Privacy policy

1. Who we are

ADHD Brain Scan UK is a trading name operated from 7 Chelford Road, Handforth, SK9 3SQ, United Kingdom. We provide private qEEG brain screening services for ADHD.

For the purposes of UK data protection law (the UK General Data Protection Regulation and the Data Protection Act 2018), we are the data controller — meaning we decide how and why your personal data is processed.

Contact for data enquiries:
Email: info@adhdbrainscan.co.uk
Phone: +44 161 570 1638
Address: 7 Chelford Road, Handforth, SK9 3SQ

2. What data we collect

We collect the following categories of data depending on how you interact with us:

Personal information (provided by you)

• Full name
• Date of birth
• Email address
• Phone number
• Postal address (if provided)
• Gender
• Referral source (e.g. self-referral, GP, school)
• Current medications
• Relevant medical history and presenting concerns
• Parent/guardian details (for clients under 18)

Health data (special category data)

• Raw EEG recordings from all electrode channels (Cz, Fz, F3, F4)
• Computed frequency band powers (delta, theta, alpha, beta, gamma)
• Theta/beta ratio measurements
• Z-scores and normative comparison results
• Go/No-Go attention task performance data (reaction times, accuracy, error rates)
• Generated PDF screening reports (see how it works)
• Clinical interpretation letters (comprehensive package only)

Payment data

Payments are processed securely by Stripe. We do not see, store, or have access to your full card number, CVV, or bank details. Stripe handles all payment processing in compliance with PCI-DSS Level 1. We receive only a transaction confirmation, amount, and the last four digits of your card for record-keeping.

Website usage data

• Pages visited and time spent (via anonymised analytics)
• Browser type and device information
• Referring website
• IP address (anonymised)

3. How we use your data

Purpose	Lawful basis
Conducting your qEEG brain screening	Explicit consent (Article 9(2)(a))
Generating your screening report	Explicit consent; performance of contract
Comparing results against normative data	Explicit consent
Sending your report via email	Performance of contract
Providing results consultation (comprehensive package)	Explicit consent; performance of contract
Medication comparison (comparing pre/post scans)	Explicit consent
Processing payment	Performance of contract
Contacting you about your appointment	Performance of contract; legitimate interest
Responding to enquiries	Legitimate interest
Improving our services and website	Legitimate interest

4. How we store your data

Your data is stored securely using the following systems:

• Screening data and EEG recordings: Stored in Google Cloud Firestore, encrypted at rest (AES-256) and in transit (TLS 1.2+). Data is stored in EU/UK data centres. Access is restricted to authenticated personnel only.
• PDF reports and clinical letters: Generated locally during the screening session and transmitted to you via email. Copies are stored in our secure cloud storage.
• Payment records: Held by Stripe in PCI-DSS compliant infrastructure. We retain transaction records (amount, date, last four digits) for accounting purposes.
• Email correspondence: Stored in our email system with standard encryption.

5. How long we keep your data

We retain your data for the following periods, after which it is securely deleted:

Data type	Retention period	Reason
Screening reports (PDF)	7 years from last appointment (adults) Until the client turns 25 (children)	Aligns with NHS health records guidance; enables medication comparison scans; covers complaints and legal queries
Clinical interpretation letters	7 years (adults) Until client turns 25 (children)	May be needed for ongoing clinical, educational, or workplace purposes
Raw EEG recordings	2 years from recording date	Allows for re-analysis if needed; raw data is large and its primary value is in the computed report
Personal information	7 years (adults) Until client turns 25 (children)	Linked to screening records; necessary for identification and follow-up
Payment records	7 years from transaction date	HMRC legal requirement for financial records
Consent forms	7 years (adults) Until client turns 25 (children)	Evidence of valid consent for processing health data
Website analytics	26 months	Standard analytics retention for service improvement

6. Who we share your data with

We do not sell, rent, or trade your personal or health data to any third party. We share data only in the following limited circumstances:

• With your explicit consent: If you ask us to share your report with your GP, psychiatrist, school, employer, or any other party, we will do so only with your written or verbal consent.
• Payment processor: Stripe processes your payment data under their own privacy policy (stripe.com/gb/privacy).
• Cloud infrastructure: Google Cloud Platform hosts our database infrastructure under their data processing agreement, with data stored in EU/UK regions.
• Legal obligation: If required by law, regulation, or valid legal process (e.g. court order), we may be required to disclose data to authorities.

We do not share your data with marketing companies, advertisers, data brokers, or any commercial third parties.

7. Your rights under UK GDPR

Under UK data protection law, you have the following rights regarding your personal data:

• Right of access: You can request a copy of all personal and health data we hold about you. We will respond within 30 days.
• Right to rectification: You can ask us to correct any inaccurate data we hold.
• Right to erasure: You can request that we delete your data, subject to legal and regulatory retention requirements. Note that we may need to retain certain health records for the periods specified in section 5.
• Right to restrict processing: You can ask us to limit how we use your data in certain circumstances.
• Right to data portability: You can request your data in a structured, machine-readable format to transfer to another provider.
• Right to withdraw consent: Where processing is based on consent, you can withdraw that consent at any time. This does not affect the lawfulness of processing carried out before withdrawal.
• Right to object: You can object to processing based on legitimate interest.

To exercise any of these rights, contact us at info@adhdbrainscan.co.uk. We will respond within 30 days.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk | Helpline: 0303 123 1113.

8. Children's data

For clients under 18, we require consent from a parent or legal guardian before conducting any screening. The parent/guardian must:

• Complete and sign the intake and consent form on behalf of the child
• Be present during the screening session
• Be the named recipient of all reports and correspondence

When a child reaches 18, they may contact us to take ownership of their records, request a copy, or request deletion.

9. Data security

We take the security of your data seriously and implement the following measures:

• All data is encrypted at rest (AES-256) and in transit (TLS 1.2+)
• Access to screening data requires authenticated login with role-based permissions
• Cloud infrastructure is hosted on Google Cloud Platform with SOC 2 Type II and ISO 27001 certification
• Payment processing is handled entirely by Stripe (PCI-DSS Level 1 compliant)
• PDF reports are transmitted via encrypted email
• Physical screening equipment is stored securely when not in use
• Staff are trained in data protection and confidentiality procedures

10. Cookies

Our website uses the following cookies:

• Essential cookies: Required for the website to function (e.g. session management). These cannot be disabled.
• Analytics cookies: We may use anonymised analytics to understand how visitors use our site. No personally identifiable information is collected through analytics. You can opt out via your browser settings.

We do not use advertising cookies, tracking pixels, or retargeting technology.

11. Third-party links

Our website may contain links to external websites (e.g. Stripe for payments, research publications). We are not responsible for the privacy practices of external sites. We recommend reviewing their privacy policies independently.

12. Changes to this policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. The "last updated" date at the bottom of this page will always reflect the most recent version. Material changes will be communicated via email to existing clients where appropriate.

13. Contact us

If you have any questions about this privacy policy, wish to exercise your data rights, or have concerns about how we handle your information, please contact us:

ADHD Brain Scan UK
7 Chelford Road, Handforth, SK9 3SQ
Email: info@adhdbrainscan.co.uk
Phone: +44 161 570 1638