Privacy Notice

Pernovia Health provides private, remote adult ADHD assessment and diagnostic services to eligible adults aged 18 and over in England and Northern Ireland.

This notice explains how we collect, use, share and protect personal information in connection with our website, enquiries, bookings, assessment services and the administration of our funded post-assessment coaching pathway.

Distinct Mind And Co Ltd, trading as Pernovia Health, acts as the controller for personal data where we determine the purposes and means of processing. In some circumstances other organisations involved in delivering parts of the service may act as controllers in their own right for their own purposes.

• Distinct Mind And Co Ltd
• Company number 17427527
• Registered office: 2 Park Street, Ashford, England, TN24 8LG
• Registered in England and Wales.

If you have a question about privacy or wish to make a data protection request, please contact us at privacy@pernoviahealth.com or using the contact details provided in your booking confirmation.

Depending on how you interact with us, we may collect the following categories of information:

• identity and contact information, such as your name, date of birth, email address, telephone number and location details relevant to eligibility;
• booking, payment and administrative information, including appointment details, correspondence about your booking and payment confirmations;
• health and clinical information relevant to an ADHD assessment;
• developmental, educational and occupational history;
• current and previous medications;
• mental health and physical health history;
• information about substance use where clinically relevant;
• psychometric and questionnaire responses;
• consultation notes, clinical formulation and assessment reports;
• supporting documents you choose to provide, such as previous reports or school records;
• technical and website information, such as device and browsing data, where applicable;
• communications between you and us; and
• limited post-assessment coaching administration information, such as your chosen partner, funded-session eligibility and booking or attendance status; and
• informant or collateral information provided by a person you nominate.

We aim to collect only the information that is necessary for the purpose concerned.

We may collect information:

• directly from you, through enquiries, booking, questionnaires and consultations;
• from an informant you nominate to provide collateral information;
• from documents you supply to support the assessment;
• through Zanda, our core clinical and practice-management environment used for registration, bookings, intake and questionnaires, clinical records, appointments, assessment administration and reports; and
• from an independent coaching partner where necessary to administer or verify your two funded sessions; and
• from healthcare professionals or services, only where this is lawful, appropriate and relevant to your assessment.

Some information is necessary to assess your eligibility, arrange your booking and carry out a clinically reliable ADHD assessment.

If required information is not provided, we may be unable to accept your booking, proceed with the assessment, or reach a diagnostic conclusion.

Other information is provided voluntarily and is only requested where it is clinically relevant. Where information is optional, we will make that clear at the point of collection wherever reasonably practicable.

We rely on different lawful bases under Article 6 UK GDPR depending on the purpose of the processing. No single lawful basis applies to everything we do.

Where we rely on legitimate interests, we consider whether our interests are outweighed by your interests, rights and freedoms.

Health information is special category data under UK GDPR and receives additional protection.

Where processing is necessary for assessment, medical diagnosis and the provision and management of healthcare services, we rely on Article 9(2)(h) UK GDPR, together with the condition in Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018 (health or social care purposes).

This processing is carried out by, or under the responsibility of, healthcare professionals who are subject to duties of confidentiality and professional secrecy.

In specific circumstances a different Article 9 condition may apply, for example where processing is necessary to protect vital interests, or in connection with the establishment, exercise or defence of legal claims. The applicable condition depends on the purpose and the circumstances.

We do not rely on explicit consent as the general condition for core clinical assessment processing. Where we do rely on consent for a particular activity, we will make that clear and you may withdraw it at any time.

Our public website is deliberately designed to minimise the collection and storage of sensitive clinical information.

Clinical questionnaires, patient records, consultation documentation and assessment reports are handled within Zanda, our core clinical and practice-management environment, rather than unnecessarily duplicated into the public website.

Where the website collects information, this is generally limited to enquiry, booking and administrative details needed to arrange your care.

Our website includes a general enquiry form. Where you use it, we collect the first name, email address, enquiry category and message you choose to provide, and we use that information to respond to your enquiry. Please avoid including medical records, questionnaire answers or other detailed health information in the general enquiry form; if you are already a patient, please use the contact details provided to you to discuss your care.

We use carefully selected organisations to help us deliver and support the service. Our current or selected systems include:

• Zanda, for registration, bookings, intake and questionnaires, clinical records, appointments, assessment administration and reports;
• Stripe, for payment processing;
• Google Workspace, for business email and collaboration;
• Lovable, for our public website and application infrastructure;
• Resend, for website-generated email delivery where configured;
• Cookiebot, provided by Usercentrics, for cookie consent management;
• Google Analytics 4, for website analytics where appropriate consent has been given; and
• Brevo, where a person separately opts in to our optional post-screener email information sequence, as explained below. Brevo receives information for this purpose only where the person has opted in.

We may also share information with insurers and indemnity providers, accountants, lawyers and other professional advisers, and regulators or authorities where disclosure is required or permitted by law.

