Privacy Policy

Privacy Policy

ADHD Complete LTD
Date of this notice: 3 May 2026

1. Who we are

ADHD Complete LTD is a private healthcare provider specialising in the assessment of Attention Deficit Hyperactivity Disorder (ADHD) and Autism Spectrum Disorder (ASD) in children and adults.

Data Controller: ADHD Complete LTD
Registered address: ADHD Complete LTD, 86–90 Paul Street, London, EC2A 4NE
Data Protection Officer: Edward Parker
Contact email: contact@ADHDComplete.com

We are responsible for ensuring that your personal data is processed in accordance with UK data protection law.

2. The type of personal information we collect

We collect and process the following categories of personal data:

• Personal identifiers (name, date of birth, contact details)
• Health and clinical information, including:
  • Personal medical history
  • Family medical history
  • Social and developmental history
  • Assessment and diagnostic information
• Appointment and service-related information
• Correspondence and communications

We may also collect information from third parties where relevant and with appropriate consent, including:

• Responses from nominated contacts (for example, parents, carers, teachers, or workplace representatives)
• Information provided by a GP where explicitly requested and consented to

We do not collect or store identity documents or payment card details.

3. How we collect your personal information

We collect personal information:

• Directly from you or a parent/carer at the point of referral and throughout the assessment process
• From authorised third parties where you have provided explicit consent
• From clinicians involved in your care

4. How we use your personal information

We use your information to:

• Provide ADHD and ASD assessment services
• Produce diagnostic reports
• Communicate with you about your assessment
• Ensure safe and effective clinical decision-making
• Meet legal and safeguarding obligations
• Improve the quality and efficiency of our service

5. Use of Artificial Intelligence in consultations

We use a secure healthcare artificial intelligence system (Heidi) to support clinicians by transcribing consultations into written clinical documentation.

This processing is undertaken solely for the purpose of:

• Supporting accurate clinical record-keeping
• Improving efficiency in documentation
• Assisting clinicians in preparing diagnostic reports

Safeguards in place:

• Audio is processed in real time and is not retained as a recording
• Transcription data is stored temporarily (up to a maximum of 14 days) and deleted as soon as documentation is completed
• Data is not used for AI model training
• Clinicians cannot access or replay audio recordings
• All extracted information is reviewed and verified by a clinician before being added to your clinical record
• Only authorised clinicians have access to the transcription during processing

Heidi acts as a data processor under contractual obligations compliant with UK data protection law.

6. Lawful basis for processing

Under the UK General Data Protection Regulation (UK GDPR), we rely on the following lawful bases:

Article 6 (Lawful basis)

• Performance of a contract – to provide the assessment services you have requested
• Legal obligation – to meet clinical, safeguarding, and regulatory requirements
• Legitimate interests – to ensure efficient and effective service delivery

Article 9 (Special category data)

We process health data under the condition that:

• Processing is necessary for the provision of health care

Consent

We rely on your consent for specific activities, including:

• Contacting third parties (for example, teachers or GPs)
• Sharing diagnostic reports with your GP

You may withdraw consent at any time. This will not affect processing already carried out but may impact our ability to complete certain aspects of the assessment.

7. How we share your personal information

We only share your information where necessary and appropriate. This may include:

• You, or your parent/carer
• Your GP, where you have provided explicit consent
• Authorised third parties nominated by you, where consent has been given

We may also share information without consent where required:

• For safeguarding purposes where there is a risk of harm
• To comply with legal obligations (for example, court orders or regulatory requirements)

Internally:

• The assessing clinician has full access to your records
• Other clinicians may review diagnostic reports as part of a multidisciplinary review process

We do not share your information with employers, schools, or other organisations unless explicitly authorised by you.

8. Data storage and security

We store personal data using secure, encrypted systems within Microsoft 365, including:

• Outlook
• OneDrive
• SharePoint
• Teams

We implement appropriate technical and organisational measures, including:

• Multi-factor authentication (MFA)
• Encryption
• Password protection

We ensure that all systems used meet appropriate security standards for handling sensitive healthcare data.

9. International data transfers

Some of the systems we use (such as Microsoft 365 and Heidi) may involve processing data outside the UK.

Where this occurs, we ensure appropriate safeguards are in place, such as:

• UK adequacy regulations
• Standard contractual clauses

to ensure your data remains protected to UK GDPR standards.

10. How long we retain your information

We retain personal data only for as long as necessary for clinical and legal purposes:

• Adult records: up to 8 years after the end of care
• Children’s records: until age 25 (or 26 if 17 at the end of treatment)

AI transcription data (Heidi):

• Stored temporarily for up to 14 days
• Deleted earlier once documentation is complete
• Not retrievable after deletion

All data is securely deleted when no longer required.

11. Children’s data

We assess children aged 5 and above.

• Consent is obtained from a parent or legal guardian at referral
• During assessment, clinicians assess the child’s level of understanding and competence (including Gillick competence where appropriate)
• We communicate directly with the child where clinically appropriate

12. Your data protection rights

Under data protection law, you have the right to:

• Access your personal data
• Request correction of inaccurate or incomplete data
• Request erasure of your data (in certain circumstances)
• Request restriction of processing
• Object to processing
• Request data portability

You do not have to pay to exercise your rights. We will respond within one month.

To make a request, contact: contact@ADHDComplete.com

13. How to complain

If you have concerns about how we use your personal data, please contact us in the first instance at:
contact@ADHDComplete.com

You also have the right to complain to the Information Commissioner’s Office (ICO).

Address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline: 0303 123 1113

14. Updates to this policy

We may update this Privacy Policy from time to time. The latest version will always be available upon request or via our website.

15. Important note

Providing your personal data is necessary for us to carry out an assessment. If you do not provide the required information, we may not be able to deliver our services safely or effectively.