Privacy policy

This policy explains how ADHD Test Limited, trading as ADHD Simple, handles your personal and health information when providing services in the United Kingdom. We are responsible for that information under the UK GDPR, the Data Protection Act 2018 and applicable confidentiality law.

We are part of the group owned by Simple Health Technology Limited (New Zealand company 9316973). The operating companies are ADHD Test NZ Limited in New Zealand, ADHD Simple Pty Limited in Australia and ADHD Test Limited in the United Kingdom.

Employees, clinicians and contractors working for any of these companies must follow this policy when handling information for our UK service. Access is limited to what their role requires. Being in the same group does not give someone unrestricted access to your records.

If our terms and this policy differ about your information, this policy applies.

For a privacy question, access request, correction or complaint, email contact@adhdsimple.co.uk.

ADHD Test Limited. UK company number 16245886. We are the controller responsible for the UK service.

• Name, preferred name and previous names where relevant
• Date of birth
• Gender, pronouns and sex assigned at birth where clinically relevant
• Residential and postal address
• Email address
• Telephone numbers
• Emergency contact and next-of-kin details
• Family members, carers and support people that you nominate
• NHS, CHI or HSC number and other relevant healthcare identifiers
• Medical history
• Mental health history
• ADHD assessments
• Screening questionnaires
• Diagnoses
• Medications
• Allergies
• Blood pressure, pulse and other clinical observations
• Blood test, ECG, laboratory and imaging results, where relevant or provided to us
• Referral letters
• Hospital discharge summaries
• Specialist reports
• Clinical notes
• Treatment plans
• Prescriptions
• Appointment history
• Insurance information
• Billing and payment information
• Communications with us, including telephone calls, SMS, iMessage, WhatsApp, email and in-app messages
• Message and email metadata, including delivery, read, bounce and status information
• Audio recordings of telephone calls
• Audio and video recordings of consultations where applicable
• Recordings and transcripts of online meetings and video consultations where applicable
• Website and application usage information
• Device information, IP addresses and push notification device tokens
• Support and messaging metadata, including device and messaging identifiers used to route and deliver your messages
• Cookie identifiers, advertising and click identifiers, and campaign, referral and UTM data
• Security and audit logs
• Consent records
• Complaint records
• Information required for legal, regulatory, safeguarding or fraud prevention purposes

We use information to arrange and provide care, assess and treat you, issue prescriptions where appropriate, communicate with you, manage payments and your account, respond to complaints, keep services secure and meet our legal and professional duties.

• Care: your history, assessments, questionnaires, observations and treatment records help clinicians make safe decisions.

• Administration: contact, appointment and payment details help us run the service and keep you informed.

• Safety and legal duties: information may be needed for safeguarding, preventing fraud, handling claims and responding to lawful requests.

• Improvement and communications: we use proportionate information to understand service performance and, where permitted, send marketing. You can opt out of marketing at any time.

Our lawful bases. We rely on contract to arrange and provide the services you request; legal obligations for required records and disclosures; and legitimate interests for proportionate administration, security and service improvement. Where consent is required, including for particular optional uses, we ask for it. In an emergency, vital interests may apply.

Health information. Health data needs an additional legal condition. For diagnosis, treatment and managing healthcare we normally rely on UK GDPR Article 9(2)(h), with professional confidentiality and the safeguards required by the Data Protection Act 2018. Explicit consent, legal claims or another specific condition may apply to other uses where lawful. We do not treat acceptance of our terms as blanket consent to every use of health data.

We do not claim a general public-task basis simply because we are a healthcare provider. Any research use that needs separate consent or approval must meet those requirements.

We may collect information directly from you, including when you:

• Register with ADHD Simple

• Book appointments

• Complete questionnaires or forms

• Attend consultations

• Use our patient portal

• Contact us by telephone, email, SMS or other communications

We may also receive information from:

• Your GP

• Nurse practitioners

• Psychiatrists

• Psychologists

• Specialists

• Hospitals

• Pharmacies

• Laboratories

• Radiology providers

• Previous healthcare providers

• Referring clinicians

• Health insurers where applicable

• ACC or other funding agencies where applicable

• Government agencies where authorised or required by law

• Family members, carers, whānau or support people that you have nominated or authorised

• Parents, guardians or attorneys acting on your behalf

• Other individuals authorised by you to provide information relevant to your healthcare

As part of providing healthcare we may receive referral letters, previous assessments, medication history, specialist reports, hospital discharge summaries, laboratory results, imaging reports and other information relevant to your treatment.

