Privacy Policy

Who we are

ADHD Private is a website operated by Sellframe Ltd, a company registered in Scotland (company number SC472357) with its registered office at 14 Avonside Grove, Hamilton, Lanarkshire, ML3 7DL.

Sellframe Ltd is the data controller for the personal information described in this policy. We are registered with the Information Commissioner's Office (ICO) under reference ZA781833.

For anything to do with your data, contact us at [email protected] or write to us at the address above.

The short version

• You can browse and compare every clinic on this site without giving us any personal information at all.
• If you complete our Find your match questionnaire, we ask for your email address so we can send you your matches. Your answers tell us about your health, so we only use them with your explicit consent.
• We only pass your contact details to a clinic if you choose to. There are two ways, both optional: sending an enquiry from a clinic's own listing passes it to that one clinic (the Send button tells you so before you send), and separately ticking the optional box at the end of the questionnaire sends your answers to a maximum of three clinics.
• We never sell or rent your personal information.
• You can ask us to delete your data at any time, and we will.

What we collect, and why

1. Website analytics

We use Fathom Analytics, a privacy-focused analytics service, to understand how the site is used. It records the pages visited, the referring website, the country, and the device and browser type. Fathom does not use cookies and does not track individuals across websites. We cannot identify you from this data.

Lawful basis: legitimate interests (Article 6(1)(f) UK GDPR) — we need to understand how our directory is used in order to run and improve it.

2. Clinic views and outbound clicks

When you view a clinic's page, or click through to a clinic's website, booking page or phone number, we record it. Each record holds the clinic concerned, the page you came from, a short-lived browser “fingerprint”, a one-way hashed version of your IP address, and your browser's user-agent string.

To be straightforward about this: that combination is pseudonymous, not anonymous. We do not use it to identify you, build a profile of you, or advertise to you, and it is never sold or shared. We use it to count each click once rather than several times, to filter out automated traffic, and to tell clinics how many people their listing reached.

Lawful basis: legitimate interests (Article 6(1)(f) UK GDPR) — measuring which listings are useful, keeping our statistics accurate, and preventing abuse. We have balanced this against your interests by using a hashed IP rather than storing your IP address, and by deleting these identifiers after 12 months.

3. Contact and “list your clinic” forms

If you use our contact form or our “list your clinic” form, we store your submission — your name, email address, what you wrote, and for clinic enquiries the clinic name, website and phone number you give us. We also record the IP address and browser the form was sent from, to help us block automated spam.

Lawful basis: legitimate interests (Article 6(1)(f) UK GDPR) for responding to enquiries and preventing spam; and, where you are asking to be listed, taking steps at your request before entering into a contract (Article 6(1)(b) UK GDPR).

4. The “Find your match” questionnaire — health information

Our questionnaire asks who the assessment is for, what service you need, where you would like to be seen (including a postcode if you give one), whether you may be eligible for NHS Right to Choose, how soon you need to be seen, and any other preferences. At the end we ask for your email address, and optionally a phone number.

Because these answers indicate that you or someone you care for may be seeking an ADHD assessment, they are information about health — “special category” data under UK data protection law. That means we need your explicit consent, which is why the consent boxes at the end of the questionnaire are unticked by default and why we explain what each one does.

There are two separate consents, and they do different things:

• Required — to send your personalised clinic matches to your email address. We show your matches on screen straight away and email you a copy, so you still have them once you have closed the page.
• Optional — to pass your contact details to clinics so they can contact you about an assessment. This is entirely your choice, and you get your results either way.

Monthly totals. We count how many people complete the questionnaire each month, and we may publish those totals, for example in our research. A total is one number for a month: it contains none of your answers and nothing that could identify you, and we never publish a total below ten.

Lawful basis: your consent (Article 6(1)(a) UK GDPR) and your explicit consent for health information (Article 9(2)(a) UK GDPR). You can withdraw either consent at any time — see Your rights below.

5. Enquiries you send to a clinic from its listing — health information

Clinic pages carry a form for asking that clinic about an assessment — it appears when we have confirmed the clinic's email address can actually receive mail, so your enquiry never goes to a dead mailbox. If you use it we ask who the assessment is for, what you are looking for, your email address, and optionally a first name, a phone number and a message. We do not ask for a surname.

