Dr Kristy Fenton

Privacy Policy (Privacy Notice)

Last updated: September 2026

This Privacy Policy explains how Dr Kristy Fenton ("we", "us", "our") collects, uses, stores, and protects personal and health data relating to young people, their parents, and legal guardians.

We operate in full compliance with the Data Protection Act 2018, the UK General Data Protection Regulation (UK GDPR), and professional clinical confidentiality standards governed by the General Medical Council (GMC).

1. Data Controller Details

Practice Name: Dr K M Fenton Ltd
Practice Website: https://drkmfenton.co.uk
Email: contact@drkmfenton.co.uk
Practice Location: 1 Snow Hill Court, Central London, EC1A 2EJ
ICO Registration: Registered with the Information Commissioner's Office (ICO) under registration number: ZB647712

2. Types of Personal Data We Collect

To provide specialist psychiatric assessment and care, we collect and process:

• Contact & Demographic Data: Names, dates of birth, home and billing addresses, parent/guardian contact details, phone numbers, and email addresses.
• Special Category Health Data: Physical and mental health histories, neurodevelopmental records, medical diagnoses, psychiatric formulations, consultation notes, medication records, and registered NHS GP details.
• Assessment & Diagnostic Data: Standardised clinical questionnaires and rating scales (e.g., Young DIVA-5, 3di, ADOS-2, Conners-4, CEFI, RCADS) and objective metrics (e.g., QbCheck data).
• Educational & Collateral Information: School reports, SENCO observations, individual education plans (IEPs/EHCPs), and educational psychology reports where provided.
• Audio & Transcription Data: Real-time consultation audio captured via secure ambient clinical scribe software (where not opted out of) to generate clinical notes.
• Financial Information: Payment records, invoices, and tokenised transaction identifiers via our secure booking/payment systems.

3. Lawful Bases for Processing Data

4. Ambient Voice Technology (AI Clinical Documentation)

To ensure Dr Fenton remains fully focused on the young person and family rather than typing or taking manual notes during appointments, our practice utilises secure ambient clinical voice technology.

• Purpose: The system securely captures the consultation audio in real time to generate accurate structured notes and draft diagnostic reports for clinician verification.
• Privacy & Storage: Audio recordings are encrypted in transit and at rest, processed within secure UK/EU environments, and permanently erased once the transcript has been verified. Audio recordings are never retained long-term or used to train third-party public AI models.
• Human Oversight: All generated documentation is reviewed, validated, and edited directly by Dr Fenton before being entered into the official medical record.
• Right to Opt Out: Ambient documentation is optional. If you prefer that ambient technology is not used during your consultation, please inform us in writing prior to your appointment or notify Dr Fenton at the start of your session. Opting out will not affect your care or appointment length.

5. Data Sharing and Third Parties

We treat all patient data with strict clinical confidentiality. Data is only shared with designated entities in the following circumstances:

• Primary Care (Registered GP): Diagnostic summaries and clinical reports are routinely shared with the young person's registered GP in accordance with GMC guidelines, unless you explicitly opt out in writing prior to assessment.
• Electronic Health Record (EHR): Records are stored on Semble, an ISO 27001-certified, UK GDPR-compliant clinical management platform secured by multi-factor authentication (MFA).
• Digital Pharmacies: Private prescriptions are securely transmitted to licensed partner pharmacies (e.g., Pharmacierge, CloudRx) to dispense and dispatch medication.
• Diagnostic Testing Providers: Assessment tools such as QbCheck process limited necessary identifiers for diagnostic profiling.
• Schools & Other Professionals: Reports are shared with schools, SENCOs, or therapists only upon your specific written request and consent.
• Safeguarding & Emergency Disclosures: In rare cases involving imminent serious risk of harm to the patient or others, or under statutory child protection duties, we are legally required to disclose necessary information to emergency services (999/111) or safeguarding bodies.

6. Data Retention

In accordance with the NHS Records Management Code of Practice and medical indemnity standards, child and adolescent psychiatric records are retained until the patient's 25th or 26th birthday (or 8 years after the conclusion of treatment, whichever is longer). Financial and billing records are kept for 7 years to meet statutory HMRC requirements. Temporary ambient audio recordings are deleted within 7 days of transcription.

7. Your Legal Rights

Under the UK GDPR, you have statutory rights including:

• Right of Access: You may submit a Subject Access Request (SAR) to receive a copy of your records.
• Right to Rectification: You may request the correction of inaccurate factual information. (Clinical opinions and professional medical formulations cannot be altered, though your observations can be appended).
• Right to Erasure & Restriction: Subject to mandatory clinical record-retention laws.
• Right to Opt Out: You may withdraw consent for ambient scribing or optional data sharing at any time.

To submit a data rights request, please email contact@drkmfenton.co.uk.

8. Regulatory Complaints

Dr K M Fenton Ltd is registered with the Information Commissioner’s Office (ICO) as a data controller. If you have questions or concerns about how your data is handled, please contact our practice first so we can assist. You also have the right to lodge a complaint directly with the UK supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113 | Website: ico.org.uk