Athona Limited trading as Assessment UK is committed to protecting your personal data. This Privacy Notice explains what we collect, how long we keep it, who we share it with, whether a supplier processes it outside the United Kingdom, and your rights of access, correction and complaint. It is written in compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Data (Use and Access) Act 2025.

We process data fairly, transparently and securely to deliver high-quality, person-centred remote assessments and treatments for conditions such as Attention Deficit Hyperactivity Disorder (ADHD), Autism Spectrum Disorder (ASD) and other psychological needs.

This notice applies to patients and service users (including children, young people, adults, families and carers), informants (people who knew a patient as a child and who are asked to complete a questionnaire), and staff (including employees, contractors and multidisciplinary team members). Where processing differs we have noted it. If you have questions, contact our Data Protection Officer.

Who We Are

  • Data Controller: Athona Limited trading as Assessment UK
  • Address: 2nd Floor Kingsgate House, 1 King Edward Road, Brentwood, Essex CM14 4HG
  • Telephone: 01277 255617
  • Website: www.assessmentuk.com
  • CQC Provider ID: 1-24079282695
  • Data Protection Officer: dpo@assessmentuk.com
  • Registered Manager: Registered.Manager@assessmentuk.com

As a CQC-registered provider we deliver remote services across England via secure telehealth platforms, adhering to NICE guidelines, NHS standards and our Statement of Purpose.

What Data We Collect

We only collect data necessary for our purposes.

For patients and service users

  • Personal identifiers: name, date of birth, address, contact details, gender, ethnicity (to support inclusive care).
  • Health and special-category data: medical history, symptoms, diagnostic results (including from tools such as WURS-25 and QBCheck), treatment plans, titration monitoring (heart rate, blood pressure, height and weight at agreed intervals), referral details and feedback.
  • Identity and location verification data to confirm you are the right person and that you are in the United Kingdom at the time of contact.
  • Family, carer, school or workplace information where relevant to the assessment, and accessibility or reasonable-adjustment needs.

For informants

Where it helps the assessment (for example ADHD or autism history from childhood), we may ask you for the name and email address of someone who knew you as a child, such as a parent or long-term carer. We call these people informants. We send them a questionnaire. The email we send includes a short privacy statement explaining why we are contacting them, what we will do with their answers, how long we keep them and their rights (UK GDPR Article 14).

For staff

  • Personal identifiers, contact details, emergency contacts and identity documents.
  • Employment data: CV, qualifications, training records, performance, payroll, bank details, DBS and fitness-for-role information where relevant.

How We Use Your Data

For patients and service users

  • To provide remote diagnostic assessments, titration and reviews.
  • To coordinate care with your GP and other professionals involved in your care, in line with the law and your agreement where required.
  • To keep you safe (risk assessment, safeguarding, red-flag escalation).
  • To improve our services through clinical audit, quality improvement and feedback (using the minimum data necessary).
  • To meet legal and professional duties (CQC, NICE, professional regulators).

Approved ambient scribe (Heidi)

We may use an approved ambient clinical scribe (Heidi) to help draft the note of a video contact. We ask for your agreement before it starts so that you know it is happening and can say no. Saying no does not change your care; the clinician writes the note in the usual way. The lawful basis for this processing is the provision of health care (Article 6(1)(b) or (f) together with Article 9(2)(h) UK GDPR). Audio is not kept after the draft note has been produced. Patient encounters are not used to train any supplier’s general model. The clinician must review, correct and sign the note before it becomes part of your record. No other AI tool is used on clinical content.

Automated decisions are not used for clinical decisions; all clinical decisions involve human oversight.

For staff

  • Recruitment, employment, payroll, training, performance and regulatory compliance (including CQC fit and proper person checks).

Legal Basis for Processing

Patients and service users

  • Article 6(1)(e) UK GDPR (public task / health service delivery) and Article 9(2)(h) (provision of health or social care).
  • Agreement where we need it for transparency or for non-essential purposes (for example research, certain school or family contacts, or the ambient scribe). You can withdraw agreement at any time; this does not affect the lawfulness of earlier processing.

Staff

  • Article 6(1)(b) (contract) and Article 6(1)(c) (legal obligation). Article 9(2)(b) where employment-related health data is processed.

Children’s data is processed with parental responsibility or, where the young person has capacity, with their involvement (Gillick competence).

