Skip to content
ADHDX

Governance at ADHDX

Privacy Policy

How ADHDX collects, uses and protects personal information about you and your child.

Data protection lead

Portrait of Dr Essam Abdelhakim

Dr Essam Abdelhakim

Chief Medical Officer · Clinical Safety Officer

+44 7387 268709essam@adhdx.co.uk

Last updated 10 September 2026

ADHDX Ltd is the data controller for the personal information collected through this website, your ADHDX account and your child’s assessment. This policy explains what we collect, why we use it, where it is kept, how long we keep it and the rights you have.

It applies to:

  • Visitors to this website
  • Parents and carers who use the symptom checker
  • Parents and carers who book an assessment for their child, complete the parent questionnaire and attend the recorded assessment appointment
  • Teachers who complete the teacher questionnaire at a parent’s invitation
  • Doctors who sign in to the ADHDX clinician portal

Who to contact

Questions about this policy, or about how we handle your information, can be put to our data protection lead directly using the details above. Written requests, including requests to exercise your rights, should be sent to admin@adhdx.co.uk so that they are logged and answered within the required time.

What we collect

Assessment questionnaires and appointments

  • The child code we issue for the assessment, and limited context such as the child’s age, gender and school year
  • Questionnaire answers about behaviour, development, education, family history and everyday functioning
  • Free-text comments entered by the person completing the questionnaire
  • The recording and transcript of the assessment appointment, which takes place by video call
  • The consent recorded before a parent questionnaire: the name of the parent or guardian giving it and their acceptance of the terms and privacy notice
  • The report the doctors write, and the drafts behind it
  • Technical and account information for the doctors who use the clinician portal

Please do not include unnecessary information about other people in free-text answers. Tell us only what is relevant to the child being assessed.

Symptom checker

The symptom checker on this website scores your answers in your browser. Nothing is sent to us unless you save the report to your ADHDX account. If you do, we collect:

  • Your name and email address, from your account
  • Your child’s first name and age, and your GP practice if you choose to give it
  • Your answers to the checker questions, which appear only in the report itself
  • Your confirmation that you are the child’s parent or legal guardian

The report is a PDF kept in your account for you to download, and a copy is emailed to you from results@mail.adhdx.co.uk. We do not send it to your GP; you decide whether to pass it on. If you go on to book a free call or an assessment, the doctor you speak to can see the checker reports saved to your account, so they know what prompted it. While you work through the checker, your answers are held in your browser’s local storage so you can pick up where you left off, and are cleared when you finish. If you ask to save the report before signing in, your answers are held in your browser for up to seven days until you have done so.

Your ADHDX account

Booking an assessment, booking a free call and saving a checker report all use an ADHDX account. You sign in with your email address and a password, or with your Google account. If you use Google, it confirms your identity to us and shares your name and email address; we never see your Google password, and Google handles that sign-in under its own privacy policy. For your account we collect:

  • Your name and email address, and your mobile number if you give it
  • Your child’s name and date of birth, and the child code we issue for the assessment
  • Your acceptance of the terms and privacy notice when you book, your name as the parent or guardian giving consent, and whether you would like updates from ADHDX
  • Your booking: the fee, when you paid, your appointment time and which doctor it is with. Card details are entered on Stripe’s secure payment page and never reach ADHDX
  • Your free call: the time you chose, which doctor it is with, and the name and phone number you gave us for it
  • The email address you give us for your child’s teacher, which we use only to send them the questionnaire link
  • The reports saved to your account

Your account holds a link to your child’s clinical record, but the record itself is stored separately and refers to you only by an anonymous account identifier. You can ask us to delete your account at any time; the clinical record is kept under the retention rules below.

