Your information, explained clearly
Privacy Notice
How ADHDinSYNC uses and protects your information, and how to ask a question or exercise your rights.
Your privacy at a glance
Your information
Relevant information helps us assess suitability, provide ADHD assessment and treatment, and keep clinical records.
What we collect ↓Sharing for your care
We share relevant information only where necessary and lawful, including with professionals involved in your care.
Who receives information ↓Young people’s privacy
For ages 7–17, we consider confidentiality, understanding and appropriate parent or carer involvement.
Privacy for young people ↓Your choices and rights
Ask to see your information, request a correction or raise a concern. Some rights have legal limits.
Understand your rights ↓How long we keep it
Retention depends on the record and its purpose. Clinical records and general enquiries have different periods.
Read retention details ↓Sending an enquiry
Keep your message brief. Please do not send medical reports, identity documents or a detailed health history.
How enquiries work ↓For a general enquiry, please do not send medical reports or identity documents. We explain how to provide clinical information securely.
Who is responsible for your information?
ADHDINSYNC LIMITED · Company No. 16411219 is the data controller where we decide how and why your personal information is used.
For privacy questions, requests and general enquiries, email info@adhdinsync.co.uk or telephone 07872 078760.
Appointments are 100% virtual. We do not offer in-person patient appointments.
ICO registration number: ZC065879.
What information do we collect?
Depending on your enquiry and care, information may include your name, date of birth, contact details, parent/carer or representative details, referral and appointment information, developmental and health history, assessment questionnaires, reports and supporting information.
It may also include clinical findings, medication and prescribing information, physical-health monitoring, consent, safeguarding and risk information, correspondence, payments, invoices, complaints and technical information generated through our website. Health information receives additional protection under data protection law.
Where does information come from?
We obtain information directly from you and, where appropriate and lawful, from parents or carers, your GP, referrers, previous assessment reports and professionals involved in your care. We consider confidentiality, consent where required, and the purpose of sharing before requesting or disclosing information.
Why do we use your information?
- Answer enquiries and assess whether our service is suitable.
- Arrange appointments and communicate with you.
- Carry out assessments, explain findings and document clinical decisions.
- Provide treatment, prescribing and monitoring where appropriate.
- Coordinate care and protect safety.
- Manage payments, complaints and information-rights requests.
- Maintain records, secure our systems and meet applicable obligations.
If essential information is unavailable, we will explain whether this prevents us from completing an assessment or proceeding with treatment.
Our lawful reasons for using your information
Data protection law requires us to identify a lawful reason for each use of personal information. Health information has additional protection.
Enquiries, appointments and payment
We use information necessary to respond to a request about our services, make booking arrangements and provide services under our agreement with you. Where applicable, our lawful basis is taking steps at your request before entering a contract, or performing that contract—Article 6(1)(b) UK GDPR.
For general enquiries and necessary administration that do not fall within a contract, we rely on legitimate interests—Article 6(1)(f). Our interests are responding to enquiries, administering our service and maintaining accurate business records.
Assessment, treatment and clinical records
We use relevant information to assess suitability, carry out ADHD assessments, provide treatment and monitoring, coordinate care and maintain clinical records.
Where this processing is necessary to fulfil our agreement with you, we rely on Article 6(1)(b). Where contract does not apply, including where a young person is not party to the agreement, we rely on our legitimate interests in providing and managing appropriate healthcare—Article 6(1)(f)—subject to the individual’s rights and interests.
For health information, we also rely on Article 9(2)(h), covering medical diagnosis, healthcare, treatment and management of healthcare services, together with Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018. This information is processed by, or under the responsibility of, a health professional subject to confidentiality obligations.
Safety, security and complaints
We rely on legitimate interests where necessary to protect our systems, prevent misuse, investigate complaints and manage our service responsibly. We consider whether the processing is necessary and proportionate and whether an individual’s rights override those interests. We give particular consideration to children’s interests.
Where health information is involved in managing care or a clinical complaint, the healthcare condition described above also applies. Where information is necessary to establish, exercise or defend legal claims, Article 9(2)(f) may apply.
Legal duties and safeguarding
We rely on Article 6(1)(c) where processing is necessary to meet a specific legal obligation, such as applicable tax-record requirements, responding to information-rights requests or complying with a binding court order.
Safeguarding information is assessed according to the circumstances. We identify the applicable lawful basis and, where health or other specially protected information is involved, the additional legal condition before using or sharing it. We limit disclosure to what is necessary.
Consent and your choices
Consent to assessment or treatment is separate from consent as a data-protection lawful basis. Agreeing to care does not give us unrestricted permission to use your information.
