Ketamine is a prescription-only medicine that may be prescribed off-label by our medical team following a comprehensive assessment to assist in the psychotherapy.

Privacy and Cookie Policy

Last updated: 26th July 2026

1. About this policy

The Emerge Clinic respects your privacy and is committed to protecting your personal information.

This Privacy and Cookie Policy explains how we collect, use, store and share personal information when you:

  • visit our website;
  • contact us with an enquiry;
  • ask to be assessed for one of our programmes;
  • receive services from The Emerge Clinic;
  • communicate with us by telephone, email, website form or another agreed method.

This policy also explains your rights under UK data-protection law and how cookies and similar technologies are used on our website.

The Emerge Clinic is a trading name of KetaClinics Ltd, a company registered in England and Wales.

Company number: 15660130
Registered office: St Georges Works, 51 Colegate, Norwich, Norfolk, England, NR3 1DD
Email: hello@theemergeclinic.co.uk

2. Who is responsible for your information?

The Emerge programme combines psychotherapy and administrative services provided through Emerge Clinic with medical assessment, prescribing and medical care provided through Devany Medical Ltd.

KetaClinics Ltd, trading as The Emerge Clinic, and Devany Medical Ltd act as joint controllers for the personal information processed in connection with the Emerge programme.

This means that the two organisations work together in determining why certain information is needed and how it is used to assess suitability, coordinate care and provide the programme. However, each organisation maintains its own records and is responsible for the security and management of the information held within its own systems.

The Emerge Clinic holds psychotherapy, assessment, communication and administrative information within secure cloud storage and, where necessary, secure paper records.

Devany Medical Ltd holds medical information within its secure medical-records system.

Only authorised individuals involved in providing or administering your care may access this information. Within the Emerge programme, this will ordinarily be Paul Gibson and Dr Adam Devany.

You may contact either The Emerge Clinic or Devany Medical Ltd about the use of your information or to exercise your data-protection rights. The Emerge Clinic will act as the primary contact point for general enquiries about this policy and will liaise with Devany Medical Ltd where necessary.

3. The information we may collect

The information we collect depends on whether you are visiting the website, making an enquiry, undergoing an assessment or receiving treatment.

We may collect and process:

Identity and contact information

This may include your:

  • name;
  • date of birth;
  • postal address;
  • email address;
  • telephone number;
  • preferred method of communication;
  • emergency-contact or next-of-kin information.
Healthcare-provider information

This may include the names and contact details of your:

  • GP;
  • psychiatrist;
  • cardiologist;
  • therapist;
  • consultant;
  • other healthcare professionals involved in your care.
Medical and mental-health information

This may include:

  • your current and previous physical and mental-health conditions;
  • diagnoses and symptoms;
  • medication and treatment history;
  • allergies and adverse reactions;
  • blood-pressure readings and other clinical observations;
  • blood-test results;
  • hospital admissions or previous procedures;
  • alcohol and substance-use information;
  • relevant family medical or psychiatric history;
  • history of psychosis, mania, self-harm or suicidal thoughts;
  • information about disability or accessibility requirements;
  • clinical correspondence and reports from other professionals;
  • information required to assess your suitability for the programme.

Medical and mental-health information is classified as special-category personal data and receives additional protection under data-protection law.

Psychotherapy information

This may include:

  • information discussed during assessment and psychotherapy sessions;
  • clinical formulations;
  • psychotherapy notes;
  • treatment goals;
  • psychological questionnaires and outcome measures;
  • progress and integration notes;
  • relevant personal, relational and developmental history;
  • risk and safeguarding assessments;
  • personalised therapeutic materials or recordings.
Programme and administrative information

This may include:

  • appointment dates and attendance records;
  • signed consent forms and programme agreements;
  • correspondence relating to assessments and appointments;
  • invoices and payment records;
  • complaints, concerns or feedback;
  • records of cancellations or programme withdrawal.

We do not normally retain complete payment-card details. Card payments are processed by the relevant payment provider.

Website and technical information

When you use our website, we may collect:

  • your internet protocol address;
  • browser and device type;
  • operating system;
  • pages visited;
  • the date and time of your visit;
  • referring website;
  • cookie preferences;
  • website analytics and performance information.

Further information is provided in the cookie section below.

4. How we receive information

We may receive personal information:

  • directly from you;
  • through an online enquiry or contact form;
  • through telephone calls, emails, letters or agreed messaging services;
  • during medical or psychotherapy assessments;
  • during treatment and integration sessions;
  • through questionnaires, consent forms and programme documentation;
  • from a family member or representative contacting us with your knowledge or authority;
  • from your GP, psychiatrist, cardiologist or another healthcare professional;
  • from Devany Medical Ltd or another professional involved in your care;
  • from medical records, referral letters, test results or clinical reports;
  • automatically through your use of our website.

Where information is requested from another healthcare professional, we will ordinarily obtain your consent before making that request.

There may be exceptional circumstances in which information is obtained or shared without consent, such as a medical emergency, a serious safeguarding concern or where disclosure is required by law.

