Athona Limited, trading as Assessment UK (the Provider), is a Care Quality Commission (CQC)-registered remote consultation clinic providing comprehensive diagnostic assessments and evidence-based treatments for conditions such as Attention Deficit Hyperactivity Disorder (ADHD), Autism Spectrum Disorder (ASD) and other psychological needs. Services are delivered remotely across England via secure telehealth platforms.

This Data Protection Policy sets out our approach to processing personal data in compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Data (Use and Access) Act 2025. It supports CQC Regulation 12 (Safe care and treatment) and Regulation 17 (Good governance) and is read with the Privacy Notice, Information Governance Policy, Confidentiality Policy, Records Management Policy and Clinical AI Scribe Policy (Heidi).

Purpose

  • Ensure all personal data processing is lawful, fair, transparent and secure, particularly for special-category health data.
  • Protect individuals’ rights under UK GDPR.
  • Identify and mitigate data-protection risks in remote telehealth environments.
  • Demonstrate accountability through documented processes, including Data Protection Impact Assessments (DPIAs).
  • Support clinical governance, audit and service improvement.

Scope

This policy applies to all staff, contractors, locums and multidisciplinary team members, and to all third parties processing data on our behalf. It covers personal data of patients and service users (adults, children and young people, families and carers), informants, and staff. It applies to all processing activities connected with remote assessment, titration, review, shared care, identity verification and related administrative functions.

Definitions

  • Personal data: Information relating to an identified or identifiable living individual.
  • Special-category data: Data revealing health, racial or ethnic origin, or other Article 9 categories.
  • Data controller: Athona Limited trading as Assessment UK.
  • Data processor: A third party that processes personal data on our instructions under a written contract.
  • Informant: A person (typically a parent or long-term carer) who knew the patient as a child and who is asked to complete a questionnaire to support the assessment.

Legal and Regulatory Framework

  • UK GDPR and Data Protection Act 2018 (including the seven principles).
  • Data (Use and Access) Act 2025.
  • CQC Regulations 12 and 17.
  • NHS Records Management Code of Practice 2021 and the Data Security and Protection Toolkit.
  • Caldicott Principles.
  • Common-law duty of confidentiality.

Lawful Bases

For patients and service users the primary lawful bases are Article 6(1)(e) (public task / health service delivery) and Article 9(2)(h) (provision of health or social care). Agreement is sought where needed for transparency or for non-essential purposes (for example research, certain school or family contacts, the ambient scribe, or passing contact details to a selected therapy provider). Agreement is not used as the Article 9 lawful basis for core clinical care. Staff processing relies on Article 6(1)(b) (contract) and Article 6(1)(c) (legal obligation), with Article 9(2)(b) where employment-related health data is involved.

Children’s data is processed with parental responsibility or, where the young person has capacity, with their involvement (Gillick competence).

Approved Ambient Scribe (Heidi)

Heidi is the only approved ambient clinical scribe. It may be used only after the person has been told and has agreed for that contact (transparency). The lawful basis remains Article 6(1)(b) or (f) together with Article 9(2)(h). Audio is not retained after the draft note is produced. Patient encounters are not used to train any supplier model. The clinician must review, correct and sign the note before it becomes part of the clinical record. No other AI tool is used on clinical content. A DPIA, Data Processing Agreement and AI systems register entry are required before live use.

Informants

Where it supports the assessment we may ask the patient for the name and email address of an informant (for example a parent). We send the informant a questionnaire. The email contains a short privacy statement meeting UK GDPR Article 14 (why we are contacting them, what we will do with their answers, how long we keep them and their rights). Informant data is handled under the same security and retention rules as other assessment information.

Sharing

We share the minimum necessary data securely and in line with the Caldicott Principles. Sharing with a GP or other healthcare professional for direct care is permitted under the lawful bases above. With the patient’s agreement we may also pass contact details to selected therapy providers who may be able to assist further. We never sell personal data.

Suppliers (Processors)

The following suppliers process personal data on our behalf under written contracts that require UK GDPR compliance:

  • Semble – patient management / electronic health record software.
  • Heidi Health – approved ambient clinical scribe (no model training on customer data; audio not retained after draft).
  • Qbtech – QBCheck quantified behaviour assessment tool (authorised to aggregate or anonymise data, including for product development and model training; Qbtech solely liable for secondary use).
  • Stripe – card payment processing.
  • Romi (Neuro Notion App Limited) – AI companion app.
  • SignatureRX and Pharmacierge – pharmacy providers.
  • Orb by Mipro Medical Solutions Ltd – GP summary record access.
  • Accuro – administrative functions.

No international transfers of personal data take place for the core clinical record or Heidi processing without appropriate safeguards.

Responsibilities

  • Board of Directors: Approve the policy, oversee strategy and review DPIA summaries and breach reports.
  • Data Protection Officer (dpo@assessmentuk.com): Monitor compliance, advise, conduct DPIAs for high-risk activities, handle data-subject requests and ICO notifications.
  • Senior Information Risk Owner: Integrate data protection into risk registers and review processor contracts.
  • Registered Manager (Registered.Manager@assessmentuk.com): Embed the policy in operations, oversee DSARs and escalate breaches.
  • All staff: Process data only as necessary and securely, report incidents, and follow the Privacy Notice and related procedures.
  • Processors: Comply with their Data Processing Agreements and permit audits.

Data Security, DPIAs and Breach Management

Technical and organisational measures include encryption, role-based access controls, multi-factor authentication and secure virtual desktop access for home-based staff. Records are not stored on personal devices. DPIAs are completed for high-risk processing (including the Heidi ambient scribe and any new telehealth or AI tools) before the activity starts. Breaches that meet the threshold are reported to the Information Commissioner’s Office within 72 hours. All incidents, including near misses, are logged and reviewed.

Retention and Disposal

Retention follows the NHS Records Management Code of Practice: adult health records generally 8 years after last contact; children’s records until the 25th birthday (or 8 years after last contact if longer); identity documents only as long as needed for verification. Data is securely deleted or destroyed at the end of the retention period.

Training, Monitoring and Complaints

All staff complete mandatory data-protection training annually and at induction. Compliance is monitored through audits, DSPT submission and review of data-subject requests. Data-protection concerns should be directed to the Data Protection Officer at dpo@assessmentuk.com or the Registered Manager at Registered.Manager@assessmentuk.com. Unresolved issues may be escalated to the Information Commissioner’s Office.

Linked policies

  • Privacy Notice
  • Cookie Policy
  • Information Governance Policy
  • Confidentiality Policy
  • Records Management Policy
  • Clinical AI Scribe Policy (Heidi)
  • Shared Care and GP Communication Protocol
  • Consent Policy and Procedure for Adults
  • Consent Policy and Procedure for Children and Young Persons
  • Digital Platform, Technology Safety and Cybersecurity Policy

This policy will be reviewed annually or following changes in regulations or professional guidance.

Version: 1.2

Classification: Public External Use

Date: 30/10/2026

Review Date: 30/10/2027