact us at hello@optiminds.org if you wish to make a request.
Cookies and other tracking technology
When you visit our website, cookies and similar technologies may collect information about how you browse. We may match this cookie data with third party data, such as from Google and social media platforms, to help us understand website and email usage and to make our marketing more relevant. You can manage or disable cookies through your browser settings. You can access our cookie policy here.
Links to other websites
Our website may contain links to, or embedded content from, other websites. If you follow a link to leave our site, please note we have no control over those websites and cannot be responsible for the protection or privacy of any information you provide there. This policy does not cover third party websites, so we recommend you check the privacy policy of each website you visit.
Marketing
We would like to send you information about services that may interest you. Where we have your consent, or where it is in our legitimate interests to do so, we may contact you by email. If you have previously agreed to this, you can unsubscribe at any time by contacting us at hello@optiminds.org, or by using the ‘unsubscribe’ link in our emails. Please allow up to 7 days for this to take effect.
How to complain
If you have any concerns about our use of your personal information, please contact us first at hello@optiminds.org so we can try to put things right.
If you are still unhappy with how we have used your data, you can complain to the Information Commissioner’s Office (ICO):
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Changes to this privacy policy
We may update this privacy policy from time to time. This version was published on 07/07/26. Last reviewed: 07/07/26. Next scheduled review: 07/07/27.