Effective Date: 1st September 2025

Headspace (“we”, “us”, or “our”) is committed to protecting and respecting your privacy. This Privacy Policy outlines how we collect, use, store, and protect your personal information when you use our ADHD prescribing services.

We are committed to complying with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and all other relevant healthcare and data protection laws.

• Name: Headspace
• Services: Prescribing treatment for ADHD
• Data Controller: Headspace 
• Contact: rhiannon@headspace-adhd.co.u

We collect and process the following types of personal data:

• Full name
• Date of birth
• Address
• Email address
• Telephone number
• NHS number (if applicable)

• Medical history
• ADHD assessments and reports
• Prescriptions and medication history
• Mental health information
• GP and other clinical correspondence

• IP address
• Browser type
• Device information
• Usage logs from our website or patient portal

• Billing address
• Payment method (via third-party processors – we do not store card details)

We use your personal information to:

• Provide clinical treatment.
• Prescribe and manage medications
• Share relevant data with your GP or other clinicians (with your consent)
• Comply with legal and regulatory obligations
• Improve our services and ensure patient safety
• Respond to enquiries or concerns
• Process payments and issue invoices
• Manage appointments and communications

We rely on the following legal bases:

• Consent – where you have given clear consent (e.g., for information sharing)
• Contract – to deliver our services to you
• Legal obligation – for regulatory or safeguarding reasons
• Vital interests – where your health or safety is at risk
• Legitimate interests – to improve our services or protect against misuse

For special category (health) data, we process this under Article 9(2)(h) of UK GDPR – healthcare provision by a registered health professional.

We may share your data with:

• Your GP (with your explicit consent unless there's a safeguarding concern)
• Our prescribing clinicians and healthcare professionals
• The NHS or HIW 

if required for inspection or compliance

• Pharmacies for prescription dispensing
• Technology providers who support our systems (bound by data processing agreements)
• Legal, regulatory, or safeguarding authorities if required

We do not sell your data to third parties.

We securely store your data in encrypted systems within the UK or approved countries under UK data protection law.

• Clinical records: retained for at least 8 years after the last treatment (or until age 25 for children), as required by NHS guidelines.
• Technical and usage data: retained for a shorter period (usually under 2 years) unless required for legal reasons.

Under UK data protection laws, you have the right to:

• Access your personal data
• Correct inaccurate or incomplete data
• Request erasure of your data (where applicable)
• Restrict or object to processing
• Request transfer of your data
• Withdraw consent at any time
• Lodge a complaint with the ICO (www.ico.org.uk)

To exercise your rights, email: rhiannon@headspace-adhd.co.uk

We implement robust technical and organisational measures to protect your data, including:

• Encrypted communication (HTTPS)
• Role-based access to clinical records
• Regular staff training in data protection
• Secure prescription and document storage systems

Our website may use cookies to enhance user experience, monitor usage, and support essential functionality. You will be prompted to accept or manage cookies when visiting the site.

See our [Cookie Policy] for more information.

We may update this Privacy Policy from time to time. Any significant changes will be communicated to you via email or through our website.

Last Updated: 1st September 2025

If you have any questions about this policy or how your data is handled, please contact:

Data Protection Officer
Email: rhiannon@headspace-adhd.co.uk
Post: Headspace, 7 Nevill St, Abergavenny, NP7 5AA