This website

  • Page-view analytics through GoatCounter and PostHog. Neither sets cookies on this site, records your session, or receives names, email addresses or checker answers. GoatCounter holds your IP address in memory for up to eight hours to count repeat visits and does not store it. Checker events record only the outcome band
  • Google Tag Manager, which loads on every page of this website and runs Google Analytics and Google Ads measurement tags. Those tags set cookies and send data only if you accept them in the cookie banner shown on your first visit, run for us by CookieYes; they then tell Google which pages you visit, how you reached the site and whether you went on to book a free call or pay for an assessment, so that we can see which of our advertising brings families to us. The same tags run, under the same choice, on the pages of your ADHDX account on our portal, but never on its sign-in page, the questionnaires or the video call; when you book a free call or pay, your account tells Google only that a free call was booked or a payment was completed, with no name, payment details or anything about your child
  • Your IP address, which is used briefly to limit repeat submissions to the symptom checker and the contact form, and may appear in our hosting logs
  • Your IP address is also seen by Google when your browser loads our web font from Google Fonts

When you send the contact form, your name, email address and message go to our server, which emails them to our clinic mailbox and keeps nothing else; your message is then held in that mailbox with the rest of our correspondence. A count of recent submissions from your connection is held briefly to limit repeat sending. Assessment payments are taken on Stripe’s payment page, which has its own privacy notice.

Cookies

Our own analytics set no cookies. Google Tag Manager loads on every page of this website, but the Google Analytics and Google Ads measurement tags it runs set cookies and send data only if you accept them in the cookie banner shown on your first visit. The banner is run for us by CookieYes, which remembers your answer in a cookie named cookieyes-consent for a year; to change it, use Cookie choices in the footer of any page, which opens the banner again. If you withdraw your acceptance the tags stop straight away, though cookies already set stay in your browser until they expire or you clear them. The same tags run, under the same choice, on the pages of your ADHDX account on our portal, but never on its sign-in page, the questionnaires or the video call, whose addresses carry a code or a link meant only for you. CookieYes shares your answer across adhdx.co.uk, so you choose once, and Cookie choices in the footer of your account opens the banner again there too. When you book a free call or pay for an assessment, your account, if you accepted cookies, tells Google only that a free call was booked or a payment was completed: no name, no payment details and nothing about your child.

Your account, the questionnaire and the clinician portal

Your ADHDX account, the questionnaire and the clinician portal, at portal.adhdx.co.uk and questionnaire.adhdx.co.uk, use PostHog to help us understand how they are used and to fix problems. This includes session recordings of the questionnaire and the clinician pages, never of your account pages, in which every piece of text and every input is masked before it leaves your browser. On your account pages PostHog stores nothing on your device at all, which is why the cookie notice does not appear there and the cookie banner is the only one you meet. Elsewhere in those apps a cookie notice, separate from the cookie banner, lets you opt out at any time.

Why we use it

  • To carry out your child’s assessment: to bring the questionnaire answers and the appointment transcript together for the assessing doctors, and to write and sign the report
  • To prepare draft summaries and a draft report for the doctors to review; the final report is always written and signed by the doctors
  • To share the report with your child’s GP, if you ask us to
  • To prepare the symptom checker report you asked for, keep it in your account and send it to you
  • To take payment for an assessment, issue the child code, book the appointment and send you the questionnaire links, reminders and the video-call link
  • To answer you when you write to us through the contact form
  • To contact you about ADHD support for families, only if you ticked the box asking for updates; you can unsubscribe at any time
  • To keep our systems secure, audited and running

ADHDX does not make a diagnosis automatically.

Clinicians remain responsible for interpreting the information and for all final clinical decisions.

Our legal basis

Under UK GDPR we rely on the following:

  • Assessment questionnaires, interviews and reports: performance of a contract (Article 6(1)(b)) and our legitimate interests in running a safe, effective assessment service (Article 6(1)(f)); for health information, the provision of health care (Article 9(2)(h))
  • Your ADHDX account and booking an assessment: performance of a contract (Article 6(1)(b))
  • Symptom checker reports and updates from ADHDX: your consent, which you can withdraw at any time
  • Answering an enquiry you send us through the contact form: our legitimate interests in replying to you (Article 6(1)(f))
  • Google Tag Manager cookies and the measurement they enable: your consent, which you can withdraw at any time using Cookie choices in the footer
  • Sharing the report with your child’s GP: your permission, which we ask for at the time and which you can withdraw

