Privacy Policy

Last updated: September 2026

This privacy policy explains how Clearmind collects, uses, stores, and shares your personal data when you use our website, enquire about our services, or undergo an ADHD assessment with us. We are committed to protecting your privacy and handling your data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Please read this policy carefully. By using our website or engaging our services, you acknowledge that you have read and understood this policy.

1. Who we are

Clearmind is a private healthcare provider specialising in ADHD diagnostic assessments for adults. We are the data controller for all personal data processed in connection with our services, which means we determine the purposes and means of processing your personal data.

• Registered address: 124 City Road, London, EC1V 2NX
• Email: hello@clearmind-adhd.co.uk
• Phone: 0800 123 4567
• Website: clearmind-adhd.co.uk

Data Protection Officer (DPO): Our Data Protection Officer can be contacted at hello@clearmind-adhd.co.uk or by writing to: Data Protection Officer, Clearmind, 124 City Road, London, EC1V 2NX. Please mark your correspondence “FAO Data Protection Officer”.

2. What data we collect

We collect and process the following categories of personal data, depending on your interaction with us:

2.1 Personal identification data

• Full name
• Date of birth
• Gender
• Home address
• Email address
• Telephone number
• Emergency contact details

2.2 Health and medical data (Special Category data)

• Medical history relevant to ADHD (including mental health history, neurodevelopmental conditions, and co-occurring conditions)
• Pre-assessment screening questionnaire responses (e.g. ASRS, DIVA-5)
• Clinical assessment notes and observations
• Diagnostic outcomes and reports
• Medication history, prescriptions, and titration records
• GP and other healthcare professional details
• Informant or collateral history (e.g. from a family member)
• Follow-up appointment notes

2.3 Financial and payment data

• Payment card details (processed securely by our payment processor, Stripe — we do not store your full card details)
• Billing address
• Transaction records and invoices

2.4 Technical and usage data

• IP address
• Browser type and version
• Device information
• Pages visited and time spent on our website
• Referring website
• Cookie data (see section 14)

2.5 Communication data

• Enquiry form submissions
• Email correspondence
• Telephone call records
• Video consultation recordings (only where you have been informed and have consented)

3. Lawful basis for processing

Under UK GDPR, we must have a valid lawful basis for each processing activity. The table below sets out the lawful bases we rely on:

4. Special Category data

Health and medical data is classified as Special Category data under Article 9 of the UK GDPR and requires an additional condition for processing beyond the lawful bases set out in section 3 above. We rely on the following Article 9 conditions:

• Explicit consent (Article 9(2)(a)): We obtain your explicit, informed consent before processing your health data. You will be asked to provide this consent before your assessment begins. You may withdraw your consent at any time, although this may affect our ability to provide or continue your care.
• Provision of health or social care (Article 9(2)(h)): Processing is necessary for the provision of healthcare services, including diagnosis and treatment, under the responsibility of a health professional subject to professional confidentiality obligations.
• Substantial public interest (Schedule 1, Part 2 of the Data Protection Act 2018): In limited circumstances, we may process your health data where it is necessary for reasons of substantial public interest, such as safeguarding vulnerable individuals.

5. How we use your data

We use your personal data for the following purposes:

• Assessment and diagnosis: To conduct your ADHD diagnostic assessment via video call, including reviewing pre-assessment questionnaires, conducting clinical interviews, and reaching a diagnostic conclusion.
• Clinical reporting: To produce a comprehensive diagnostic report summarising our findings and recommendations.
• GP communication: With your explicit consent, to share your diagnostic report and relevant clinical information with your registered GP to support shared care and ongoing treatment.
• Medication management: To prescribe ADHD medication where clinically appropriate, manage medication titration, and conduct medication review appointments.
• Follow-up care: To schedule and conduct follow-up appointments to monitor your progress and adjust treatment as needed.
• Invoicing and payments: To process your payment for our services and issue invoices and receipts.
• Communication: To respond to your enquiries, send appointment confirmations and reminders, and provide clinical correspondence.
• Service improvement: To analyse anonymised and aggregated data to improve our clinical services and patient experience.
• Legal and regulatory compliance: To comply with our obligations under healthcare regulations, including maintaining clinical records, responding to regulatory enquiries, and reporting where required by law.
• Marketing: Where you have opted in, to send you information about our services, resources, and updates relevant to ADHD. You can unsubscribe at any time.

