Policies

Privacy Policy & Data Protection Notice

ADHD Professionals Ltd - Privacy Policy & Data Protection Notice
Document Ref: Privacy-Notice-V1 | Effective Date: 30/06/2026 | Governance Reference: IGCS-V1 & RMDP-V1

1. Introduction & Data Controller Information
ADHD Professionals Ltd is committed to protecting the privacy, confidentiality, and security of all personal and special category health data entrusted to us. As a specialist clinical service delivering remote adult ADHD assessments and care, we process personal data in strict compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Caldicott Principles, and guidelines established by the Care Quality Commission (CQC).

This Privacy Policy outlines how ADHD Professionals Ltd collects, uses, stores, retains, and shares your information, as well as detailing your statutory data rights.

Data Controller & Contact Details
ADHD Professionals Ltd acts as the Data Controller for all patient and service-user information.
Company Name: ADHD Professionals Ltd
Data Protection Officer (DPO): Designated DPO Oversight Team
Email Contact: info@adhd-professionals.com
Operational Hours: Monday to Friday, Standard Business Hours

Our Data Protection Officer oversees organizational compliance, conducts Data Protection Impact Assessments (DPIAs) for clinical technologies, and acts as the primary contact for regulatory bodies, including the Information Commissioner's Office (ICO).

2. Categories of Data Collected
To provide safe, evidence-based, and personalized clinical assessments, we collect and process several categories of information:

Personal Identifiable Data (PID)
Identity Data: Full name, date of birth, title, and preferred identity details.
Contact Data: Email address, primary telephone number, home address, and emergency contact details.
Financial & Billing Data: Payment transaction details, invoicing history, and third-party payment processing identifiers (processed via secure payment providers such as Stripe/Klarna).
Administrative Data: Records of communications, call-back requests, consent records, and administrative notes.

Special Category Health Data
Clinical Assessment Records: Baseline screening forms, standard referral details, childhood developmental history, and functional impairment forms.
Psychiatric & Medical History: Diagnostic formulations, clinical interview notes, co-occurring condition screenings (e.g., anxiety, depression, autism, sleep disorders), and previous medical assessments.
Informant Data: Questionnaires and behavioral observations provided by third parties (e.g., family members or partners) with consent.
Care & Treatment Plans: Clinical outcome reports, workplace/educational adjustment recommendations, and titration records.

3. Lawful Basis for Processing Data
Under Articles 6 and 9 of the UK GDPR, we process personal and health data only when a defined legal gateway exists:

Data Category: Identity & Contact Details
Purpose: Appointment scheduling, service communication, pre-assessment onboarding.
UK GDPR Article 6 basis: Article 6(1)(b), performance of a contract.
UK GDPR Article 9 basis: Not applicable.

Data Category: Clinical & Diagnostic Data
Purpose: Conducting ADHD assessments, formulating diagnostic reports, recommendations.
UK GDPR Article 6 basis: Article 6(1)(b), performance of a contract; Article 6(1)(f), legitimate interests.
UK GDPR Article 9 basis: Article 9(2)(h), provision of health or social care treatment.

Data Category: Informant Questionnaires
Purpose: Collateral developmental history gathering.
UK GDPR Article 6 basis: Article 6(1)(f), legitimate interests.
UK GDPR Article 9 basis: Article 9(2)(h), provision of health care treatment.

Data Category: GP Sharing & Reports
Purpose: Transmitting outcome reports and treatment plans to primary care.
UK GDPR Article 6 basis: Article 6(1)(a), explicit consent.
UK GDPR Article 9 basis: Article 9(2)(a), explicit patient consent.

Data Category: Emergency Safeguarding
Purpose: Preventing serious harm or managing acute crisis situations.
UK GDPR Article 6 basis: Article 6(1)(d), vital interests; Article 6(1)(c), legal obligation.
UK GDPR Article 9 basis: Article 9(2)(c), protection of vital interests.

4. Electronic Health Record Storage & Cyber Security Standards
ADHD Professionals Ltd maintains rigorous technical and organizational safeguards to ensure data integrity and prevent unauthorized access or disclosure.