5. Why we use your information

We may use personal information to:

  • respond to enquiries;
  • understand the nature of the support you are seeking;
  • arrange an initial consultation or assessment;
  • assess whether the Emerge programme may be appropriate and safe for you;
  • confirm your medical history, diagnoses and medication;
  • obtain relevant information from your GP, psychiatrist, cardiologist or another professional;
  • arrange medical investigations or obtain clinical advice;
  • deliver medical, psychotherapeutic and administrative elements of the programme;
  • coordinate care between The Emerge Clinic and Devany Medical Ltd;
  • maintain accurate clinical and administrative records;
  • monitor your safety, wellbeing and progress;
  • manage clinical risk and safeguarding concerns;
  • communicate with you before, during and after the programme;
  • arrange appointments and respond to requests to reschedule;
  • process payments, issue invoices and maintain financial records;
  • create personalised therapeutic materials;
  • manage complaints or concerns;
  • obtain legal, regulatory, insurance or professional advice;
  • establish, exercise or defend legal claims;
  • comply with legal, professional, regulatory, tax and insurance obligations;
  • maintain the security and proper operation of our website and information systems;
  • improve the quality and accessibility of our services;
  • send optional news or marketing communications where you have agreed to receive them.

We will not use information obtained through a clinical enquiry to send general marketing communications unless you have separately chosen to receive them.

6. Our lawful bases for processing information

Data-protection law requires us to have a lawful basis for using personal information.

Depending on the circumstances, we may rely on one or more of the following bases.

Steps taken at your request and performance of a contract

We may process information where this is necessary to:

  • respond to a request to assess or treat you;
  • arrange assessments and appointments;
  • enter into and perform our agreement with you;
  • provide the services you have requested;
  • administer payment and programme arrangements.
Legal obligation

We may process information where necessary to comply with legal, financial, regulatory, safeguarding or reporting obligations.

Legitimate interests

We may process information where it is necessary for our legitimate interests or those of another person, provided that those interests are not overridden by your rights and interests.

These interests may include:

  • responding appropriately to enquiries;
  • operating and administering a safe healthcare and psychotherapy service;
  • maintaining appropriate records;
  • protecting patients, clinicians and the public;
  • managing complaints;
  • preventing fraud or misuse;
  • maintaining website and information security;
  • obtaining professional, legal or insurance advice;
  • establishing or defending legal claims.
Vital interests

In a serious emergency, we may process or disclose information where this is necessary to protect your life or physical safety, or that of another person.

Consent

We may rely on your consent where the activity is genuinely optional. Examples may include:

  • receiving marketing communications;
  • publishing an identifiable testimonial;
  • using identifiable information in a case study;
  • making an optional audio or video recording;
  • using non-essential website cookies.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not make earlier processing unlawful.

Consent to receive medical treatment or psychotherapy is separate from consent used as a lawful basis under data-protection law.

7. How we use health and other special-category information

Information concerning your physical health, mental health and treatment is special-category personal data.

In addition to having a general lawful basis, we must meet an additional legal condition before processing this information.

Depending on the circumstances, we may process special-category information where:

  • it is necessary for medical diagnosis, assessment, treatment or the provision and management of health or social care;
  • the information is processed by, or under the responsibility of, a professional who is subject to an obligation of confidentiality;
  • you have given explicit consent for a particular optional use;
  • it is necessary to protect vital interests where you are physically or legally unable to consent;
  • it is necessary for the establishment, exercise or defence of legal claims;
  • it is necessary for an appropriate safeguarding or substantial public-interest purpose permitted by law.

We will only collect and use health information that is relevant to the assessment, safety, delivery and administration of your care.

8. Joint working between The Emerge Clinic and Devany Medical Ltd

The Emerge Clinic and Devany Medical Ltd may share relevant information with one another where this is necessary to:

  • assess whether the programme is appropriate and medically safe;
  • coordinate medical and psychotherapeutic care;
  • arrange appointments and treatment;
  • monitor risk, physical observations and psychological wellbeing;
  • respond to a medical or psychological concern;
  • maintain continuity of care;
  • investigate a complaint, incident or safeguarding concern.

Information will only be shared where it is relevant to the recipient’s role.

The organisations maintain separate record systems. Information entered into one organisation’s records is not necessarily reproduced in full within the other organisation’s system.

Each organisation is responsible for:

  • maintaining the accuracy and security of the records it holds;
  • limiting access to authorised individuals;
  • responding appropriately to data breaches;
  • complying with retention requirements;
  • assisting with requests from individuals exercising their rights.

The Emerge Clinic and Devany Medical Ltd maintain arrangements governing their respective data-protection responsibilities.

9. Who we may share information with

Information will ordinarily only be accessed by Paul Gibson and Dr Adam Devany as necessary for their respective roles.

Where relevant and lawful, information may also be shared with:

  • your GP;
  • your psychiatrist;
  • your cardiologist;
  • another consultant or healthcare professional involved in your care;
  • a laboratory, phlebotomy provider or diagnostic service;
  • an emergency-contact person, where authorised or necessary in an emergency;
  • emergency services;
  • safeguarding authorities;
  • a professional supervisor, subject to professional confidentiality and data minimisation;
  • our insurers, legal advisers, accountants or professional advisers;
  • regulators, courts, law-enforcement bodies or public authorities where disclosure is legally required;
  • carefully selected IT, website, email, secure-storage, payment or administrative service providers acting on our instructions.

Where we seek information from a GP, psychiatrist, cardiologist or another professional, we will ordinarily ask for your consent before contacting them.

We will not ordinarily disclose information to a spouse, partner, relative, friend or employer without your authority.

We may disclose information without consent where:

  • there is an immediate or serious risk of harm to you or another person;
  • there is a safeguarding concern involving a child or an adult at risk;
  • urgent disclosure is necessary for medical care;
  • disclosure is required by law, court order or a regulatory authority;
  • it is necessary to establish, exercise or defend a legal claim.

Where possible and appropriate, we will discuss such a disclosure with you before it is made.

We do not sell personal information.

10. Confidentiality

Information disclosed during assessment, medical care and psychotherapy is treated confidentially.

