Privacy Policy

What data we collect

When you use our website or book an assessment, we may collect: your name, email address, phone number, and date of birth; health information including medical history, current medications, and responses to our pre-assessment questionnaires; identity verification documents; payment information (processed via Stripe — we do not store card details); and technical data such as your IP address, browser type, and pages visited.

If you contact us, request a guide, download our sample report, or take our online screener, we also collect the details you provide, such as your email address and the content of your enquiry.

We only collect information that is necessary for the service you have requested.

How we use your data

We use your personal data to process your booking and deliver your assessment; communicate with you about your appointment and report; process payment; comply with our legal and regulatory obligations; improve the quality and safety of our services; and, where you have given permission, send you marketing communications.

We process your data on the following legal bases: performance of a contract (your booking); compliance with a legal obligation; our legitimate interests in operating and improving our service; your explicit consent, which is required for special category health data under UK GDPR Article 9(2)(h); and your consent for optional cookies and marketing communications, which you may withdraw at any time.

Your health data

Your health information is special category data under UK GDPR. We process it solely to provide your diagnostic assessment, under Article 9(2)(h) and your explicit consent provided at the time of booking.

Your clinical records are held securely in Carepatron, our clinical management platform, with access restricted to your assessing clinician and administrative staff on a strict need-to-know basis.

We never use your health information for marketing or advertising, we never build advertising audiences from it, and we never target advertising to you based on your health information or any health condition.

Marketing communications

Where you give us permission — for example by requesting a guide, downloading our sample report, taking our online screener, or otherwise opting in — we may send you helpful information about ADHD and our services by email. Every marketing email includes an unsubscribe link, and you can opt out at any time without affecting any assessment you have booked.

We decide what to send you based only on the fact that you chose to opt in — never on your clinical information, your assessment outcome, or any health condition. We use a third-party email platform to deliver these communications on our behalf under a data processing agreement.

Third parties and data sharing

We do not sell your personal data. We share data only with the following parties, each under appropriate data processing agreements:

Care Patron Limited (trading as Carepatron) — our clinical platform, which processes appointment data, pre-assessment questionnaire responses, and clinical documentation on our behalf under a data processing agreement. Care Patron Limited is based in New Zealand. Data transferred to Carepatron is protected under their GDPR compliance framework and SOC 2 certification, which ensures your data is handled to an equivalent standard of protection.

Stripe — our payment processor. Payment card data is handled entirely by Stripe and is not stored by us.

Google — we use Google Analytics 4 and Google Signals to understand how our website is used, and Google Ads conversion tracking, delivered through the Google tag and Google Tag Manager, to measure the effectiveness of our advertising. We use Google Consent Mode so that these tags respect the choices you make in our cookie banner. This data is processed in accordance with Google's privacy policy.

Meta — where we advertise on Meta platforms (Facebook and Instagram), we use the Meta Pixel to measure the effectiveness of that advertising and to reach relevant audiences. Any Meta tracking is only activated if you accept advertising cookies via our consent banner.

Email platform — where you have opted in to marketing, we use a third-party email service provider to send and manage those communications on our behalf.

We may add, remove, or change our analytics, advertising, and email providers from time to time. Any new provider will operate on the same consent basis, and to the same standards of protection, described in this policy.

We may also share data where required by law, regulation, or court order.

Data retention

We retain clinical records for a minimum of 8 years following your last assessment, in line with NHS record-keeping guidelines for private providers. Financial records are kept for 7 years as required by HMRC.

If you enquire, download a resource, take our screener, or otherwise give us your details but do not book, we will keep your contact details for no longer than 12 months, or until you ask us to delete them or you unsubscribe, whichever is sooner. You may request earlier deletion subject to our legal obligations.

Your rights

Under UK GDPR you have the right to: access the personal data we hold about you; request correction of inaccurate data; request erasure of your data (subject to legal obligations); restrict or object to our processing; receive your data in a portable format; and withdraw consent at any time.

To exercise any of these rights, contact us at info@distinct.health. We will respond within one calendar month. You also have the right to complain to the ICO at ico.org.uk or on 0303 123 1113.

Changes to this policy

We update this policy when we change how we process data — for example when we add a new third-party tool or change our practices. The date at the top of this page reflects when it was last updated. We encourage you to check back periodically.