If we rely on consent for a particular use, we explain that use and how you can withdraw consent. Withdrawal does not affect processing already carried out lawfully.
You may object to processing based on legitimate interests. We assess objections under data protection law and explain our decision. Contact info@adhdinsync.co.uk.
Who may receive information?
Where necessary, appropriate and lawful, recipients may include you or an authorised representative, your GP, professionals involved in your care, pharmacies, relevant prescribing services, safeguarding or statutory authorities, regulators, professional advisers, an independent complaint reviewer and suppliers supporting our systems and administration.
We limit sharing to what is needed for the purpose and apply appropriate confidentiality safeguards. We do not sell patient personal information.
Young people and confidentiality
For patients aged 7–17, we consider understanding, capacity, applicable law, safeguarding and individual circumstances. We explain parent/carer involvement. A parent or carer does not automatically receive unrestricted access to every part of a young person’s record. Information may need to be shared to protect someone from serious harm or meet another lawful obligation.
Systems used for your care
Cliniko is our designated clinical-record and appointment system. IONOS supports our business email and website. Zoom is our chosen video-consultation platform.
Video appointments and clinical notes
We use Zoom for live video appointments. We do not record or transcribe consultations, use Zoom AI Companion to summarise appointments, or use AI note-taking tools to create clinical notes. Your clinician documents your care in your clinical record.
Cliniko publishes a UK Data Processing Addendum as part of its customer terms. You can ask our privacy contact for information about the agreements relevant to your care.
How long do we keep information?
We normally retain clinical assessment and treatment records for 20 years after care ends or the last clinical entry, whichever is later. We review records before disposal and retain them longer only where there is a documented justification. Different periods apply to non-clinical information.
We retain information for defined clinical, legal, professional and administrative purposes. The period depends on record type, age, the care provided, when care ends and any applicable complaint, safeguarding, investigation or legal hold. Records reaching their review date are assessed before secure disposal.
Enquiries that do not lead to care
We normally keep general enquiries for six months after the last meaningful contact, then securely delete them. If an enquiry results in a clinical assessment of suitability or raises safeguarding, complaint or legal concerns, we retain the necessary information under the relevant record-retention policy.
Cliniko retention and record exports
Cliniko has confirmed that after subscription cancellation it retains account data for at least one year, with access to log in and export during that period. This supplier access period is separate from ADHDinSYNC’s clinical-record retention schedule.
Processing outside the UK
Cliniko has confirmed that this UK-created account’s data is stored in the UK. Some suppliers or subprocessors may process relevant information outside the UK. Contact our privacy contact for information about the processing locations and safeguards applicable to your information.
Cliniko is provided by Red Guava Pty Ltd in Australia. Its UK data-processing agreement includes standard contractual clauses with the UK international-transfer addendum. Cliniko’s published supplier list identifies providers based in the UK, United States and Australia. A supplier’s listed location does not mean that every patient’s complete record is stored there. Contact our privacy contact to request a copy of the relevant safeguards.
Your rights
Depending on the circumstances, you may request access, correction, erasure, restriction or portability of your personal information. Where processing relies on consent, you may withdraw that consent.
Your right to object: You may object to processing based on legitimate interests. You also have an absolute right to object to use of your information for direct marketing.
Rights are subject to applicable conditions and exceptions. For example, an erasure request may not require deletion where we have a lawful reason to retain a record. Contact us using the details above. We may need proportionate evidence of identity or authority before disclosing information.
Website enquiries and cookies
Use our enquiry form for a brief booking request or general question. We use the details to respond and arrange the next steps. Please do not include detailed health histories, assessment reports or identity documents. We will explain the appropriate way to provide clinical information.
Your enquiry
Our general enquiry form asks for your name, email address and a brief message, with an optional subject. We use this information to respond, consider suitability and discuss the next steps. Your message is sent to our business email inbox.
The form currently displays an on-screen submission confirmation; it does not send a separate acknowledgement email to you. Confirmation of submission is not confirmation of an appointment or clinical review.
WPForms Lite is used to provide the form. Its entry-storage and entry-backup features are not active on this website. Enquiries received by email are still personal information held by ADHDinSYNC and are handled under this notice. Please do not include medical reports, identity documents or detailed health histories in the general enquiry form.
Questions or concerns
You can ask about your information without affecting how we consider your enquiry or provide your care. Contact us using the details above. You may also complain directly to the Information Commissioner’s Office. You do not have to complete our complaints procedure before contacting the ICO.
Changes to this notice
We review this notice when our services, systems or information practices change.