This policy explains how Neuro FX Ltd uses information when you visit ADHDassess, complete screening or buy a Passport. For a question or privacy request, email info@neurofx.co.uk.
Who we are
ADHDassess is a product of Neuro FX Ltd, a company registered in England and Wales, company number 16159083, registered office Crown House, 27 Old Gloucester Street, London WC1N 3AX. Neuro FX Ltd, trading as NeuroFX and ADHDassess, is the data controller. Our ICO registration is ZB870010.
The launch waitlist
If you join the waitlist, we store your email address, the date you joined and a record of your agreement to receive a launch notification from NeuroFX. We do not ask for screening answers or information about your health. Joining does not create a patient account or commit you to buying screening.
We use this information with your consent to let you know when ADHDassess opens. It will not be added to a general marketing list. You can withdraw your consent and ask us to remove your entry at any time by emailing info@neurofx.co.uk. We will remove waitlist entries within 30 days of sending the launch notification.
The waitlist is stored in our existing EU-hosted database. We keep a short-lived, hashed network identifier to limit automated sign-ups; your IP address is not stored in the waitlist entry. Our hosting provider also processes requests to deliver the site.
What we collect
- Account and contact details: your name, email address and, where you provide it, your phone number.
- Identification and care context: date of birth, address, GP details and NHS number where supplied, and a parent or guardian's relationship to a child.
- Screening data: your answers to the published questionnaires, the structured intake, and any informant responses you invite.
- Health data: the above includes special-category health information, which we handle with additional safeguards.
- Payment confirmation: we receive confirmation of payment from our payment provider. We never see or store your full card number.
- Technical data: limited, privacy-preserving analytics where you have consented, and strictly necessary cookies to run the service.
How we use it
We use information to provide your free screening journey, save answers and produce your factual completion record. If you buy a Passport, we analyse the completed information and prepare its report and introduction letter for clinical review. Contact details are used for essential service messages and optional text updates, not as automatic consent to marketing.
For account and service delivery, we rely on UK GDPR Article 6(1)(b), taking steps you request before a contract and performing that contract. Health information is processed under Article 9(2)(h), health care by or under the responsibility of a professional subject to confidentiality. We use consent for optional analytics and the launch waitlist, and obtain your separate agreement to optional voice processing and texts. Legal obligations and, where applicable, safeguarding or vital-interest provisions may require limited retention or disclosure.
Necessary security and abuse-prevention processing supports our legitimate interest in protecting the service and its users. You can ask us about this assessment or object to processing based on legitimate interests. Declining optional measurement does not affect access to screening.
Children and informants
A parent or legal guardian supplies a child's information and must have appropriate authority. We also receive information from invited informants, such as a partner, relative or teacher. Their responses may appear in the Passport shared with the account holder; the invitation explains this. Only invite someone appropriate to contact, and do not add unrelated people's personal information to your answers.
Optional text updates
When text updates are available, you can choose screening reminders, a message when your reviewed report is ready, or both. We verify the UK mobile number you provide and record your choices. Twilio processes that number and the message to deliver these texts. We do not put your answers, scores or report in a text message. Our name may appear on your phone's lock screen. You can turn texts off and remove the notification number in your account settings at any time. This does not stop essential service emails or enrol you in marketing messages.
Optional voice transcription
You can speak a narrative answer instead of typing. Recording is optional and starts only when you choose to start it and allow microphone access. A temporary audio copy stays in your browser tab for playback until you save or discard it or close the page. Only when you request a transcript is that recording sent through our server to our cloud transcription provider, OpenAI, using its audio transcription API. ADHDassess processes the audio in memory and does not save it in your account, screening records or audio storage. Only the text you choose to save becomes part of your answer. Please check it for accuracy before saving.
OpenAI's published policy for the audio transcription endpoint specifies no retention of audio for abuse monitoring or application state. API data is not used for model training by default. See its data controls policy for details. We record your voice-processing consent and a count of transcription requests, not the audio itself. You can type your answer instead at any time.
AI-assisted drafting
Part of your report’s narrative may be drafted with the help of a language model. The drafting input includes structured screening results and relevant personal accounts. We remove direct account identifiers and filter identifying details from narrative text, but free text can still contain personal information. Do not include someone else’s contact details in your answers. The draft is reviewed by a NeuroFX clinician before release. AI drafting does not diagnose ADHD or replace clinical judgement.
Checking a shared Passport
Reports with a verification reference can be checked by someone you share them with. They enter the reference, assessed person’s name and date of birth already printed on the report. A match confirms the issue date, revision and whether the report is current, superseded or withdrawn. It does not reveal scores, answers, findings or the reason for a withdrawal. There is no public search by name or date of birth.
If the recipient also selects a PDF, its fingerprint is calculated on their device. Only that fingerprint is sent for comparison; the file is not uploaded. We retain a private encrypted issued copy and verification record with the report. Entered details are used for the check, not added to a marketing list or ordinary application logs. Short-lived hashed network and reference identifiers help prevent automated abuse. Our hosting provider also processes requests to operate and protect the service.