Confidentiality is not absolute. It may be necessary to disclose relevant information where:

  • we believe there is a serious and immediate risk to you;
  • we believe another person may be at serious risk;
  • there is a safeguarding concern;
  • urgent medical intervention is required;
  • we are required to disclose information by law;
  • disclosure is necessary in connection with a legal, regulatory, insurance or professional matter.

Any disclosure will be limited, where reasonably possible, to the information necessary for the particular purpose.

11. How long we retain information

We do not retain personal information indefinitely. Different categories of information are retained for different periods according to their clinical, legal, financial, professional and insurance purposes.

Our general retention periods are:

Initial enquiries that do not proceed

Enquiry correspondence and preliminary information will ordinarily be retained for up to 12 months from the date of the last meaningful contact.

We may retain limited information for longer where this is necessary to record a clinical-suitability decision, manage risk, respond to a complaint or establish or defend a legal claim.

Adult clinical and psychotherapy records

Clinical, medical and psychotherapy records will ordinarily be retained for eight years following the date of the patient’s last treatment or last clinical contact.

A longer period may apply where:

  • there is an ongoing complaint or legal claim;
  • a serious incident or safeguarding concern has occurred;
  • our insurer, regulator or another applicable legal requirement requires longer retention;
  • the record has continuing clinical relevance;
  • deletion would be inappropriate because of an identified risk.

The Emerge Clinic currently provides services to adults only. Should services ever be provided to a person under 18, a different retention period would apply.

Financial and transaction records

Invoices, payment records and accounting information will ordinarily be retained for at least six years after the end of the relevant financial year, or for any longer period required by tax or company law.

Complaints, incidents and safeguarding records

These records may be retained for the period necessary to investigate and resolve the matter and for any additional period required for legal, regulatory, insurance or safeguarding purposes.

Website information and cookies

Website logs, analytics information and cookies are retained for the periods described in our cookie settings or by the relevant service provider.

At the end of the applicable retention period, information will be securely deleted, destroyed or anonymised unless there is a lawful reason to retain it.

We may periodically review and reduce the information retained so that we do not keep more information than is necessary.

12. How we protect information

We take reasonable and proportionate measures to protect personal information against:

  • unauthorised access;
  • accidental loss;
  • alteration;
  • disclosure;
  • destruction

Measures may include:

  • secure medical-records software;
  • secure cloud storage;
  • password protection and access controls;
  • multi-factor authentication where available;
  • encryption provided by our systems and service providers;
  • secure physical storage of paper records;
  • limiting access to people who genuinely require it;
  • confidentiality obligations;
  • secure backup and disposal arrangements;
  • appropriate contracts with service providers;
  • procedures for recognising and responding to data breaches.

Paper records are stored securely and are not left accessible to unauthorised people.

Although we take appropriate precautions, no internet, email or electronic-storage system can be guaranteed to be entirely risk free.

13. Email and electronic communication

Email and ordinary electronic messaging may not always be completely secure.

Please avoid sending information that is not necessary. Where particularly sensitive or extensive medical information is required, we may recommend a more secure method of transfer.

We will use the contact details you provide to communicate with you about enquiries, appointments, assessments, treatment and administration.

You are responsible for informing us if your contact details change or if it is no longer safe or appropriate for us to use a particular method of communication.

14. Information stored or accessed outside the United Kingdom

Some providers of website, email, cloud-storage, analytics, payment or communication services may store or access information outside the United Kingdom.

Where personal information is transferred internationally, we will take reasonable steps to ensure that an appropriate legal safeguard is in place. Depending on the destination, this may include:

  • a UK adequacy regulation;
  • approved contractual data-protection clauses;
  • another transfer mechanism permitted under UK data-protection law.

We seek to use reputable providers that maintain appropriate security and data-protection safeguards.

15. Your data-protection rights

Depending on the circumstances, you may have the right to:

  • be informed about how your information is used;
  • request access to personal information held about you;
  • request correction of inaccurate or incomplete information;
  • request deletion of information in certain circumstances;
  • request that processing be restricted;
  • object to certain types of processing;
  • receive certain information in a portable format;
  • withdraw consent where processing is based on consent;
  • object to direct marketing;
  • complain to the Information Commissioner’s Office.

These rights are not absolute. For example, we may need to retain clinical information despite a request for deletion where it is needed for ongoing care, patient safety, legal compliance, insurance purposes or the establishment or defence of legal claims.

We will not usually charge a fee for responding to a request. We may request proof of identity before releasing information.

We will ordinarily respond within one month. This period may be extended where a request is particularly complex or involves a large amount of information, as permitted by law.

To exercise your rights, contact:

Email: hello@theemergeclinic.co.uk
Address: St Georges Works, 51 Colegate, Norwich, Norfolk, England, NR3 1DD

Because The Emerge Clinic and Devany Medical Ltd hold information on separate systems, we may need to liaise with Devany Medical Ltd to provide a complete response. You may also contact Devany Medical Ltd directly in relation to records held within its medical system.

16. Access to health and psychotherapy records

You may request access to the personal information and clinical records held about you.

Before releasing health or psychotherapy records, we may need to review them to determine whether an exemption applies. In limited circumstances, information may be withheld or redacted where disclosure would:

  • be likely to cause serious harm to your physical or mental health or that of another person;
  • reveal confidential information about another person;
  • prejudice an applicable safeguarding, legal or regulatory process;
  • otherwise fall within an exemption provided by law.

Where information is withheld, we will explain this unless the law prevents us from doing so.

17. Correction of records

You may ask us to correct information that is factually inaccurate.