Not every provider acts as a processor on our behalf. Depending on the service and its legal role, a provider may act as our processor, as an independent controller, or as a separate controller for its own purposes. Where a provider acts as a controller in its own right, its own privacy information will apply to that processing.

Completing the free ADHD screener does not require consent to receive marketing emails. After completing the screener, you may separately and voluntarily choose to receive a short series of helpful emails about adult ADHD assessment, Pernovia Health services and practical next steps.

This opt-in is an unticked affirmative choice and is separate from the screener and our assessment service. Choosing not to opt in, or later withdrawing consent, does not affect your use of the screener, your ability to make a booking, your assessment, or access to any other care or service.

Where you opt in, we may use Brevo to operate the sequence. Information sent to Brevo is limited to your first name, email address, consent status and evidence (including the timestamp, source and wording version where applicable), unsubscribe or suppression status, and ordinary email delivery and engagement information.

We do not intentionally send your screener answers, ASRS responses, screener score or outcome, symptoms, diagnosis, medication information or clinical record to Brevo.

The sequence consists of exactly three emails sent over approximately 10 days and then ends automatically. You will not be automatically subscribed to an ongoing newsletter or indefinite marketing programme. Any future newsletter would require a separate appropriate opt-in.

Every email provides a way to unsubscribe. You may withdraw consent at any time, and no further marketing emails will be sent after your withdrawal is applied. We may retain minimal suppression information so that we can continue to honour your choice not to receive marketing.

Our lawful basis for this optional sequence is consent under Article 6(1)(a) UK GDPR. We also observe the requirements of the Privacy and Electronic Communications Regulations for electronic marketing where applicable.

According to Brevo's current published information, its database infrastructure is hosted within the European Union. Some ancillary or subprocessor activity may involve processing elsewhere, so the international-transfer safeguards described in this notice continue to apply.

The completed assessment report is provided to you.

You may choose to share the report with your GP or another healthcare professional if you wish.

Pernovia Health does not routinely obtain GP details or send reports to GPs as part of the standard pathway.

If disclosure is ever required for safeguarding, legal or urgent safety reasons, information may be shared without your consent where this is lawful and necessary.

After completing the Pernovia Health assessment pathway, you may choose to use two complimentary post-assessment coaching sessions. This support is optional and available regardless of whether your assessment results in an ADHD diagnosis. Where options are available, you choose your preferred independent coaching partner after reviewing their profile.

Our current independent coaching partners include Ruth Bidmead. Our coaching partners are independent contractors and coaching providers, not employees or clinicians of Pernovia Health. They do not provide ADHD assessment, diagnosis, prescribing, medication advice, clinical monitoring or other clinical care on behalf of Pernovia Health.

You book directly into the chosen coach's availability using their dedicated booking route. Once you do so, that coach is responsible for their own booking system, coaching records, privacy arrangements, confidentiality, safeguarding and data protection. Pernovia Health and each coach act independently as controllers for the personal data they process for their respective services, and the coach's own privacy information applies to their processing.

To administer or verify access to the funded coaching pathway, Pernovia Health and the chosen coach may process or share the minimum information reasonably necessary, such as your name, contact details, chosen coach, eligibility for the two funded sessions, booking or attendance status, and limited administrative correspondence. We do not routinely share your diagnostic outcome, assessment report, questionnaire responses or clinical record for this purpose. We use the lawful basis appropriate to the particular processing, including contract or legitimate interests for pathway administration and consent where required for a particular disclosure.

You may choose to share your Pernovia Health assessment or report directly with your coach. This is your choice; Pernovia Health does not routinely send diagnostic reports or clinical information to coaching partners.

If a safeguarding concern arises during coaching, the independent coach follows their own safeguarding and professional procedures and may share relevant information with appropriate professionals or services where lawful and necessary. Pernovia Health may be contacted where appropriate, but Pernovia Health is not an emergency or crisis service.

After the two Pernovia-funded sessions, you may choose to continue privately with your coach. Any continuing relationship, payment and related data processing are directly between you and the independent coach and sit outside the Pernovia Health assessment service. Brevo is not used for the coaching pathway.

Where clinically appropriate, information may be collected from an informant you nominate, such as a partner, relative or close friend who knows you well.

Where we collect information directly from an informant, we will provide them with appropriate privacy information about how their information will be used.

Informant responses form part of the clinical evidence considered during the assessment. They do not determine the outcome on their own.

Informants are asked to provide only information that is relevant to the assessment and to avoid including unnecessary information about other people.

Recording or transcription technology may be used to support accurate clinical documentation.

You will be informed before any such technology is used in your appointment, and where consent is required it will be obtained.

Where audio is technically created, it may be processed transiently by the provider. Retention of any audio or transcript can depend on the provider and the configuration in use. We aim not to retain audio for longer than is necessary to produce and check the clinical documentation.