Like the questionnaire, these answers indicate that you or someone you care for may be seeking an ADHD assessment, so they are information about health — “special category” data. We send them to the one clinic whose page you were on — the Send button names that clinic, so you always know exactly who receives your enquiry before you send it. No other clinic gets it, and we do not use it to contact you about anything else.

The clinic pays us nothing for this. It makes no difference whether they advertise with us or not.

After you send an enquiry we may email you at most twice about it: if we learn that the clinic's email address is not working we will tell you and give you their own contact details, and a few days later we may ask a single yes/no question — whether the clinic got back to you — because that is the only way we can find out which clinics respond. Nothing else, and never marketing.

Your conversation with the clinic. A clinic with a Featured listing receives your contact details with the enquiry and usually replies to you directly. A clinic without one replies through us: we email you a notification and keep those messages here, so you and the clinic can both read the conversation in one place. The notification deliberately does not contain the message itself — you follow a private link to read it, so the words are not left sitting in an inbox after we have deleted them.

We delete these messages after six months, which is sooner than the twelve months we keep the enquiry itself. You can delete them at any time before that, from the conversation page itself — we email you a private link to it whenever the clinic replies. Deleting removes the words immediately and stops that link working, including in emails already sent. Only you and the clinic you enquired with can see the conversation.

It is a way to arrange an appointment — cost, waiting times, what happens next. It is not a way to get medical advice, and nobody monitors it out of hours.

Like our other forms, we also record a one-way hashed version of your IP address and your browser's user-agent string when you send an enquiry, to help us block automated abuse. We cannot identify you from these.

Monthly totals. We count how many people send an enquiry from a clinic's listing each month, and we may publish those totals. A total contains nothing you wrote and nothing that could identify you, and we never publish a total below ten.

Lawful basis: your consent (Article 6(1)(a) UK GDPR) and your explicit consent for health information (Article 9(2)(a) UK GDPR); legitimate interests (Article 6(1)(f)) for the anti-abuse records. You give this consent by sending the enquiry — the Send button states in words what is shared and names the clinic that will receive it, and nothing is sent unless you choose to.

6. Clinic contact information

We hold contact details for the clinics we list — a public-facing email address, phone number and website, gathered from the clinic's own published pages or provided by the clinic when it asked to be listed. Where a clinic's published address is a named person's mailbox, that address is personal data and this section is our notice to them.

We use these details to run the directory, to pass on patient enquiries, and to check — through the verification service described under Service providers — that an address can receive mail before any enquiry is sent to it. We keep them while the clinic is listed. A clinic can stop receiving patient enquiries at any time using the link in any enquiry email or by asking us, and can ask us to correct or remove its details at [email protected].

Lawful basis: legitimate interests (Article 6(1)(f) UK GDPR) — running an accurate directory and delivering the enquiries patients ask us to send, using contact details the clinic itself has published.

7. Clinic portal accounts

If you work for a clinic and create a portal account, we store your name, work email address, a securely hashed password (if you set one), and which clinic your account is linked to. We use it to run your account, show you your listing's statistics, and give you a working view of the enquiries patients send your clinic.

That working view includes the enquiry itself: the portal shows a clinic the full contents of each enquiry addressed to it — the patient's first name, email address, phone number if given, and message — exactly what we already deliver to the clinic's email address (see “A clinic you enquired with directly” below). It is the same information shown a second way, never to any other clinic, and it follows the same 12-month retention rule described in the table below. Notes a clinic writes about an enquiry are the clinic's own working records, visible only inside that clinic's portal.

If you switch on text alerts, we also store the mobile number you give us and the date you confirmed it. We text a code to that number first and only start sending alerts once it is entered back — so the alerts are confirmed by whoever holds the phone, not only by whoever filled in the form. An alert says that an enquiry has arrived and links you to it; it never contains a patient's name, contact details or message. Reply STOP to any of our texts and they end immediately and permanently, and we delete the number. You can do the same at any time from the notifications screen.