Clinical records may contain professional opinions, observations or information recorded at a particular time. Where there is a disagreement about a clinical opinion rather than a factual error, we may retain the original entry and add a note recording your objection or clarification.

We will not ordinarily delete or rewrite an accurate historic record merely because circumstances or opinions have subsequently changed.

18. Automated decision-making

We do not make decisions about your eligibility, suitability or treatment solely through automated decision-making.

Clinical-suitability decisions are made by appropriately involved practitioners after considering the relevant information.

We may use website analytics to understand how visitors use the website, but this is not used to make automated clinical decisions about you.

19. Marketing

We will only send general marketing or promotional communications where we have a lawful basis to do so.

Where we rely on your consent, you may unsubscribe at any time by:

  • using the unsubscribe option in the communication;
  • contacting us at hello@theemergeclinic.co.uk.

Choosing not to receive marketing will not affect your ability to enquire about or receive services.

We do not use sensitive medical or psychotherapy information for unrelated marketing.

20. Testimonials and case studies

We will not publish your name, photograph, testimonial, treatment story or other identifiable information without your explicit agreement.

Where possible, case material used for education or service information will be anonymised.

You may withdraw consent to future use of identifiable testimonial or case-study material. Withdrawal may not always enable us to retrieve material that has already been lawfully printed, published or distributed, but we will stop future use where reasonably possible.

Cookie Policy

21. What are cookies?

Cookies are small text files placed on your computer, tablet or mobile device when you visit a website.

They can be used to:

  • make a website function correctly;
  • remember choices and preferences;
  • maintain website security;
  • understand how visitors use a website;
  • improve performance and accessibility;
  • support embedded services such as videos or maps.

Some technologies perform similar functions without using conventional cookie files. References to cookies in this policy include similar storage and access technologies where applicable.

22. Types of cookies we may use
Strictly necessary cookies

These cookies are necessary for the website to function or to provide a service you have requested.

They may be used for:

  • website security;
  • managing network traffic;
  • remembering your privacy choices;
  • enabling forms to function;
  • maintaining essential website features.

Strictly necessary cookies do not normally require consent, although we will still provide information about them.

Preference or functional cookies

These cookies allow the website to remember choices you have made, such as display or accessibility preferences.

Where these cookies are not strictly necessary, they will only be used with your consent.

Analytics cookies

Analytics cookies help us understand how visitors use the website, for example:

  • which pages are visited;
  • how visitors reached the website;
  • how long visitors remain on a page;
  • whether errors occur;
  • which devices or browsers are used.

Where consent is legally required, analytics cookies will remain disabled unless and until you accept them.

Embedded and third-party content

Some pages may contain content provided by third parties, such as:

  • videos;
  • maps;
  • social-media content;
  • booking tools;
  • external forms.

These providers may place cookies or collect technical information when the content loads. Non-essential embedded content should not place cookies before you have given the required consent.

Advertising cookies

We do not intend to use advertising or behavioural-tracking cookies unless they are clearly identified within the website’s cookie controls.

Should such cookies be introduced, they will remain disabled until valid consent has been obtained.

23. Your cookie choices

When you first visit the website, you may be presented with a cookie banner or settings panel.

You should be able to:

  • accept non-essential cookies;
  • reject non-essential cookies;
  • select particular categories;
  • change your preferences later.

Rejecting non-essential cookies should be as straightforward as accepting them.

Strictly necessary cookies cannot always be disabled through the website because the website may not function properly without them.

You can also control or delete cookies through your browser settings. Blocking all cookies may affect the operation of some website features.

24. Cookie duration

Some cookies are deleted when you close your browser. These are known as session cookies.

Other cookies remain on your device for a defined period or until you delete them. These are known as persistent cookies.

The name, provider, purpose and duration of individual cookies should be available through the website’s cookie settings panel or cookie declaration.

25. Third-party cookie providers

Where our website uses third-party tools, the relevant provider may process information according to its own privacy policy.

We will periodically review the tools used on our website and seek to ensure that non-essential technologies are correctly identified and controlled through our consent mechanism.

26. Children

Emerge Clinic provides its programme to adults aged 18 and over.

Our website and services are not directed at children. If information concerning a child is provided in connection with an adult patient’s care or a safeguarding concern, it will be handled confidentially and only used where relevant and lawful.

27. Complaints about the use of information

Please contact us first if you have a concern about how we have handled your personal information. We will attempt to investigate and resolve the matter.

Email: hello@theemergeclinic.co.uk
Address: St Georges Works, 51 Colegate, Norwich, Norfolk, England, NR3 1DD

You also have the right to complain to the Information Commissioner’s Office, the United Kingdom’s independent data-protection regulator.

Information about making a complaint is available through the Information Commissioner’s Office website.

28. Changes to this policy

We may update this policy to reflect:

  • changes to our services;
  • changes to the organisations or systems involved;
  • changes in legal or regulatory requirements;
  • changes to the cookies or technologies used on our website.

The latest version will be published on this page with its updated review date.

Where a change materially affects how current patients’ information is used, we will take reasonable steps to bring it to their attention.

29. Contact us

Questions about this Privacy and Cookie Policy or the use of your information should be sent to:

The Emerge Clinic
A trading name of KetaClinics Ltd

Email: hello@theemergeclinic.co.uk
Postal address: St Georges Works, 51 Colegate, Norwich, Norfolk, England, NR3 1DD

For questions specifically concerning medical records held by Devany Medical Ltd, you may contact:

Devany Medical Ltd
Email:
consult@dradamclinic.com
Address:
Progress House
Church Road
Gorleston
NR31 6NP

Privacy and Cookie Policy

Last updated: 26th July 2026

1. About this policy

The Emerge Clinic respects your privacy and is committed to protecting your personal information.