6. Who we share your data with

We will never sell your personal data to third parties. We may share your data with the following categories of recipients, only to the extent necessary and with appropriate safeguards in place:

6.1 Healthcare providers

• Your GP: With your explicit consent, we will share your diagnostic report and relevant clinical information with your registered GP. If you are prescribed medication, your GP will need to be informed as part of shared care arrangements.
• Prescribing pharmacies: Where medication is prescribed, your prescription details will be shared with the dispensing pharmacy to fulfil your prescription.
• Other healthcare professionals: With your consent, we may share information with other healthcare providers involved in your care (e.g. therapists, psychiatrists).

6.2 Service providers and processors

• Stripe: Our payment processor, who handles payment card transactions securely on our behalf. Stripe acts as a data processor and is PCI DSS compliant. See Stripe's Privacy Policy.
• Formspree: Our form handling service, which processes data submitted through our website enquiry forms. Formspree acts as a data processor. See section 13 regarding international transfers.
• Video call platform: We use a secure video conferencing platform to conduct assessments remotely. The platform provider acts as a data processor and is required to meet appropriate security and privacy standards.
• IT and hosting providers: Companies that provide our website hosting, email, cloud storage, and IT support services.

6.3 Legal and regulatory bodies

• Regulatory authorities (e.g. the Care Quality Commission) where required by law.
• Law enforcement agencies where we are legally required to disclose information.
• Professional regulatory bodies (e.g. the General Medical Council) if needed.
• Safeguarding authorities where there is a risk of serious harm to you or another person.

7. Data retention periods

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. The following retention periods apply:

When the retention period expires, your data will be securely deleted or anonymised. Please note that we may be unable to delete clinical records before the minimum retention period has elapsed, even if you request erasure, as we are legally required to maintain these records.

8. Your rights under UK GDPR

Under the UK GDPR, you have the following rights in relation to your personal data. These rights are not absolute and may be subject to exemptions, particularly where clinical records are concerned.

• Right of access (Article 15): You have the right to request a copy of the personal data we hold about you. See section 9 for how to make a Subject Access Request.
• Right to rectification (Article 16): You have the right to request that we correct any inaccurate or incomplete personal data we hold about you.
• Right to erasure (Article 17): You have the right to request that we delete your personal data. However, this right does not apply where we are required to retain data for legal or regulatory reasons, including the retention of medical records as described in section 7.
• Right to restriction of processing (Article 18): You have the right to request that we restrict the processing of your personal data in certain circumstances, for example if you contest the accuracy of the data.
• Right to data portability (Article 20): You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to request that we transfer it to another controller where technically feasible.
• Right to object (Article 21): You have the right to object to the processing of your personal data where we are relying on legitimate interests as the lawful basis. We will stop processing unless we can demonstrate compelling legitimate grounds.
• Right to withdraw consent: Where we rely on your consent to process your data, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
• Right to complain: You have the right to lodge a complaint with the Information Commissioner's Office (ICO). See section 15 for details.

To exercise any of these rights, please contact us at hello@clearmind-adhd.co.uk or write to us at 124 City Road, London, EC1V 2NX. We will respond to your request within one month of receipt. In complex cases, we may extend this by a further two months, and we will inform you if this is necessary.

9. Subject Access Requests

You have the right to request a copy of all personal data we hold about you. This is known as a Subject Access Request (SAR). To make a SAR:

• Email us at hello@clearmind-adhd.co.uk with the subject line “Subject Access Request”, or write to us at 124 City Road, London, EC1V 2NX.
• Please provide sufficient information to verify your identity (e.g. your full name, date of birth, and address).
• Please specify the information you are requesting, if you have a particular concern. This will help us respond efficiently.

We will respond to your SAR free of charge within one calendar month. We may request additional identification to verify your identity before releasing any data. If your request is manifestly unfounded or excessive (for example, if you make repetitive requests), we may charge a reasonable fee or refuse the request, providing our reasons for doing so.

