Your privacy

Privacy policy

We take the privacy of your personal and health information seriously. This policy explains what we collect, why, how we keep it safe, and your rights under UK data protection law.

Last updated: October 2026

We never sell your dataYour information is used only to provide and improve your care.

Your GP only with permissionWe share clinical information only when you agree, or the law requires it.

You’re in controlAsk to see, correct or delete your data, or unsubscribe, at any time.

01Who we are

CogMission (CogMission Limited, a company registered in Scotland, company number SC586535) is a brain health clinic based at 4 Albyn Place, Edinburgh EH2 4NG. We are the data controller for the personal information described in this policy.

Each of our clinical directors is registered with the Information Commissioner’s Office (ICO):

Charmaine Shepherd (registered as Edinburgh Health Limited): ICO registration number ZB161797
Jean Dow (registered as Jean Dow Herbalist Ltd): ICO registration number ZA190290

If you have any questions about this policy or how we use your information, contact us at info@cogmission.co.uk, call 0131 235 1238, or write to us at the address above.

02Information we collect

We only collect the information we need. Depending on how you use our services, this may include:

Type	Examples
Contact details	Name, email address, phone number, postal address
Enquiry details	What you tell us in a message, on a call or in our contact form
Health information	Medical and family history, symptoms, medicines, lifestyle, cognitive assessment results, blood and other test results, clinical notes and treatment plans. AI transcripts are used to create clinical notes, but these are immediately deleted once their clinical notes are generated
Family or carer details	Name and contact details of a relative or carer who contacts us or joins appointments
Payment details	Invoices and payment records. Card payments are handled securely by our payment provider; we do not store full card numbers
Workplace programmes	Organisation name, contact details and booking information. Workshop feedback is collected anonymously where possible
Cognitive Decline Evaluation	Name, email and phone number of the client (and of the carer, if a carer completes it), and the answers given on our online self-evaluation. This is health information, and we only store it with your consent
Website and newsletter	Email address for our tips newsletter, and basic technical data such as cookies (see below)

Health information is “special category” data under UK data protection law, and we give it extra protection.

03How we use your information

to respond to your enquiry and arrange your free call
to provide assessments, testing and personalised programmes
to arrange laboratory tests and visiting phlebotomy
to communicate with you about appointments, results and your care
to take payment and keep financial records
to send our newsletter, if you have signed up
to deliver workplace programmes agreed with your employer
to meet our legal, regulatory and professional obligations
to improve our services and keep our website secure

We never sell your personal information, and we do not use it for automated decision-making.

04Our legal basis

Under the UK General Data Protection Regulation (GDPR) we must have a lawful basis for using your information:

Purpose	Lawful basis
Providing your care and programme	Contract with you, or steps you ask us to take before entering one
Using your health information	Provision of health care by or under the responsibility of a health professional (UK GDPR Article 9(2)(h)), and where appropriate your explicit consent
Replying to enquiries	Our legitimate interests in responding to you, or steps before a contract
Newsletter	Your consent, which you can withdraw at any time
Accounts, tax and records	Legal obligation
Website security and improvement	Our legitimate interests

06International transfers

Some of our service providers or laboratories may store or process data outside the UK. When this happens we make sure appropriate safeguards are in place, such as UK adequacy regulations or the ICO’s International Data Transfer Agreement. [Confirm whether any lab or system is outside the UK.]

07How long we keep it

Information	How long
Clinical records	7 years after your last contact with us, in line with professional and records-management guidance. AI transcripts are used to create clinical notes, but these are immediately deleted once their clinical notes are generated
Enquiries that don’t lead to care	Up to 12 months
Financial records	6 years, as required by HMRC
Online self-evaluations	Up to 12 months if they don’t lead to care; if you become a client, they form part of your clinical record
Newsletter	Until you unsubscribe

After this, information is securely deleted or destroyed.

08Keeping it safe

We use appropriate technical and organisational measures to protect your information, including secure, access-controlled systems, encryption where appropriate, staff confidentiality and training, and secure storage of paper records. Everyone at CogMission is bound by professional duties of confidentiality.

09Your rights

Under UK data protection law you have the right to:

Accessa copy of the information we hold about you

Correctionof anything inaccurate or incomplete

Erasurein some circumstances (some clinical records must be kept)

Restrictionof how we use your information

Objectionto processing based on legitimate interests

Portabilityof information you gave us, in a usable format

Withdraw consentat any time, where we rely on it

To use any of these rights, email info@cogmission.co.uk. We’ll respond within one month, and there is usually no charge.

10Cookies and our website

Our website uses essential cookies so it works properly. With your consent, we also use analytics cookies to understand how visitors use the site. You can accept or decline them on the cookie banner, and change your choice at any time with “Cookie settings” at the bottom of every page.

Your cookie choice (essential): saved in your browser for 6 months so we don’t ask again on every page.
Google Analytics (analytics, only if you accept): the cookies _ga and _ga_LQQKVGDJ41, which last up to 2 years. They count visits and show which pages are used, without telling us who you are. Google processes this data and may transfer it outside the UK.
YouTube videos: our videos use YouTube’s privacy-enhanced mode, so YouTube only sets cookies once you press play.

We don’t use advertising or marketing cookies.

Our site links to other websites, including YouTube, Facebook, Instagram and LinkedIn. Their own privacy policies apply when you visit them.

12Children

Our services are for adults. We do not knowingly collect information from children under 16.

13Complaints

If you’re unhappy with how we’ve handled your information, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, or call 0303 123 1113.

14Changes to this policy

We may update this policy from time to time. The latest version will always be on this page.