Where it is stored

ADHDX runs on Amazon Web Services in London (the eu-west-2 region). We use:

  • DynamoDB for structured questionnaire and report data
  • S3 for larger objects such as transcripts, generated PDFs and uploaded audio
  • Cognito for clinician and parent sign-in
  • Transcribe for turning audio into text
  • Bedrock for limited AI-assisted processing, where it is enabled
  • Simple Email Service for sending reports, account verification codes, booking confirmations, reminders and contact-form messages

Clinical and questionnaire information stays in the United Kingdom. Website analytics are processed by PostHog and GoatCounter in the European Union, which the UK recognises as providing adequate protection for personal data. If you accept cookies, Google Tag Manager and the tags it loads send website usage data to Google, which may process it in the United States under the UK Extension to the EU-US Data Privacy Framework. Payments are processed by Stripe. Appointment times are held in the clinic’s Google Calendar: an assessment under the child code only, and a free call under your first name only. Your phone number and email address never go into the diary.

How long we keep it

  • Reports saved to your ADHDX account are kept until you delete them or ask us to delete your account
  • Bookings that are never paid for are deleted automatically after seven days
  • Uploaded audio files are deleted automatically after six months
  • Questionnaire answers, the appointment recording and transcript, and the report form your child’s clinical record, which is kept until the deletion point set by our retention schedule
  • Consent records are kept with the case as an audit trail
  • Other information is kept only as long as operational need, our retention schedule and legal obligations require

Who we share it with

Information is shared only as needed with:

  • The ADHDX doctors carrying out your child’s assessment
  • ADHDX technical and administrative staff, where required for support and security
  • Amazon Web Services as our hosting and processing provider
  • Stripe as our payment provider, which receives your name, email address and the payment details you enter on its page
  • Google, which hosts our clinic mailbox and so receives any message you send us through the contact form, holds appointment times in the clinic’s calendar under the child code only, confirms your identity to us if you sign in with Google and, if you accept cookies, receives website and account usage data through Google Tag Manager, which pages you visit, that a free call was booked and that a payment for an assessment was completed, never a name, a child code or anything about your child
  • Your child’s teacher, who receives the questionnaire link and child code at the email address you give us
  • PostHog and GoatCounter as our analytics providers, who never receive names, email addresses or answers
  • CookieYes, which runs the cookie banner on this website and keeps a record of the choice you make in it
  • Your child’s GP, only with your permission, to support NHS care. The report is yours: we do not send it to anyone else, and we recommend that you share it with your child’s school yourself

We do not sell personal data.

Your rights

You have the right to:

  • Access the personal information we hold about you or your child
  • Ask us to correct information that is wrong or incomplete
  • Ask us to delete information, including your ADHDX account, where that applies
  • Ask us to restrict or object to how we use it, in some circumstances
  • Withdraw your permission for us to share the report with your GP, or your consent for the symptom checker report, updates from ADHDX or cookies, at any time
  • Complain to the Information Commissioner’s Office (ICO)

To exercise any of these rights, email admin@adhdx.co.uk. We will verify your identity, and your authority to act for a child, before disclosing or changing anything, and we aim to reply within one calendar month. If you are unhappy with our response you can raise a complaint with the ICO.

Security

We protect your information with access controls, multi-factor authentication for clinician accounts, encryption in transit and at rest, and logged cloud infrastructure. Because some questionnaire and report draft data may be stored temporarily in your browser for resilience, please avoid using shared or unmanaged devices.

Children

Information about a child is provided by the adults responsible for them. The symptom checker, which is for children aged 3 to 17, and the assessment questionnaires are designed for parents, carers and teachers to complete, not for children themselves. We treat information about children as sensitive at every stage.

Changes to this policy

We will update this policy if the way we handle personal information changes, and the date at the top of this page will change with it.