This Privacy and Cookie Policy explains how we collect, use, store and share personal information when you:

  • visit our website;
  • contact us with an enquiry;
  • ask to be assessed for one of our programmes;
  • receive services from The Emerge Clinic;
  • communicate with us by telephone, email, website form or another agreed method.

This policy also explains your rights under UK data-protection law and how cookies and similar technologies are used on our website.

The Emerge Clinic is a trading name of KetaClinics Ltd, a company registered in England and Wales.

Company number: 15660130
Registered office: St Georges Works, 51 Colegate, Norwich, Norfolk, England, NR3 1DD
Email: hello@theemergeclinic.co.uk

2. Who is responsible for your information?

The Emerge programme combines psychotherapy and administrative services provided through The Emerge Clinic with medical assessment, prescribing and medical care provided through Devany Medical Ltd.

KetaClinics Ltd, trading as The Emerge Clinic, and Devany Medical Ltd act as joint controllers for the personal information processed in connection with the Emerge programme.

This means that the two organisations work together in determining why certain information is needed and how it is used to assess suitability, coordinate care and provide the programme. However, each organisation maintains its own records and is responsible for the security and management of the information held within its own systems.

The Emerge Clinic holds psychotherapy, assessment, communication and administrative information within secure cloud storage and, where necessary, secure paper records.

Devany Medical Ltd holds medical information within its secure medical-records system.

Only authorised individuals involved in providing or administering your care may access this information. Within the Emerge programme, this will ordinarily be Paul Gibson and Dr Adam Devany.

You may contact either The Emerge Clinic or Devany Medical Ltd about the use of your information or to exercise your data-protection rights. The Emerge Clinic will act as the primary contact point for general enquiries about this policy and will liaise with Devany Medical Ltd where necessary.

3. The information we may collect

The information we collect depends on whether you are visiting the website, making an enquiry, undergoing an assessment or receiving treatment.

We may collect and process:

Identity and contact information

This may include your:

  • name;
  • date of birth;
  • postal address;
  • email address;
  • telephone number;
  • preferred method of communication;
  • emergency-contact or next-of-kin information.
Healthcare-provider information

This may include the names and contact details of your:

  • GP;
  • psychiatrist;
  • cardiologist;
  • therapist;
  • consultant;
  • other healthcare professionals involved in your care.
Medical and mental-health information

This may include:

  • your current and previous physical and mental-health conditions;
  • diagnoses and symptoms;
  • medication and treatment history;
  • allergies and adverse reactions;
  • blood-pressure readings and other clinical observations;
  • blood-test results;
  • hospital admissions or previous procedures;
  • alcohol and substance-use information;
  • relevant family medical or psychiatric history;
  • history of psychosis, mania, self-harm or suicidal thoughts;
  • information about disability or accessibility requirements;
  • clinical correspondence and reports from other professionals;
  • information required to assess your suitability for the programme.

Medical and mental-health information is classified as special-category personal data and receives additional protection under data-protection law.

Psychotherapy information

This may include:

  • information discussed during assessment and psychotherapy sessions;
  • clinical formulations;
  • psychotherapy notes;
  • treatment goals;
  • psychological questionnaires and outcome measures;
  • progress and integration notes;
  • relevant personal, relational and developmental history;
  • risk and safeguarding assessments;
  • personalised therapeutic materials or recordings.
Programme and administrative information

This may include:

  • appointment dates and attendance records;
  • signed consent forms and programme agreements;
  • correspondence relating to assessments and appointments;
  • invoices and payment records;
  • complaints, concerns or feedback;
  • records of cancellations or programme withdrawal.

We do not normally retain complete payment-card details. Card payments are processed by the relevant payment provider.

Website and technical information

When you use our website, we may collect:

  • your internet protocol address;
  • browser and device type;
  • operating system;
  • pages visited;
  • the date and time of your visit;
  • referring website;
  • cookie preferences;
  • website analytics and performance information.

Further information is provided in the cookie section below.

4. How we receive information

We may receive personal information:

  • directly from you;
  • through an online enquiry or contact form;
  • through telephone calls, emails, letters or agreed messaging services;
  • during medical or psychotherapy assessments;
  • during treatment and integration sessions;
  • through questionnaires, consent forms and programme documentation;
  • from a family member or representative contacting us with your knowledge or authority;
  • from your GP, psychiatrist, cardiologist or another healthcare professional;
  • from Devany Medical Ltd or another professional involved in your care;
  • from medical records, referral letters, test results or clinical reports;
  • automatically through your use of our website.

Where information is requested from another healthcare professional, we will ordinarily obtain your consent before making that request.

There may be exceptional circumstances in which information is obtained or shared without consent, such as a medical emergency, a serious safeguarding concern or where disclosure is required by law.