Where reasonably practicable, transcription is optional. You may tell your clinician before or at the start of the appointment that you would prefer transcription not to be used, and the clinician will use an appropriate alternative method of note-taking where this can be accommodated safely.

Some of our service providers may process personal data in the UK, the European Economic Area or other countries.

Where personal data is transferred outside the UK to a country that is not covered by UK adequacy regulations, we use appropriate safeguards where required. These may include the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful transfer mechanism, together with any supplementary measures we consider necessary.

The providers we use and the locations in which they process data are reviewed as part of our vendor governance arrangements.

We keep personal information only for as long as is reasonably necessary for the purpose for which it was collected.

When deciding retention periods we take account of:

• the clinical purpose of the record and its continued usefulness to your care;
• professional and regulatory obligations applying to our clinicians;
• indemnity and insurance requirements;
• legal limitation periods for potential claims;
• safeguarding requirements; and
• contractual, tax and accounting obligations.

Different categories of information may be kept for different periods. We maintain an internal retention schedule rather than applying a single blanket period to everything.

Contact and consent information for the optional post-screener email sequence is retained only as necessary to operate the finite sequence and maintain associated compliance records. Following unsubscribe or withdrawal, we may retain minimal suppression information so that we can prevent further marketing.

Limited coaching-pathway administration records are retained only for as long as reasonably necessary to administer or verify the two funded sessions and meet applicable contractual, safeguarding, accounting or legal requirements. Each independent coach sets and explains the retention arrangements for their own coaching records.

Retention settings within clinical systems, and provider backup cycles, may operate in accordance with the provider's documented retention and deletion processes.

Our retention arrangements are reviewed periodically.

We take appropriate technical and organisational measures to protect personal information, including:

• access controls and role-based access, so that staff see only what they need;
• use of established clinical systems designed for healthcare data;
• encryption in transit, and at rest where appropriate;
• confidentiality obligations for clinicians and staff;
• multi-factor authentication where supported;
• due diligence on service providers;
• data minimisation; and
• procedures for identifying, managing and reporting information security incidents.

No system can be guaranteed to be completely secure, and we do not claim otherwise. We work to reduce risk and to respond promptly if something goes wrong.

Ordinary email is not a fully secure method of communication and may be intercepted or misdirected.

Please avoid sending unnecessary sensitive information by ordinary email where a secure clinical portal or other secure method is available to you.

If sensitive information does need to be sent by email, please send only what is necessary and follow any secure instructions we provide.

Strictly necessary technologies, such as those required for the website to function and to remain secure, may operate without consent where this is permitted.

Non-essential analytics, advertising pixels, embedded tracking and similar technologies will only be activated after appropriate consent has been given, where consent is required.

We do not intentionally send names, email addresses, screener responses, screener scores or outcomes, or clinical information to Google Analytics 4.

Our Cookie Policy will explain the technologies in use and the choices available to you.

Subject to certain conditions, you have the right to:

• access the personal information we hold about you;
• have inaccurate personal information corrected;
• request erasure of personal information in certain circumstances;
• request restriction of processing in certain circumstances;
• object to processing carried out on the basis of legitimate interests;
• receive certain information in a portable format, where applicable; and
• withdraw consent where processing actually relies on consent.

These rights are not absolute. They may be limited by exemptions under data protection law, or by clinical, professional and legal record-keeping obligations. Where we cannot fully meet a request, we will explain why.

You can ask for a copy of the personal information we hold about you. A request can be made verbally or in writing.

We may need to verify your identity before we can respond, and we may ask you to clarify the information you are seeking.

We will respond without undue delay and usually within one month of receiving a valid request. Where a request is complex, or where several requests have been made, the period may be extended by up to two further months as permitted by law. If that happens, we will tell you within one month and explain why.

Some information may be withheld or redacted where an exemption applies, including where disclosure would reveal information about another person who has not consented, or where an exemption relevant to health records or the rights of others applies.

Requests are normally free of charge, unless a lawful exception applies, such as where a request is manifestly unfounded or excessive.

A designated privacy contact within Pernovia Health is responsible for handling privacy enquiries and data protection requests.

You can reach them by email at privacy@pernoviahealth.com or using the contact details provided in your booking confirmation.

If we later become legally required to appoint a Data Protection Officer, this notice will be updated with the relevant details.

If you have a concern about how we have handled your personal information, please contact us first so that we can try to put it right.

You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection:

• Information Commissioner's Office (ICO)
• Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
• Telephone: 0303 123 1113
• Website: ico.org.uk

Contacting us first does not affect your right to complain to the ICO at any time.

We may update this notice as our services, systems, service providers or processing activities change.

Material changes to providers, processing locations, purposes, categories of information, retention arrangements or safeguards may result in this notice being updated and a new date being displayed at the top of the page.

We encourage you to review this notice from time to time.