Lawful basis: performance of a contract with you or your clinic (Article 6(1)(b) UK GDPR) for the account itself; for showing the enquiry contents, the same explicit consent the patient gave when sending the enquiry (Article 9(2)(a)) — the portal is a delivery route to the one clinic they chose, not a new use.

Who we share your information with

We never sell or rent your personal information, and we do not share it for anyone else's marketing. There are two situations in which we pass your details to another organisation, and both only happen if you ask us to:

1. A clinic you enquired with directly

If you use the enquiry form on a clinic's page and send it, we send your first name, what you are looking for, and any message you wrote to that one clinic. The Send button names the clinic before you send. We do not ask for your surname.

Whether the clinic also receives your email address and phone number depends on their account with us. Clinics with a Featured listing receive both and will usually reply to you directly. Clinics without one are never given your phone number, and the copy of the enquiry we email them carries no contact details at all. They read the enquiry in our portal, where your email address is visible to them, and reply through us — we pass that reply on to you by email. Either way the clinic you chose is the only one that receives anything, and either way you get an answer — the difference is whether it reaches you from them or from us.

Clinic staff with a portal account read your enquiry there, and it is removed on the same 12-month schedule as the email copy (see the retention table). If you would rather not continue a conversation, every message we send you carries a link to end it — after which neither side can post, and the clinic keeps only what you had already sent.

The clinic pays us nothing for this, whether or not they advertise with us. Any clinic whose email address we have confirmed can receive these enquiries — most can — and a clinic is only ever excluded because its address does not work or because it asked us not to send them, never because of payment.

A clinic can also connect its own software to ours, in two ways, and it is worth being plain about the difference. A webhook tells the clinic's system that an enquiry has arrived and gives it a reference and a link — it carries no name, message or contact details. An API key can read the enquiry in full, including your message, into whatever system the clinic runs. Where a clinic does that, it decides what happens next with that copy and is responsible for it under data-protection law, exactly as it is for anything it has already been sent. Only the clinic you chose can ever do this, and only for enquiries addressed to it.

What we send the clinic by email. The email we send a clinic tells them an enquiry has arrived, what you are looking for and who it is for, and gives them a link to open it. It deliberately does not contain your message — the same reason your own notifications do not: an email sits in a mailbox we do not control and would outlive the deletion we promise you. Clinics with a Featured listing also receive your email address and phone number there, so they can reply to you directly.

Asking you for a review. If you reached a clinic through this site and it later records that your assessment went ahead, we may email you once — and only once, ever — to ask whether you would leave that clinic a review. We ask everyone in the same position, never only the people a clinic expects to be complimentary, and there is never a reward for leaving one. Every such email carries a one-click way to stop, which is permanent, and you can also reply to us at any time to be excluded.

Lawful basis: legitimate interests (Article 6(1)(f) UK GDPR) — helping patients choose between clinics on genuine, current experience. We balanced this against your interests by asking at most once, never offering an incentive, keeping the request free of any health detail, and honouring an opt-out permanently.

2. Clinics matched to you by the questionnaire

If you tick the optional consent box at the end of the questionnaire, we send your email address, your first name and phone number if you gave them, and your questionnaire answers to a maximum of three clinics from our directory, so they can contact you about an assessment. The name is optional — leave it blank and we send nothing but the rest. Whether a clinic also receives your email address and phone number depends on their account with us — clinics without a paid account reply through us instead, and we pass their answer on to you. Where a clinic replies through us we keep those messages here so you and the clinic can both read the conversation, we delete them after six months, and you can delete them yourself sooner. A clinic that has your contact details may simply phone or email you directly, and that conversation is its own.

Here you have not chosen a clinic, so we choose for you. We pick on how close a clinic is to you and whether it does what you asked for, and one of the three places is reserved for a clinic that advertises with us, wherever a suitable one exists — those places are shared evenly among the clinics that pay us. The other places go to the closest clinics that fit, whether they pay us or not. We tell you this plainly because you should know how we make money before you decide whether to tick the box. Paid placement is always marked “Featured”. Elsewhere on the site paying can also lift a clinic's position in our lists — every list where it does says so, and our terms set out exactly how — but it never changes a clinic's rating or its reviews.