Optional visit-source measurement
Optional first-party measurement also uses a random 30-minute visit identifier to compare campaign visits with screening starts, completion and Passport purchases. Limited progress milestones remain inside ADHDassess; staff see aggregate campaign totals. These records do not contain your answers, scores, name, email address or advertising click IDs, and are not uploaded to Google Ads or Meta. This measurement requires the visit-source choice in Cookie settings and is separate from consenting to service emails or texts.
With your permission, we remember a recognised visit-source or campaign category for up to 30 days and record it against an order if you purchase. This helps us compare sources of sales and refunds internally. It does not include your screening answers or send purchase details to Google or advertising platforms. You can stop future capture using Cookie settings in the footer; this does not remove categories already recorded against orders. Our cookie policy explains the choices.
Optional Google Analytics
With a separate consent choice, Google Analytics measures visits to four public pages: home, about, pricing and the resources index. It does not run on individual articles, sign-in, checkout, questionnaires, accounts, reports or staff pages. Google receives a fixed page address, a neutral page label, a cookie identifier and basic visit and device information. It processes your IP address to handle the request. We do not send names, contact details, query strings, referring addresses, screening data or purchase details.
Google signals, advertising personalisation and automatic interaction tracking are off. Google measurement cookies last up to 30 days. You can withdraw this consent using Cookie settings; the page reloads to remove the Google scripts. Google may process information outside the UK; see its privacy policy for its processing and transfer information.
Who we share it with
We do not sell personal information. Authorised NeuroFX staff and clinicians access information relevant to their work. We use service providers for hosting, database storage, transactional email, payments, text messages, optional transcription and document preparation.
- Vercel hosts the application and Supabase provides our EU-hosted database infrastructure.
- Resend delivers service emails; Twilio processes optional text messages and number verification.
- Stripe processes payment details under its own payment and privacy terms. We receive the information needed to fulfil and reconcile orders, not your full card number.
- Cloud AI providers process relevant input for enabled drafting or transcription, as described above. Drafting is reviewed by a clinician, not used as an autonomous diagnostic decision.
- SSL.com provides organisational digital signing. The signing integration sends a document hash for signing, rather than the complete Passport.
- Optional Google Analytics processing is limited to the public pages and data described above.
We use appropriate contractual arrangements for service providers and limit access to what is needed. Information may also be shared with a professional you ask us to involve, or with an appropriate service or authority where a legal or safeguarding basis requires it. We do not automatically send your Passport to a GP, school or employer just because you have provided their details.
International processing
EU database hosting does not mean all processing stays in the UK or EU. Hosting, communications, payment and AI providers may process limited information in other countries. Where UK data protection law requires a transfer safeguard, this may be an applicable adequacy arrangement or approved contractual safeguards, including the UK Addendum or International Data Transfer Agreement where appropriate. Contact us for the arrangements relevant to a particular processing activity and how to obtain information about those safeguards.
How long we keep it
For an unpaid free screening, we keep answers for 90 days after completion, with a factual reminder before removal. Incomplete screening has a 90-day maximum including its final return period. An unresolved safeguarding concern or a payment still being confirmed may require a hold before deletion. Paid clinical records are retained under NeuroFX's records policy and relevant professional guidance. The applicable period depends on the person's age, the date and nature of the care, professional record-keeping duties and any unresolved complaint, safeguarding issue or legal claim. Payment and accounting records may have separate statutory retention requirements.
Deleting an account is not the same as erasing a clinical record we must retain. We restrict access to retained records and remove information when the applicable requirements end. Ask us for the retention position for your particular record. Optional future Passport updates would require their own terms; the current service does not promise indefinite online storage.
Your rights
- Access a copy of the personal data we hold about you.
- Ask us to correct anything that is inaccurate.
- Ask us to delete data we are not legally required to keep.
- Ask us to restrict processing, object where applicable, or receive portable data where the legal conditions apply.
- Withdraw consent for optional processing, such as analytics, at any time.
- Complain to the Information Commissioner’s Office if you are unhappy with how we have handled your data.
Rights depend on the circumstances and lawful basis; they are not absolute. We may need to confirm identity before responding. We normally respond within one month and will explain any lawful extension. Withdrawing consent does not invalidate processing already carried out.
Decisions and corrections
Automated questionnaire scoring and drafting assist the service, but the issued Passport is reviewed by a clinician. ADHDassess does not make an automated diagnosis or treatment decision. If factual information or a transcript is wrong, correct it before submission or contact us. A correction to an issued document must preserve a clear revision and verification history.
Contact
To exercise any of these rights, or to ask a question about your data, email info@neurofx.co.uk. You can also contact the ICO if you believe your information has been mishandled. Our telephone number is 0333 533 3303.