Our Policies

PRIVACY POLICY

Diyadvik Limited (“we”, “us”, “our”) is committed to protecting the privacy and confidentiality of all children, young people, parents, and carers who use our services. Because we process special category health data, we apply the highest standards of confidentiality and data protection. 

This Privacy Policy explains how we collect, use, store, and protect personal information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.  

This notice also provides additional information relating to website use.

1. Who We Are 

We provide private ADHD assessments, psychiatric treatment, and ongoing care for children and adolescents.  

Website: www.adhdclinic.org.uk  

Email: office@adhdclinic.org.uk 

Data Controller & Data Protection Lead:   

• Dr. Divik Seth, Consultant Child & Adolescent Psychiatrist 
• diyadvik limited | Hawthorne House,17a Hawthorne Drive, Leicester, LE5 6DL.  
• Information Commissioner’s Office (ICO) Registration No.: ZC072429 

2. What Information We Collect 

The types of personal information we may collect for the service includes but is not limited to: 

Personal details  

• Child’s name, date of birth, address  
• Gender Identity, Pronouns 
• Parent/Carer contact details  
• Parental responsibility information  

Clinical information  

• Referral information  
• Developmental history  
• School reports and teacher questionnaires  
• Assessment notes  
• Diagnostic reports  
• Medication history  
• Risk and safeguarding information  

Administrative information  

• Appointment records  
• Invoices and payment details  
• Correspondence with parents, schools, GPs, and other professionals  

Website data  

• IP address  
• Cookies (see Cookie Policy)  
• Contact form submissions  
• We do not collect unnecessary data. 

3. How We Collect Information 

With explicit consent, we collect information from: 

• Parents/carers directly 
• Children and young people (where appropriate) 
• Schools and SENCOs  
• GPs and other healthcare providers 
• Referral partners 
• Online forms submitted via our website 

4. Lawful basis for processing your information  

Under UK GDPR, we must have a lawful basis for processing your personal data. 

a. Provision of healthcare (Article 6(1)(e) & Article 9(2)(h))  

To assess, diagnose, and treat ADHD and related conditions.  

b. Consent (Article 6(1)(a))  

For sharing information with schools, external professionals, or for optional communications.  

c. Legal obligations (Article 6(1)(c))  

For safeguarding, regulatory compliance, and record‑keeping.  

d. Legitimate interests (Article 6(1)(f))  

For service administration, quality assurance, and responding to enquiries.  

We only process the minimum information necessary for safe clinical care. 

5. How We Use Your Information 

We use personal data to: 

• Provide ADHD assessments and treatment 
• Prepare clinical reports 
• Prescribe and monitor medication 
• Communicate with Parents/Carers 
• Liaise with schools, GPs, and other professionals (with consent) 
• Manage appointments and billing 
• Ensure clinical safety and governance 
• Meet legal and regulatory requirements 

We never use personal data for marketing without explicit consent. 

6. Who We Share Information With  

We only share information when necessary and appropriate:  

With consent  

• Schools and SENCOs  
• Private therapists  
• Other healthcare providers  

Without consent (only when required by law)  

• Safeguarding concerns  
• Risk of harm to the child or others  
• Court orders  
• Regulatory bodies (e.g., CQC)  

For clinical care  

• GP (e.g., medication updates, shared care requests)  
• Pharmacy services (for prescriptions)  

We do not sell or share data with third‑party marketers. 

7. How We Store and Protect Information 

We use secure, encrypted systems for all clinical and administrative data. 

Measures include: 

• Encrypted electronic health records 
• Password‑protected devices & systems 
• Access restricted to clinical and administrative staff 
• Regular data protection audits 
• Multi‑factor authentication 
• Secure Microsoft 365 environment 
• Staff training in GDPR and confidentiality 

Paper records (if used) are stored in locked cabinets in secure premises.

8. How Long We Keep Information 

We follow NHS and professional guidelines for children’s mental health records: 

• Minimum of 8 years after the child turns 18 

(or longer if clinically necessary) 

After this period, records are securely destroyed. 

9. Third party recipients of personal data  

We sometimes share personal data with third parties who provide services on our behalf. All third‑party processors operate under written contracts that ensure compliance with UK GDPR and strictly limit how they may use your data. They may only process information for the specific task they have been engaged to perform. 

Our current third-party data processors include: 

• Administrative contractors – self‑employed medical secretaries and administrative staff who support correspondence, scheduling, and clinical documentation. They access personal data only when necessary and operate under confidentiality and data‑processing agreements. 
• Ambient Voice Technology (AVT) / Heidi AI (Heidi Health Ltd) - provides ambient transcription and clinical documentation support. These services process personal and special category health data solely under our instructions and do not use information for any independent purpose. 
• Secure email, cloud storage, and IT service providers - used to host, store and protect our systems and communications. 

All third‑party processors are required to implement appropriate technical and organisational measures to keep your data secure and to support your GDPR rights. 

10.  Your Rights  

Under UK GDPR, you have the right to: 

• Access your personal information 
• Request correction of inaccurate data 
• Request deletion (where legally possible) 
• Restrict or object to processing 
• Request transfer of your data to another provider 
• Withdraw consent at any time  

You can read more about your rights at  For the public | ICO 

To exercise these rights, contact by email: office@adhdclinic.org.uk 

If you want to make a formal complaint about the way we have processed your personal information, you can contact the ICO which is the statutory body that oversees data protection law in the UK. For more information go to Make a complaint | ICO

11. Children’s Data 

We only collect information about children with the consent of a parent or person with parental responsibility. 

Young people aged 13+ may have rights to confidentiality if they are deemed Gillick competent. 

12. International Transfers 

We do not routinely transfer data outside the UK. 

If this becomes necessary (e.g., secure cloud services), we ensure full UK GDPR compliance. 

13. What happens in the event of a data breach?
‍To prevent unauthorised disclosure or access to your information, we have implemented strong physical and electronic security safeguards. In the unlikely event of a data protection breach the Data Protection lead, Dr Divik Seth (diyadvik limited) will notify the Information Commissioner’s Office (ICO) so that their procedures can be followed.

We will also notify all individuals whose data may have been accessed to alert them to the breach and any potential risks. 

COOKIES POLICY

This clinic’s website uses only essential cookies required for security, basic functionality, and reliable access to our online services. We do not use analytics, advertising, or preference cookies, and therefore no cookie‑consent banner is necessary. These essential cookies do not collect personal information beyond what is required for the website to operate. You may manage or delete cookies at any time through your browser settings.

If you complete a form on our website, the information you submit is temporarily stored by our web host before being securely transmitted to the clinic.