Privacy and Data Protection
DATA PRIVACY & SECURITY
Sensitive information deserves more than a privacy notice.
MHAI may process health information, AI conversations, reports and personal history. We design the service to reduce unnecessary access and separate identity information from submitted health information wherever practical.
How the process works:
- You register and pay.
- An authorised administrator creates your client reference.
- The restricted linking record connects your contact details to that reference.
- You upload information using the reference rather than your name.
- Reviewers receive the information needed for their role.
- Identity is reconnected only where necessary for consultation, care, safeguarding, billing or legal obligations.
What we may collect
- Contact and payment information
- Information you choose to submit
- AI-generated summaries or conversations
- Health and treatment history
- Relevant documents
- Consultation notes
- Plans and review information
- Consent and communication preferences
Why we use it
- To deliver the requested service
- To assess suitability
- To support safety and safeguarding
- To prepare recommendations
- To coordinate consented care
- To meet legal and professional obligations
- To improve the service using appropriately anonymised operational information
What we will not do
- Sell your health information
- Use your personal health information for advertising
- Use your submitted content to train a general AI model without a separate, explicit agreement
- Share information with an employer or provider without a lawful basis and appropriate consent, except where required by law or urgent safety duties
Third-party AI warning
If you use ChatGPT, Claude, Gemini or another AI to prepare your information, that provider’s terms and privacy controls also apply. You should remove information you do not want to share and review the privacy settings of the service you use.
Retention, deletion & your rights
The final retention policy states how long each category of data is held, why it is held and how deletion or anonymisation works. Some clinical or legal records may need to be retained even after a deletion request.
You retain rights of access, correction, restriction, objection, portability and complaint, together with contact details for the data-protection lead and the Information Commissioner’s Office.