App Privacy Policy

1. About this policy

This App Privacy Policy applies to the digital tools and patient-facing features provided by Hillcrest Neuro Clinic, including our online questionnaires, booking system, waiting list, and any future patient portal functionality. It supplements our main Privacy Policy, which governs all personal data we process.

2. Data we collect through our digital tools

When you use our online tools, we may collect:

• Contact details (name, email address, telephone number)
• Date of birth and demographic information
• Responses to clinical questionnaires (ASRS, Weiss, Wender Utah, AQ-10, and others)
• Information about your GP and referral source
• Device and browser information for security and performance purposes

3. Special category data

Our questionnaires collect health-related information, which is classified as special category data under UK GDPR. We process this data on the basis of Article 9(2)(h) — processing necessary for the purposes of preventive or occupational medicine, medical diagnosis, the provision of health or social care, or the management of health or social care systems. All clinical data is handled with the highest standards of confidentiality.

4. How we use your data

• To process your booking or waiting list registration
• To score and review your pre-assessment questionnaire responses
• To communicate with you about your appointment
• To maintain accurate clinical records
• To comply with our legal and regulatory obligations

5. Data storage and security

All data submitted through our digital tools is stored securely on encrypted servers within the United Kingdom. Access is restricted to authorised clinical and administrative staff only. We do not sell or share your data with third parties for marketing purposes.

6. Data retention

Clinical records are retained in accordance with NHS and regulatory guidance — typically a minimum of 8 years for adult records and until the patient's 25th birthday (or 8 years after last contact, whichever is longer) for records relating to children. Non-clinical enquiry data is retained for up to 3 years.

7. Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request erasure (subject to clinical and legal retention requirements)
• Object to or restrict processing in certain circumstances
• Data portability
• Lodge a complaint with the Information Commissioner's Office (ICO)

8. Contact us

For any questions about how we handle your data, or to exercise your rights, please contact our Data Protection lead at [email protected].