We take reasonable steps to ensure patients are aware when health information has been collected from sources other than themselves, in accordance with the Health Information Privacy Code 2020.

We mainly use transcripts of calls and appointments to prepare notes. We may also make audio or video recordings for care, quality checks, training or handling complaints.

We tell you when recording or transcription is used and ask for consent where required. Tell us if you have concerns so we can discuss alternatives.

Only authorised people and providers can access these records. We keep recordings only as long as needed for care or legal duties. Transcripts and approved notes may become part of your health record.

We may use AI to transcribe calls and appointments, draft notes and summarise information. This may include Microsoft Azure OpenAI, Anthropic and Vexa.

AI does not diagnose you or decide your treatment. A clinician checks and approves each note before it goes into your health record.

Providers process your information on our behalf under contracts that protect it and limit how it is used.

We use secure electronic health record systems, patient management systems, cloud infrastructure and specialist technology providers to deliver our healthcare services.

The categories of technology providers we may use include:

• Cloud hosting and infrastructure providers, including Microsoft Azure and Supabase

• Communication and collaboration platforms, including Microsoft Teams and the underlying Microsoft Graph services that support them

• Telephony and messaging providers, including Twilio, and services used to send and receive SMS and iMessage, including BlueBubbles

• Email delivery and email verification providers, including Postmark and ZeroBounce

• Payment processing providers, including Stripe

• Mapping and address lookup providers, including Google Maps and Google Places

• Error monitoring and performance providers, including Sentry

These providers may securely store or process information on our behalf and are required to maintain appropriate privacy, confidentiality and security safeguards.

Depending on the services being provided, your information may be securely stored or processed within the United Kingdom or in other countries where appropriate safeguards exist or where otherwise permitted under the UK GDPR, the Data Protection Act 2018 and applicable confidentiality law.

We do not store your full payment card number. Our payment provider holds it securely.

Where overseas access or a provider arrangement is a restricted international transfer, UK GDPR transfer rules apply. The transfer needs an applicable adequacy regulation, appropriate safeguards such as a UK International Data Transfer Agreement or Addendum with the required assessment, or a lawful exception. Group ownership alone is not a transfer safeguard. Contact us for information about relevant destinations and safeguards, including how to obtain a copy where available.

We use essential cookies and similar technologies to operate accounts, booking, payments and security. We also use analytics, advertising tags and session replay tools to understand visits, measure where bookings come from and improve the website and checkout.

Session replays can show page views, clicks, scrolling and progress through checkout. They are separate from consultation recordings. Input masking and page restrictions are used to reduce sensitive capture; what is recorded depends on the page and tool configuration. Clinical answers and payment card details must not be sent in advertising events.

Tools may include PostHog and Microsoft Clarity for analytics and session replay, Google Tag Manager and Google Analytics for measurement, Meta and TikTok for advertising attribution, and Klaviyo for communications. They may process device and browser information, IP addresses, campaign parameters and cookie or click identifiers.

Where UK law requires consent, non-essential cookies, advertising tracking and session replay must not start before that consent. Accepting healthcare terms is not cookie consent. You must be able to reject optional tracking and change your choice. Essential cookies do not require the same consent. Your browser can also block or delete cookies, although some essential functions may stop working.

Health information needs extra protection. A visit or action that reveals health information is not exempt from those rules just because it is called analytics. Any optional use that requires explicit consent or another special-category condition must meet it. We do not sell clinical records for advertising.

Service messages about your care are separate from marketing. You can opt out of marketing using the unsubscribe option or by contacting us.

We share information only where necessary and lawful, including with healthcare professionals involved in your care, your nominated pharmacy, laboratories, authorised support people, payment and technology providers, professional advisers, regulators and safeguarding or emergency services.

Suppliers working on our behalf must follow our instructions and appropriate confidentiality and security requirements. We do not authorise advertising platforms to use your clinical records to target adverts.