Sharing Your Data

We share data only when necessary and securely. We never sell your data. Sharing of patient information follows the Caldicott Principles.

With other healthcare professionals

Where appropriate, information may be shared with your GP or other professionals involved in your care, in line with the law and your agreement where required. Safe titration and ongoing care usually depend on your GP knowing what has been diagnosed and prescribed. With your agreement we may also pass your contact details to selected therapy providers who may be able to assist you further with therapy or related services. You can ask for a copy of your records. Requests are handled as explained in this Privacy Notice.

With suppliers (processors)

We use the following suppliers under written contracts that require them to protect your data:

  • Semble – patient management / electronic health record software.
  • Heidi Health – approved ambient clinical scribe. Their data processing agreement states that no customer data (including personal data and output) will be used to train, fine-tune or improve any artificial intelligence model. Audio is not retained after the draft is produced.
  • Qbtech – suppliers of the QBCheck quantified behaviour assessment tool. Qbtech is authorised to aggregate or anonymise customer personal data, including for product development, service improvement and model training purposes. Qbtech is solely liable for such de-identification and secondary use.
  • Stripe – card payment processing. Stripe’s terms do not refer to the use of customer data for AI model training.
  • Romi (Neuro Notion App Limited) – AI companion app.
  • SignatureRX and Pharmacierge – pharmacy providers.
  • Orb by Mipro Medical Solutions Ltd – GP summary record access.
  • Accuro – administrative functions.

We do not transfer personal data outside the United Kingdom unless appropriate safeguards are in place. No international transfers take place for the core clinical record or Heidi processing without those safeguards.

We also share with regulators (CQC, Information Commissioner’s Office) or law enforcement where the law requires it.

Data Security and Retention

We use encryption, role-based access controls, multi-factor authentication and secure virtual desktop access for home-based staff. Records are not stored on personal devices. Staff complete data-protection training. Breaches that meet the threshold are reported to the Information Commissioner’s Office within 72 hours.

We keep appropriate records of the care we provide. Retention follows the NHS Records Management Code of Practice:

  • Adult health records: generally 8 years after last contact (longer if litigation).
  • Children and young people: until the 25th birthday (or 8 years after last contact if longer).
  • Identity documents: kept only as long as needed for verification and any legal requirement, then securely deleted.
  • Staff records: as required by employment law (typically 6 years after employment ends).

After the retention period, data is securely deleted or destroyed.

Cookie Policy

Our website uses cookies. Strictly necessary cookies are essential for the site to work (for example secure login). Performance/analytics and functional cookies are used only with your agreement. We do not currently use marketing cookies. A separate Cookie Policy will provide full detail. You can manage cookies through your browser or our consent tool. Cookie data is kept for up to 2 years or as needed for analysis, then deleted.

Your Rights

Under UK GDPR you have the right to be informed, to access your data, to rectification, to erasure (subject to legal exemptions for care records), to restriction, to object, to data portability (limited for health data), and to withdraw agreement where agreement is the basis. You can exercise these rights by contacting dpo@assessmentuk.com. We respond within one month. For children, rights may be exercised by a person with parental responsibility.

If you are unhappy with how we have used your information, please contact us first using the details in this Privacy Notice. We will acknowledge your complaint within 30 days. You can also complain to the Information Commissioner’s Office (ico.org.uk, 0303 123 1113).

Changes to This Notice

We may update this notice. Significant changes will be posted on our website and, where we have your contact details, notified to you. Please check the website regularly.

Contact Us

For queries, rights requests or concerns:

Data Protection Officer

Email: dpo@assessmentuk.com

Telephone: 01277 255617

Address: 2nd Floor Kingsgate House, 1 King Edward Road, Brentwood, Essex CM14 4HG

Registered Manager: Registered.Manager@assessmentuk.com

Linked policies

  • Data Protection Policy
  • Information Governance Policy
  • Confidentiality Policy
  • Records Management Policy
  • Clinical AI Scribe Policy (Heidi)
  • Shared Care and GP Communication Protocol
  • Consent Policy and Procedure for Adults
  • Consent Policy and Procedure for Children and Young Persons
  • Digital Platform, Technology Safety and Cybersecurity Policy
  • Statement of Purpose

This policy will be reviewed annually or following changes in regulations or professional guidance.

 

Version: 1.2

Classification: Public External Use

Date: 30/10/2026

Review Date: 30/10/2027