5. Why we use your information

We may use personal information to:

  • respond to enquiries;
  • understand the nature of the support you are seeking;
  • arrange an initial consultation or assessment;
  • assess whether the Emerge programme may be appropriate and safe for you;
  • confirm your medical history, diagnoses and medication;
  • obtain relevant information from your GP, psychiatrist, cardiologist or another professional;
  • arrange medical investigations or obtain clinical advice;
  • deliver medical, psychotherapeutic and administrative elements of the programme;
  • coordinate care between The Emerge Clinic and Devany Medical Ltd;
  • maintain accurate clinical and administrative records;
  • monitor your safety, wellbeing and progress;
  • manage clinical risk and safeguarding concerns;
  • communicate with you before, during and after the programme;
  • arrange appointments and respond to requests to reschedule;
  • process payments, issue invoices and maintain financial records;
  • create personalised therapeutic materials;
  • manage complaints or concerns;
  • obtain legal, regulatory, insurance or professional advice;
  • establish, exercise or defend legal claims;
  • comply with legal, professional, regulatory, tax and insurance obligations;
  • maintain the security and proper operation of our website and information systems;
  • improve the quality and accessibility of our services;
  • send optional news or marketing communications where you have agreed to receive them.

We will not use information obtained through a clinical enquiry to send general marketing communications unless you have separately chosen to receive them.

6. Our lawful bases for processing information

Data-protection law requires us to have a lawful basis for using personal information.

Depending on the circumstances, we may rely on one or more of the following bases.

Steps taken at your request and performance of a contract

We may process information where this is necessary to:

  • respond to a request to assess or treat you;
  • arrange assessments and appointments;
  • enter into and perform our agreement with you;
  • provide the services you have requested;
  • administer payment and programme arrangements.
Legal obligation

We may process information where necessary to comply with legal, financial, regulatory, safeguarding or reporting obligations.

Legitimate interests

We may process information where it is necessary for our legitimate interests or those of another person, provided that those interests are not overridden by your rights and interests.

These interests may include:

  • responding appropriately to enquiries;
  • operating and administering a safe healthcare and psychotherapy service;
  • maintaining appropriate records;
  • protecting patients, clinicians and the public;
  • managing complaints;
  • preventing fraud or misuse;
  • maintaining website and information security;
  • obtaining professional, legal or insurance advice;
  • establishing or defending legal claims.
Vital interests

In a serious emergency, we may process or disclose information where this is necessary to protect your life or physical safety, or that of another person.

Consent

We may rely on your consent where the activity is genuinely optional. Examples may include:

  • receiving marketing communications;
  • publishing an identifiable testimonial;
  • using identifiable information in a case study;
  • making an optional audio or video recording;
  • using non-essential website cookies.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not make earlier processing unlawful.

Consent to receive medical treatment or psychotherapy is separate from consent used as a lawful basis under data-protection law.

7. How we use health and other special-category information

Information concerning your physical health, mental health and treatment is special-category personal data.

In addition to having a general lawful basis, we must meet an additional legal condition before processing this information.

Depending on the circumstances, we may process special-category information where:

  • it is necessary for medical diagnosis, assessment, treatment or the provision and management of health or social care;
  • the information is processed by, or under the responsibility of, a professional who is subject to an obligation of confidentiality;
  • you have given explicit consent for a particular optional use;
  • it is necessary to protect vital interests where you are physically or legally unable to consent;
  • it is necessary for the establishment, exercise or defence of legal claims;
  • it is necessary for an appropriate safeguarding or substantial public-interest purpose permitted by law.

We will only collect and use health information that is relevant to the assessment, safety, delivery and administration of your care.

8. Joint working between The Emerge Clinic and Devany Medical Ltd

The Emerge Clinic and Devany Medical Ltd may share relevant information with one another where this is necessary to:

  • assess whether the programme is appropriate and medically safe;
  • coordinate medical and psychotherapeutic care;
  • arrange appointments and treatment;
  • monitor risk, physical observations and psychological wellbeing;
  • respond to a medical or psychological concern;
  • maintain continuity of care;
  • investigate a complaint, incident or safeguarding concern.

Information will only be shared where it is relevant to the recipient’s role.

The organisations maintain separate record systems. Information entered into one organisation’s records is not necessarily reproduced in full within the other organisation’s system.

Each organisation is responsible for:

  • maintaining the accuracy and security of the records it holds;
  • limiting access to authorised individuals;
  • responding appropriately to data breaches;
  • complying with retention requirements;
  • assisting with requests from individuals exercising their rights.

The Emerge Clinic and Devany Medical Ltd maintain arrangements governing their respective data-protection responsibilities.

9. Who we may share information with

Information will ordinarily only be accessed by Paul Gibson and Dr Adam Devany as necessary for their respective roles.

Where relevant and lawful, information may also be shared with:

  • your GP;
  • your psychiatrist;
  • your cardiologist;
  • another consultant or healthcare professional involved in your care;
  • a laboratory, phlebotomy provider or diagnostic service;
  • an emergency-contact person, where authorised or necessary in an emergency;
  • emergency services;
  • safeguarding authorities;
  • a professional supervisor, subject to professional confidentiality and data minimisation;
  • our insurers, legal advisers, accountants or professional advisers;
  • regulators, courts, law-enforcement bodies or public authorities where disclosure is legally required;
  • carefully selected IT, website, email, secure-storage, payment or administrative service providers acting on our instructions.

Where we seek information from a GP, psychiatrist, cardiologist or another professional, we will ordinarily ask for your consent before contacting them.

We will not ordinarily disclose information to a spouse, partner, relative, friend or employer without your authority.

We may disclose information without consent where:

  • there is an immediate or serious risk of harm to you or another person;
  • there is a safeguarding concern involving a child or an adult at risk;
  • urgent disclosure is necessary for medical care;
  • disclosure is required by law, court order or a regulatory authority;
  • it is necessary to establish, exercise or defend a legal claim.

Where possible and appropriate, we will discuss such a disclosure with you before it is made.

We do not sell personal information.

10. Confidentiality

Information disclosed during assessment, medical care and psychotherapy is treated confidentially.

