Effective Date: 11 March 2025
Last Updated: 10 March 2025
At ADHD Access, a subsidiary of True Face Aesthetics Ltd, we are committed to protecting your privacy and handling your personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, NHS Digital standards, and guidance from the Information Commissioner’s Office (ICO). This notice explains how we collect, use, store, and share your data. It also outlines our transition from Pabau to new platforms (DrDoctor, EMIS Web, Airtable), and what that means for your information.
1. Who We Are
ADHD Access supports patients with diagnosed ADHD by offering medication reviews, prescribing, and referral pathways for coaching and therapy. We do not carry out diagnostic assessments.
Your data is stored securely in NHS-compliant systems and processed in line with data protection legislation.
Data Controller: True Face Aesthetics Ltd, Company No. 07123619
Registered Address: 381 Brinsworth Road, Brinsworth, Rotherham, S60 5DL
Contact: info@adhdaccess.uk
2. Lawful Basis for Processing Your Data
We process your personal data under the following lawful bases:
- Public Task (Article 6(1)(e)) – necessary for delivering healthcare services
- Legal Obligation (Article 9(2)(h)) – required for medical diagnosis, prescribing, and treatment
We do not rely on consent as the legal basis for clinical data processing. Consent is only used where required, such as for marketing communications.
3. What Information We Collect
We collect only the data necessary to provide safe, effective ADHD care:
- Personal information: name, date of birth, NHS number, contact details
- Health data: diagnosis documents, prescriptions, consultation records, physical health observations
- Appointment and referral data: bookings, referral letters
- Questionnaires: symptom rating scales and screening tools
- Communications: call logs, emails, messages
- Payment data: transaction dates, invoice records, refunds
All payments are securely processed via Stripe. ADHD Access does not collect or store payment card information.
4. Where and How We Store Your Data
Your data is stored in secure, encrypted systems:
- EMIS Web: medical records, treatment plans, and GP summary care records
- DrDoctor: patient questionnaires and appointment logistics
- Airtable: internal tracking of patient care
- NHSmail: encrypted internal communication
Data is encrypted and access-controlled. Only authorised team members can access your information. Staff use secure, centrally managed, encrypted devices.
5. Transition from Pabau to New Systems
From 11 March 2025, all new patient records are managed using EMIS Web and DrDoctor.
Patients registered before 10 March 2025: data may remain partially in Pabau until secure migration is complete by January 2026
Patients registered after this date: data is held solely in DrDoctor and EMIS Web
During migration:
- Access to legacy systems is restricted to essential staff
- Data transfers are encrypted
- Once complete, Pabau data will be securely deleted
Referrals will be processed through NHS e-RS or secure channels, not email.
6. How Long We Keep Your Data
We follow NHS retention guidance:
- EMIS Web records: 8 years after last contact
- Referrals: 5 years
- Questionnaires: 3 years
- Customer service emails: 90 days
Data is securely deleted using NHS-compliant processes once no longer required.
7. Who We Share Your Data With
We only share data where necessary for your care or legal obligations:
- Your GP: to ensure continuity of care
- Pharmacies: to dispense ADHD medication
- NHS Digital and regulatory bodies: when required for auditing and compliance
- Approved third-party IT providers (e.g. DrDoctor, EMIS Web, Airtable, Handsfree IT): to support secure infrastructure
All third-party processors have signed Data Processing Agreements (DPAs) to ensure compliance with UK GDPR. We do not sell your data or share it for advertising purposes.
8. Automated Decision-Making
ADHD Access does not use automated systems to make decisions about your diagnosis or treatment.
AI tools may be used to support administrative tasks such as organising data or generating summaries. However, all clinical decisions are made by qualified clinicians.