Our group has authorised teams working in more than one country. Staff may access information from overseas for care, administration or technical support. We manage patient records separately for each country, with role-based access. The local operating company remains responsible for its service.

Authorised group teams in New Zealand and Australia may access UK information for the work described above. We remain responsible as controller. Appropriate UK international-transfer safeguards are required where the arrangement is a restricted transfer.

Who can access information? Access must be authorised and limited to what is needed for the work:

• Clinicians and clinical support staff: information needed to assess, treat and support you.

• Administration and patient-support teams: information needed for bookings, billing, communications and helping you use the service.

• Authorised technology and security staff: information needed to maintain systems, investigate faults or protect the service.

• Approved service providers: information needed to perform their contracted work, subject to appropriate instructions and safeguards.

We take reasonable technical, organisational and administrative measures to protect your information from unauthorised access, loss, misuse, alteration or disclosure.

These measures include:

• Encryption

• Multi-factor authentication

• Role-based access controls

• Audit logging

• Secure cloud infrastructure

• Regular backups

• Security monitoring

• Staff privacy training

• Confidentiality obligations

• Regular security reviews

Although no system can be guaranteed to be completely secure, we continually review and improve our security practices.

We keep information for as long as it is needed for your care and the purposes described here, taking account of the type of record, your last contact with us, professional record-keeping requirements, complaints or claims, and applicable law.

Clinical records usually need to be kept longer than temporary operational data or recordings. If a recording forms part of evidence needed for care, a complaint or a legal duty, we may need to retain it longer. We delete or permanently de-identify information when it is no longer needed. You can ask us about the retention criteria for a particular record.

Depending on the lawful basis and circumstances, you can ask for access, correction, erasure, restriction of processing or transfer of information you provided. You may object to processing based on legitimate interests and can always object to direct marketing. You can withdraw consent at any time where we rely on consent; this does not undo earlier lawful processing.

These rights have lawful limits. For example, an erasure request does not automatically require deletion of an accurate clinical record we must retain. You can ask for an explanation and complain to the ICO. You can also raise concerns about an automated decision and ask for human review where applicable.

If you believe information we hold about you is factually inaccurate, incomplete or misleading, you may request that it be corrected.

Where appropriate, we will take reasonable steps to correct factual errors, such as incorrect contact details, medication information, dates, or other factual information.

Clinical records also contain the professional observations, assessments, diagnoses and opinions of healthcare professionals. These records form part of your medical history and are maintained to support safe and effective healthcare.

Where information accurately records a clinician's professional opinion, diagnosis, assessment or contemporaneous clinical observations, we may decide that the record should remain unchanged if it accurately reflects the clinician's assessment at the time it was made.

If you disagree with a clinical opinion or diagnosis, you may request that it be reviewed by the treating clinician. Where appropriate, updated clinical information or subsequent assessments may be added to your record.

If we decide not to make a requested correction, we will explain our decision and, where required by law, record the correction, supplementary statement or dispute with the information.

We generally do not remove clinically relevant information from an accurate medical record where doing so would make the record incomplete, inaccurate or compromise the provision of safe healthcare. This includes information that was accurately recorded during the course of your assessment or treatment.

Submitted questionnaires form part of your clinical record. We retain a history of what you reported and when. If you made a mistake or your situation changes, contact us so that a correction or update can be recorded. Keeping the original submission does not remove your right to request a correction.

You can request access to your personal information, including health records, whether or not you owe us money. We provide the first copy free in the usual circumstances. Any fee or refusal must meet the legal conditions, and we will explain it.

We may need proportionate information to verify your identity. Information may be withheld or redacted where a lawful exemption applies, for example to protect another person’s information or address a serious risk of harm. We explain a refusal and your complaint rights unless the law prevents us from doing so.

Email contact@adhdsimple.co.uk and explain what you need. We respond without undue delay, normally within one month. If a complex request or several requests justify an extension, the law may allow up to two further months. We tell you within the initial month why an extension is needed. Any permitted identity or clarification step is handled under the applicable rules.

First email contact@adhdsimple.co.uk so we can investigate. You can also complain to the Information Commissioner’s Office (ICO). Its helpline is 0303 123 1113. You do not have to give up your legal rights to use our complaints process.