Please note that we may redact information about third parties from clinical records to protect their privacy.

10. How we collect your data

We collect personal data in the following ways:

• Directly from you: When you fill in forms on our website, contact us by email or phone, complete pre-assessment questionnaires, or attend an assessment or follow-up appointment.
• From third parties: With your consent, from your GP or other healthcare providers who share relevant medical history, or from an informant (e.g. a family member) who provides collateral history as part of your assessment.
• Automatically: Through cookies and similar technologies when you use our website (see section 14).

11. Automated decision-making

We do not use automated decision-making or profiling that produces legal or similarly significant effects on you. All clinical assessments and diagnostic decisions are made by qualified healthcare professionals.

12. Security measures

We take the security of your personal and health data extremely seriously. We have implemented appropriate technical and organisational measures to protect your data against unauthorised access, alteration, disclosure, or destruction, including:

• Encryption of data in transit (TLS/SSL) and at rest where appropriate.
• Access controls to ensure that only authorised personnel can access your data on a need-to-know basis.
• Secure video consultation platforms with end-to-end encryption.
• Regular security assessments and updates to our systems.
• Staff training on data protection, confidentiality, and information security.
• Secure disposal of records when they are no longer required.
• Data processing agreements with all third-party processors to ensure they meet equivalent security standards.

While we take all reasonable steps to protect your data, no method of transmission over the internet or electronic storage is completely secure. If you become aware of any security breach, please contact us immediately at hello@clearmind-adhd.co.uk.

13. International data transfers

Your personal data is primarily stored and processed within the United Kingdom and the European Economic Area (EEA). However, some of our third-party service providers may process data outside the UK:

• Formspree: Our website enquiry form submissions are processed by Formspree, which is based in the United States. Where data is transferred to the US, we ensure that appropriate safeguards are in place, including reliance on UK adequacy regulations, the UK International Data Transfer Agreement (IDTA), or Standard Contractual Clauses (SCCs) approved by the ICO, to ensure your data receives an equivalent level of protection.
• Stripe: Payment processing may involve transfers to countries outside the UK. Stripe relies on appropriate transfer mechanisms, including SCCs, to protect your data.

We will not transfer your health or medical data outside the UK without your explicit consent and without ensuring appropriate safeguards are in place. You may request further information about the safeguards we use by contacting us at hello@clearmind-adhd.co.uk.

14. Cookies and tracking

Our website uses cookies and similar technologies to provide essential functionality, analyse how visitors use our site, and improve your experience. We use both strictly necessary cookies (which do not require consent) and optional analytics cookies (which we only set with your consent).

For full details about the cookies we use, their purposes, and how to manage your cookie preferences, please see our Cookie Policy.

15. Children's data

Our ADHD assessment service is designed for adults aged 18 and over. We do not knowingly collect or process personal data from children under 18. If you believe we have inadvertently collected data from a person under 18, please contact us immediately at hello@clearmind-adhd.co.uk and we will take steps to delete the data promptly.

16. Changes to this policy

We may update this privacy policy from time to time to reflect changes in our practices, legal requirements, or regulatory guidance. When we make material changes, we will update the “Last updated” date at the top of this page. Where changes are significant, we will make reasonable efforts to notify you (for example, by email or by a notice on our website).

We encourage you to review this policy periodically. Your continued use of our website or services after any changes constitutes your acceptance of the updated policy.

17. How to contact us

If you have any questions about this privacy policy, your personal data, or wish to exercise any of your rights, please contact us:

• Email: hello@clearmind-adhd.co.uk
• Phone: 0800 123 4567
• Post: Data Protection Officer, Clearmind, 124 City Road, London, EC1V 2NX

18. How to complain

We take all complaints about our handling of personal data very seriously. If you are unhappy with how we have used your data, we would appreciate the opportunity to resolve the matter directly. Please contact us using the details in section 17.

If you are not satisfied with our response, or if you wish to raise a concern directly, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection:

• Website: ico.org.uk/make-a-complaint
• Phone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF