Dr Andreas Schenk Ltd Data Privacy Notice and Retention Policy

Last updated April 2026

1.       Introduction

Dr Andreas Schenk Ltd is committed to processing your personal data in a fair and transparent manner. This privacy notice lets you know what happens to the personal data that you give to us, or any other information that we may receive from you or about you from other professionals or organisations.

This privacy notice applies to personal information processed by, or on behalf of, Dr Andreas Schenk Ltd, herein referred to as “we”, and includes all contact made through and appointments booked via southernpsychiatry.com and aviationpsychiatrist.com.

For the purpose of applicable Data Protection legislation, including UK GDPR and the Data Protection Act 2018, the organisation responsible for your personal data, and referred to as the Data Controller, is Dr Andreas Schenk Ltd, which is registered with the Information Commissioner’s Office under the registration number ZB886016.

This Notice describes how we collect, use, and process your personal data, and how in doing so, we comply with our legal obligations to you.

What personal data we collect

We collect the following categories of personal data from you or third parties:

Identity Data: We collect basic personal data about you, which includes name, address, telephone number, email address, date of birth, next of kin information, ID number/CAA Applicant number etc. This enables us to provide assessments for occupational health and aviation regulatory purposes and advise on the appropriate treatment for you.

Special Category Health Data: This includes details about your mental health status, history, symptoms, and any related conditions or treatments. We will also collect sensitive confidential information known as “special category personal data,” in the form of other health information, religious beliefs, (if required in a healthcare setting) ethnicity, sexuality, biometric data (if applicable). This is "special category data" under UK GDPR and is treated with the highest level of care and security.  

3.       Your rights regarding your personal information

As an individual you have the following rights in relation to your personal information:

1.       Right to be informed – You have the right to be informed about how we collect and use your personal data. This Privacy Notice fulfils that right. We will update this notice on a regular basis to ensure you continue to be appropriately informed of how your personal information will be used.

2.       Right to access your personal information– You have the right to access your own personal information, as well as information relating to processing activities, and receive a copy of that information. This right is commonly referred to as a Subject Access Request (SAR). Please be mindful that when we release information to satisfy a Subject Access Request the information is for the personal use of the requestor only. It is not to be shared with anybody else and not to be used inappropriately, for example posting onto social media sites.  Individuals can be subject to prosecution for posting information in the public domain as ruled by the High Court.

3.       Right to rectification – You have the right to have inaccurate personal data corrected, or completed if it is incomplete. The correction of personal data when incorrect, out of date or incomplete will be rectified by Dr Andreas Schenk Ltd without undue or excessive delay. If, however, such requests are linked to legally or regulatory significant matters, we may require proof of any alleged inaccuracy before we are able to rectify the information held. Please note that it is not possible for us to retrospectively alter clinical observations/assessments or correct information supplied by other healthcare professionals.

4.       Right to erasure or ‘right to be forgotten’ - You have the right to request the deletion or removal of your personal data in certain circumstances. The right is not absolute and only applies in certain circumstances, for example when your personal data is no longer necessary for the purpose for which it was originally collected or processed. The right to erasure may be overridden by legal/professional obligations for example British Medical Association (BMA) guidance for retaining mental health records or the Civil Aviation Authority (CAA)'s mandated retention periods for aviation medical records. We will inform you if this is the case. 

5.       Right to restrict processing – You have the right to request that we restrict the processing of your personal data in certain situations, where you have a particular reason for wanting the restriction. This means that you can request that the way we use your data be limited. This right may be overridden in situations for example where information needs to be processed for the purpose of safeguarding or ensuring public safety, for example as when required by the DVLA or CAA.

6.       Right to data portability – You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit this data to another controller, where processing is based on your consent and carried out by automated means.

7.       Right to object to processing – You have the right to object to the processing of your personal data in certain circumstances, for example, for direct marketing purposes. However, if we can demonstrate compelling legitimate grounds to process your information then processing can continue. For example, it would be very difficult for us to assess and treat you or provide reports for occupational health/aviation regulatory purposes if we did not process any personal information about you and your health care needs.

8.       Rights in relation to automated decision making and profiling – Automated individual decision-making is a decision made by automated means (i.e., a computer system) without any human intervention. If any of the processes we use rely on automated decision making, you do have the right to ask for a human to review any computer-generated decision at any point.

How to Exercise Your Rights:

To exercise any of these rights, please contact our Data Protection Officer (DPO) at info@southernpsychiatry.com.

In the case of a Subject Access request (SAR) we will respond to your request within one month, although this period may be extended by a further two months if the request is complex or we receive a number of requests. We will inform you of any such extension. 

You can also make SAR requests via the following methods:

-              By Post to the following address: Dr Andreas Schenk Ltd, Nuffield Health Bournemouth Hospital,  67-71 Lansdowne Road, Bournemouth,  BH1 1RW,  United Kingdom

-              Verbally when engaged in a call or consultation with a member of our team.

We do not usually charge a fee to exercise your rights and you will usually receive your information within one calendar month from the date of request, unless your request is manifestly unfounded, repetitive, or excessive. For complex requests we are entitled to apply an extension of a further 2 months, but you will be informed of this as soon as possible to manage your expectations. To validate any request for information we will need to obtain proof of identity and in the case of third-party requests, the required authority to act must be provided before we can disclose any personal information.

4.       How we use your personal information and our lawful basis to use it

Explicit Consent: Prior to your first appointment you will usually be asked to complete a Client Information Form which asks for your explicit consent to process and share your information with the understanding that we are committed to protecting your privacy and maintaining your confidentiality and will not share your data with third parties for marketing purposes;  that your data will be processed on computers belonging to Dr Schenk and his personnel and stored thereon only for as long as is necessary to fulfil clinical, legal and accounting requirements; that your personal and clinical data will be stored on secure encrypted cloud servers; that your personal data/clinical information will be shared with your referring doctor or other clinicians/therapists that you agree to be referred to, or are directly involved in your care; that your anonymised data/clinical information may be used for clinical audit, care quality improvement, research, professional case discussion, publication or education and that we require your personal and confidential information in order to assist in assessing your medical fitness for an aviation medical certification and/or to provide you with healthcare services. Your explicit consent to these terms is confirmed when your return your completed Client Information Form and will remain in place unless you subsequently inform us that you withdraw consent for sharing of information or request to exercise your rights as listed in Section 3.

Under the UK GDPR we lawfully use your information in accordance with the following legal bases:

Article 6 (1)(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Article 6 (1)(c) processing is necessary for compliance with a legal obligation to which the controller is subject.

Article 9 (2)(h) processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems.

Dr Andreas Schenk Ltd may, however, choose an alternative legal basis dependent on the specific requirements and purpose of the data sharing.

We have set out in the table below conditions within UK GDPR that we rely on when we use your data:

5.       Electronic Storage and Security of Personal Data

Your personal data is stored in secure cloud storage platforms such as Tresorit and Cliniko which require two step verification access and meet UK GDPR data protection compliance requirements. Any handwritten or dictated notes are securely shredded with a cross cut shredder as soon as the clinic letters have been completed. Only information which needs to be stored for medical, legal or other purposes listed in Section 4 is retained in secure storage and any other information containing personal information is immediately deleted from local computers.  Personal information is encrypted in transit with secure password protected documents or links. Access to your personal data is strictly limited to authorised personnel who are experienced and trained in data protection and security.

6.       Who We Share Your Personal Data With

To facilitate psychiatric assessment and treatment, we will share your personal data, including information on your mental health, with the following parties:

-          Your referring doctor, occupational health consultant or mental health professional

-          Your NHS GP

-          Clinicians or therapists that you agree to be referred to, or are directly involved in your care

To facilitate the assessment of your medical fitness for Aviation Medical Certification, we will share your personal data, including information on your mental health, with the following parties:

-          The UK Civil Aviation Authority (CAA): As the regulatory body for aviation safety in the UK, the CAA requires this information to make decisions regarding your medical certification. The CAA will act as a separate data controller for the data it receives. 

-          Occupational Health Doctors/Authorised Aeromedical Examiners (AMEs): AMEs who are involved in assessing your medical application will have access to your information to perform their duties.

With your consent and at our discretion we may also share your personal data in response to information requests from Private Medical Insurers, Income Protection Insurance Companies or other Companies/Parties who have a legitimate interest in your data. Under such circumstances prior consent for release of information may have already been obtained from you by the requesting Party.

7.       Data Retention

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any healthcare, legal, regulatory, accounting, or reporting requirements. Once your data is no longer required for these purposes, it will be securely deleted.

Given the nature of the services we provide, we adhere to the guidelines of the BMA and the NHS Records Management Code of Practice for Health and Social Care and national archives requirements. Adult Mental Health Records are required to be retained for a period of 20 years or 10 years after death.

The retention periods for your mental health data submitted for aviation licensing are determined by the UK Civil Aviation Authority (CAA).

8.       Complaints

If you have any concerns about how your personal information is being managed, please contact our Data Protection Officer in the first instance:

Post: Dr Andreas Schenk Ltd, Nuffield Health Bournemouth Hospital,  67-71 Lansdowne Road, Bournemouth,  BH1 1RW,  United Kingdom

Email: info@southernpsychiatry.com

You also have the right to lodge a complaint with the Information Commissioner’s Office using the contact details below:

Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Tel: 01625 545745

Website contact: https://ico.org.uk/

9.       Changes to This Privacy Notice

This Privacy Notice is subject to change for operational, legal, or regulatory reasons. Updated privacy notices/links thereto will be posted on southernpsychiatry.com and aviationpsychiatrist.com