Last updated: April 2026
Who We Are
Dr Cassie & Associates ("we", "us", "our") is a specialist neurodevelopmental clinic registered with the Care Quality Commission (CQC), based at The Stables 3 and The Cottage, Howbery Park, Wallingford, Oxfordshire OX10 8BA (reception at The Stables 3). We are the data controller for the personal information we collect about you.
Information We Collect
When you contact us or attend an assessment, we may collect the following types of personal information:
- Contact details: name, email address, phone number, postal address
- Patient details: name, date of birth, GP details, presenting concerns
- Medical history: relevant past diagnoses, medications, school reports, prior assessments
- Assessment data: notes, questionnaire responses, observations made during clinical assessments
- Payment information: billing details (we do not store full card numbers)
How We Use Your Information
We use your personal data only for the following purposes:
- To provide clinical assessments, diagnosis, treatment, and ongoing care
- To prepare detailed reports and share them with you, your GP, school, or other professionals (with your consent)
- To communicate with you about appointments, prescriptions, and follow-up care
- To process payments and maintain accurate financial records
- To meet our legal, regulatory, and clinical governance obligations
- To improve our services through anonymised feedback and audit
Legal Basis
Under UK GDPR, we process your data on the following lawful bases:
- Consent — when you actively agree to certain processing (e.g. sharing reports with third parties)
- Contract — to fulfil our agreement to provide assessment and care services
- Legal obligation — to comply with healthcare regulations and CQC requirements
- Vital interests — in rare situations where someone's safety is at risk
- Legitimate interests — for clinical audit, service improvement, and business administration
How Long We Keep Your Data
We retain clinical records in line with NHS guidance on retention periods. For adults, this is usually 8 years after the date of last contact. For children, records are kept until the patient's 25th birthday (or 26th if the patient was 17 at last contact). After this period, records are securely destroyed.
Sharing Your Information
We will only share your personal data when it is necessary and lawful to do so. This may include:
- Your GP or other healthcare professionals involved in your care (with your consent)
- Schools and educational professionals (with your consent, e.g. for EHCP applications)
- Regulatory bodies such as the CQC, where required by law
- Our secure IT and clinical software providers, under strict data processing agreements
We will never sell your personal information or share it for marketing purposes without your explicit consent.
Your Rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you (Subject Access Request)
- Request correction of inaccurate or incomplete data
- Request erasure of your data, subject to legal retention requirements
- Object to or restrict how we process your data
- Withdraw consent at any time, where consent was the basis for processing
- Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk
How to Contact Us
If you have any questions about this policy or want to exercise any of your rights, please email enquiries@drcassie.co.uk or write to us at the address above. We will respond within one month.