In both cases, once a clinic has your details it becomes responsible for them as its own data controller, and its own privacy policy applies. If you would rather approach a clinic yourself without us passing anything on, don't send an enquiry and leave the questionnaire's boxes unticked — use the clinic's own website or phone number from their listing instead, which are links to them, and nothing is shared with anyone.

Service providers

We use a small number of companies to run the site. They process data on our instructions only, under contract, and cannot use it for their own purposes:

• DigitalOcean, LLC — hosting for our website and database.
• Resend — sending emails, including your clinic matches and any enquiry you have consented to send.
• Conva Ventures Inc. (Fathom Analytics) — website analytics.
• Stripe Payments UK, Ltd. — taking payment from clinics that buy a Featured placement, and handling their card details, billing address and invoices. This applies only to clinics that choose to pay us. We never send Stripe anything about a patient, and we never see or store card numbers.

We also use BounceBan, an email verification service based in the United States, to check whether a clinic's published email address can actually receive mail before we ever send an enquiry to it. We send BounceBan clinic email addresses only — never your details, your enquiry, or anything else about you — and its own privacy notice governs how it handles them.

We may also disclose information where the law requires it, or to establish or defend legal claims.

Where your information is processed

Our servers, and some of our providers, are outside the UK. Where information leaves the UK we rely on the safeguards UK law provides for that country or provider:

• United States — DigitalOcean and Resend both certify under the UK Extension to the EU–US Data Privacy Framework, which the UK government recognises as providing adequate protection.
• Canada — Fathom Analytics is operated by Conva Ventures Inc. Canada is covered by a UK adequacy decision for commercial organisations.
• Stripe — our contracting entity is Stripe Payments UK, Ltd. Where Stripe moves information outside the UK it relies on Standard Contractual Clauses together with the UK Addendum, rather than on an adequacy decision.

How long we keep it

We may keep information for longer where we have to for legal or accounting reasons, or to deal with a dispute.

Your rights

Under UK data protection law you have the right to:

• Ask for a copy of the personal data we hold about you
• Ask us to correct anything that is wrong or incomplete
• Ask us to delete your data
• Ask us to restrict how we use it
• Object to us using it on the basis of our legitimate interests
• Ask us to transfer it to you or another organisation
• Withdraw your consent at any time, where we rely on consent — including the consent to be contacted by clinics. Withdrawing it does not affect anything we did before you withdrew it, and we cannot recall an enquiry a clinic has already received, though we will tell you which clinics it went to so you can ask them directly.

To exercise any of these, email [email protected]. We will respond within one month, and we do not charge for it.

If you are unhappy with how we have handled your information you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. We would appreciate the chance to put things right first.

Children

This site is intended for adults. Our questionnaire can be used to find an assessment for a child or teenager, but it should be completed by their parent or guardian, and we ask for the adult's contact details rather than the child's. We do not knowingly collect personal information directly from children. If you believe a child has given us their details, contact us and we will delete them.

Cookies

We use cookies and similar local storage only where they are necessary for the website to work — for example, to remember your questionnaire answers as you move between steps, to carry the contact details you typed into one clinic’s enquiry form over to the next one so you do not have to retype them, and to keep clinic portal users signed in. The enquiry details are held only for the current browser tab, are never the message you wrote, and you can clear them at any time from the form itself. We do not use advertising or third-party tracking cookies, and our analytics is cookie-free. Because these are strictly necessary, we do not show a cookie banner.

Security

The site is served over encrypted connections, passwords are stored hashed rather than in readable form, and access to our database is restricted. No system can be guaranteed completely secure, but we take reasonable steps to protect your information and will tell you and the ICO about a breach where the law requires it.

Third-party links and embedded video

Our website links to clinic websites and other third-party sites. We are not responsible for their privacy practices, and we encourage you to read their own privacy policies.

Some clinic pages include a video hosted by YouTube or Vimeo. We show only a still image until you press play; nothing is requested from YouTube or Vimeo, and no cookie of theirs is set, unless you choose to watch it. If you do, that video is played by them and their own privacy policy applies to it. We use YouTube’s no-cookie player, which does not set advertising cookies.

Changes to this policy

We may update this policy from time to time. We will post any changes on this page and update the date at the top. Where a change materially affects how we use information you have already given us, we will contact you.