Confidentiality is not absolute. It may be necessary to disclose relevant information where:

  • we believe there is a serious and immediate risk to you;
  • we believe another person may be at serious risk;
  • there is a safeguarding concern;
  • urgent medical intervention is required;
  • we are required to disclose information by law;
  • disclosure is necessary in connection with a legal, regulatory, insurance or professional matter.

Any disclosure will be limited, where reasonably possible, to the information necessary for the particular purpose.

11. How long we retain information

We do not retain personal information indefinitely. Different categories of information are retained for different periods according to their clinical, legal, financial, professional and insurance purposes.

Our general retention periods are:

Initial enquiries that do not proceed

Enquiry correspondence and preliminary information will ordinarily be retained for up to 12 months from the date of the last meaningful contact.

We may retain limited information for longer where this is necessary to record a clinical-suitability decision, manage risk, respond to a complaint or establish or defend a legal claim.

Adult clinical and psychotherapy records

Clinical, medical and psychotherapy records will ordinarily be retained for eight years following the date of the patient’s last treatment or last clinical contact.

A longer period may apply where:

  • there is an ongoing complaint or legal claim;
  • a serious incident or safeguarding concern has occurred;
  • our insurer, regulator or another applicable legal requirement requires longer retention;
  • the record has continuing clinical relevance;
  • deletion would be inappropriate because of an identified risk.

The Emerge Clinic currently provides services to adults only. Should services ever be provided to a person under 18, a different retention period would apply.

Financial and transaction records

Invoices, payment records and accounting information will ordinarily be retained for at least six years after the end of the relevant financial year, or for any longer period required by tax or company law.

Complaints, incidents and safeguarding records

These records may be retained for the period necessary to investigate and resolve the matter and for any additional period required for legal, regulatory, insurance or safeguarding purposes.

Website information and cookies

Website logs, analytics information and cookies are retained for the periods described in our cookie settings or by the relevant service provider.

At the end of the applicable retention period, information will be securely deleted, destroyed or anonymised unless there is a lawful reason to retain it.

We may periodically review and reduce the information retained so that we do not keep more information than is necessary.

12. How we protect information

We take reasonable and proportionate measures to protect personal information against:

  • unauthorised access;
  • accidental loss;
  • alteration;
  • disclosure;
  • destruction;

Measures may include:

  • secure medical-records software;
  • secure cloud storage;
  • password protection and access controls;
  • multi-factor authentication where available;
  • encryption provided by our systems and service providers;
  • secure physical storage of paper records;
  • limiting access to people who genuinely require it;
  • confidentiality obligations;
  • secure backup and disposal arrangements;
  • appropriate contracts with service providers;
  • procedures for recognising and responding to data breaches.

Paper records are stored securely and are not left accessible to unauthorised people.

Although we take appropriate precautions, no internet, email or electronic-storage system can be guaranteed to be entirely risk free.

13. Email and electronic communication

Email and ordinary electronic messaging may not always be completely secure.

Please avoid sending information that is not necessary. Where particularly sensitive or extensive medical information is required, we may recommend a more secure method of transfer.

We will use the contact details you provide to communicate with you about enquiries, appointments, assessments, treatment and administration.

You are responsible for informing us if your contact details change or if it is no longer safe or appropriate for us to use a particular method of communication.

14. Information stored or accessed outside the United Kingdom

Some providers of website, email, cloud-storage, analytics, payment or communication services may store or access information outside the United Kingdom.

Where personal information is transferred internationally, we will take reasonable steps to ensure that an appropriate legal safeguard is in place. Depending on the destination, this may include:

  • a UK adequacy regulation;
  • approved contractual data-protection clauses;
  • another transfer mechanism permitted under UK data-protection law.

We seek to use reputable providers that maintain appropriate security and data-protection safeguards.

15. Your data-protection rights

Depending on the circumstances, you may have the right to:

  • be informed about how your information is used;
  • request access to personal information held about you;
  • request correction of inaccurate or incomplete information;
  • request deletion of information in certain circumstances;
  • request that processing be restricted;
  • object to certain types of processing;
  • receive certain information in a portable format;
  • withdraw consent where processing is based on consent;
  • object to direct marketing;
  • complain to the Information Commissioner’s Office.

These rights are not absolute. For example, we may need to retain clinical information despite a request for deletion where it is needed for ongoing care, patient safety, legal compliance, insurance purposes or the establishment or defence of legal claims.

We will not usually charge a fee for responding to a request. We may request proof of identity before releasing information.

We will ordinarily respond within one month. This period may be extended where a request is particularly complex or involves a large amount of information, as permitted by law.

To exercise your rights, contact:

Email: hello@theemergeclinic.co.uk
Address: St Georges Works, 51 Colegate, Norwich, Norfolk, England, NR3 1DD

Because The Emerge Clinic and Devany Medical Ltd hold information on separate systems, we may need to liaise with Devany Medical Ltd to provide a complete response. You may also contact Devany Medical Ltd directly in relation to records held within its medical system.

16. Access to health and psychotherapy records

You may request access to the personal information and clinical records held about you.

Before releasing health or psychotherapy records, we may need to review them to determine whether an exemption applies. In limited circumstances, information may be withheld or redacted where disclosure would:

  • be likely to cause serious harm to your physical or mental health or that of another person;
  • reveal confidential information about another person;
  • prejudice an applicable safeguarding, legal or regulatory process;
  • otherwise fall within an exemption provided by law.

Where information is withheld, we will explain this unless the law prevents us from doing so.

17. Correction of records

You may ask us to correct information that is factually inaccurate.