Electronic Health Record (EHR): All patient records, clinical notes, screening forms, and appointment logs are securely maintained in our central EHR platform, Cliniko.
Remote Telehealth Consultations: Video consultations are conducted via an enterprise-grade telehealth platform utilizing end-to-end encryption (AES-256 standard). Consultation logs and authorized attachments are encrypted both in transit and at rest.
Strict Hardware Security (Zero-BYOD Policy): All clinicians and administrative staff are issued dedicated, secure company devices. Personal laptops, tablets, or mobile phones (BYOD) are strictly prohibited from accessing clinical software or patient records.
Access Controls & Multi-Factor Authentication: Systems enforce Role-Based Access Control (RBAC), complex alphanumeric passwords (minimum 12 characters with special symbols), and mandatory Multi-Factor Authentication (MFA). Active screens automatically lock after 5 minutes of inactivity.
Secure Document Transmission: Medical reports, shared care recommendations, and diagnostic letters are never transmitted via standard, unencrypted text email. All exported documents are password-protected or sent via encrypted messaging tools. Administrative staff perform mandatory double-checks of recipient email addresses and dates of birth prior to dispatch.

5. Information Sharing & Safeguarding Boundaries
We respect patient confidentiality and adhere strictly to Caldicott Guardian principles. Patient information is shared only under defined, lawful circumstances:

Sharing with Primary Care (GPs): Diagnostic reports and clinical recommendations are shared with your registered NHS or private GP only when explicit consent is provided.
Safeguarding & Emergency Exceptions: Explicit consent is not required where disclosure is necessary to protect your vital interests or those of another individual, during acute psychiatric emergencies, or where required by law (e.g., severe safeguarding risks).
Regulatory Oversight: Information may be disclosed to statutory oversight bodies, such as the Care Quality Commission (CQC) or Information Commissioner's Office (ICO), strictly where legally mandated for quality assurance and governance audits.
Data Processor Agreements: Third-party software infrastructure providers (e.g., Cliniko) process data solely under formal Data Processing Agreements guaranteeing strict UK GDPR alignment.

6. Records Management, Retention & Safe Destruction
In compliance with standard healthcare governance and NHS Records Management guidelines, clinical files are subject to defined retention lifespans:

Retention Schedule: Psychiatric records, assessment notes, diagnostic reports, and associated clinical summaries are retained for a minimum of 20 years following the date of last discharge or treatment (or 8 years after death if sooner).
Audit Logging: Every patient interaction, phone consultation, triage note, and document modification is tracked within an uneditable digital audit trail in the EHR.
Safe Destruction Protocol: Upon expiration of the required statutory retention period, digital records are purged using DoD-compliant multi-pass data shredding algorithms executed by our EHR provider. Formal Certificates of Destruction are logged in our compliance register.

7. Your Data Protection Rights under UK GDPR
Under UK data protection law, service users possess clear statutory rights regarding their personal data:

Right of Access (Subject Access Request - SAR): You have the right to request a copy of all personal data and clinical records held by ADHD Professionals Ltd.
Cost: Subject Access Requests are processed completely free of charge.
Response Time: Fulfilled within one calendar month following identity verification.
Verification: Identity must be confirmed via photographic ID and signature matching prior to file disclosure.
Clinical Redaction Pass: In accordance with UK law, exported record bundles are audited by a senior clinician. Text will be redacted if it contains identifiable information regarding a third party who has not consented, or if the clinician determines that disclosure would cause serious harm to the physical or mental health of the patient or another person.
Right to Rectification: You may request corrections to inaccurate personal details (e.g., address, phone number, misspelt names). Clinical opinions and diagnostic findings recorded by clinicians cannot be retroactively altered, but supplementary notes can be appended.
Right to Erasure ('Right to be Forgotten'): You may request the deletion of your personal data. Please note that this right is overridden by statutory medical record retention rules requiring us to store healthcare files for 20 years.
Right to Restrict Processing: You can request that we restrict processing of your data under specific conditions.
Right to Data Portability: You may request the transfer of administrative data to another clinical provider in a structured format.
Right to Object: You may object to data processing activities based on legitimate interests.

8. How to Exercise Your Rights & Complaints Procedures
Contacting the Data Protection Officer
To submit a Subject Access Request, exercise any data rights, or ask questions regarding our privacy practices, please contact our DPO team:
Email: info@adhd-professionals.com
Postal Address: ADHD Professionals Ltd, Subject Access & Compliance Department

We aim to resolve all data enquiries promptly and transparently.

Escalation to the Information Commissioner's Office (ICO)
If you are unsatisfied with our response or believe your data is being processed unlawfully, you have the right to lodge a formal complaint with the UK data protection regulator:
Regulatory Body: Information Commissioner's Office (ICO)
Website: https://ico.org.uk/
Helpline: 0303 123 1113