Clinical records may contain professional opinions, observations or information recorded at a particular time. Where there is a disagreement about a clinical opinion rather than a factual error, we may retain the original entry and add a note recording your objection or clarification.

We will not ordinarily delete or rewrite an accurate historic record merely because circumstances or opinions have subsequently changed.

18. Automated decision-making

We do not make decisions about your eligibility, suitability or treatment solely through automated decision-making.

Clinical-suitability decisions are made by appropriately involved practitioners after considering the relevant information.

We may use website analytics to understand how visitors use the website, but this is not used to make automated clinical decisions about you.

19. Marketing

We will only send general marketing or promotional communications where we have a lawful basis to do so.

Where we rely on your consent, you may unsubscribe at any time by:

  • using the unsubscribe option in the communication;
  • contacting us at hello@theemergeclinic.co.uk.

Choosing not to receive marketing will not affect your ability to enquire about or receive services.

We do not use sensitive medical or psychotherapy information for unrelated marketing.

20. Testimonials and case studies

We will not publish your name, photograph, testimonial, treatment story or other identifiable information without your explicit agreement.

Where possible, case material used for education or service information will be anonymised.

You may withdraw consent to future use of identifiable testimonial or case-study material. Withdrawal may not always enable us to retrieve material that has already been lawfully printed, published or distributed, but we will stop future use where reasonably possible.

Cookie Policy

21. What are cookies?

Cookies are small text files placed on your computer, tablet or mobile device when you visit a website.

They can be used to:

  • make a website function correctly;
  • remember choices and preferences;
  • maintain website security;
  • understand how visitors use a website;
  • improve performance and accessibility;
  • support embedded services such as videos or maps.

Some technologies perform similar functions without using conventional cookie files. References to cookies in this policy include similar storage and access technologies where applicable.

22. Types of cookies we may use
Strictly necessary cookies

These cookies are necessary for the website to function or to provide a service you have requested.

They may be used for:

  • website security;
  • managing network traffic;
  • remembering your privacy choices;
  • enabling forms to function;
  • maintaining essential website features.

Strictly necessary cookies do not normally require consent, although we will still provide information about them.

Preference or functional cookies

These cookies allow the website to remember choices you have made, such as display or accessibility preferences.

Where these cookies are not strictly necessary, they will only be used with your consent.

Analytics cookies

Analytics cookies help us understand how visitors use the website, for example:

  • which pages are visited;
  • how visitors reached the website;
  • how long visitors remain on a page;
  • whether errors occur;
  • which devices or browsers are used.

Where consent is legally required, analytics cookies will remain disabled unless and until you accept them.

Embedded and third-party content

Some pages may contain content provided by third parties, such as:

  • videos;
  • maps;
  • social-media content;
  • booking tools;
  • external forms.

These providers may place cookies or collect technical information when the content loads. Non-essential embedded content should not place cookies before you have given the required consent.

Advertising cookies

We do not intend to use advertising or behavioural-tracking cookies unless they are clearly identified within the website’s cookie controls.

Should such cookies be introduced, they will remain disabled until valid consent has been obtained.

23. Your cookie choices

When you first visit the website, you may be presented with a cookie banner or settings panel.

You should be able to:

  • accept non-essential cookies;
  • reject non-essential cookies;
  • select particular categories;
  • change your preferences later.

Rejecting non-essential cookies should be as straightforward as accepting them.

Strictly necessary cookies cannot always be disabled through the website because the website may not function properly without them.

You can also control or delete cookies through your browser settings. Blocking all cookies may affect the operation of some website features.

24. Cookie duration

Some cookies are deleted when you close your browser. These are known as session cookies.

Other cookies remain on your device for a defined period or until you delete them. These are known as persistent cookies.

The name, provider, purpose and duration of individual cookies should be available through the website’s cookie settings panel or cookie declaration.

25. Third-party cookie providers

Where our website uses third-party tools, the relevant provider may process information according to its own privacy policy.

We will periodically review the tools used on our website and seek to ensure that non-essential technologies are correctly identified and controlled through our consent mechanism.

26. Children

The Emerge Clinic provides its programme to adults aged 18 and over.

Our website and services are not directed at children. If information concerning a child is provided in connection with an adult patient’s care or a safeguarding concern, it will be handled confidentially and only used where relevant and lawful.

27. Complaints about the use of information

Please contact us first if you have a concern about how we have handled your personal information. We will attempt to investigate and resolve the matter.

Email: hello@theemergeclinic.co.uk
Address: St Georges Works, 51 Colegate, Norwich, Norfolk, England, NR3 1DD

You also have the right to complain to the Information Commissioner’s Office, the United Kingdom’s independent data-protection regulator.

Information about making a complaint is available through the Information Commissioner’s Office website.

28. Changes to this policy

We may update this policy to reflect:

  • changes to our services;
  • changes to the organisations or systems involved;
  • changes in legal or regulatory requirements;
  • changes to the cookies or technologies used on our website.

The latest version will be published on this page with its updated review date.

Where a change materially affects how current patients’ information is used, we will take reasonable steps to bring it to their attention.

29. Contact us

Questions about this Privacy and Cookie Policy or the use of your information should be sent to:

The Emerge Clinic
A trading name of KetaClinics Ltd

Email: hello@theemergeclinic.co.uk
Postal address: St Georges Works, 51 Colegate, Norwich, Norfolk, England, NR3 1DD

For questions specifically concerning medical records held by Devany Medical Ltd, you may contact:

Devany Medical Ltd
Email:
consult@dradamclinic.com
Address:
Progress House
Church Road
Gorleston
NR31 6NP