Privacy policy

Who is responsible for your information

Leeds GP Confederation is the data controller for this service. It decides why and how your personal information is used for your care.

StrideMed Group Limited provides and operates the questionnaire technology for Leeds GP Confederation as its data processor. StrideMed may only process your information on documented instructions from Leeds GP Confederation and under a written data-processing agreement.

Information we collect

We collect the answers you provide, including your name, date of birth, contact details, GP practice, appointment preferences, autism-related experiences, physical and mental health, support needs, daily living, safeguarding and risk information, and any relevant criminal-offence information provided in response to the questionnaire.

We calculate questionnaire scores from some of your answers and create a reference number and PDF report. We also record limited technical and delivery information, such as submission time, delivery status and security or audit events, to operate and protect the service.

Why we use your information

Leeds GP Confederation uses your information to review your questionnaire, understand your needs, contact you, support direct care and decide appropriate advice, adjustments, appointments or referral next steps.

Questionnaire scores support review but do not provide a diagnosis or make a decision about you on their own. A member of the service team reviews the information and uses clinical and professional judgement.

Your information is not used for advertising or marketing.

Our legal basis

For personal information used to provide this NHS service, Leeds GP Confederation relies on UK GDPR Article 6(1)(e): processing necessary to perform a task in the public interest or exercise official authority.

For health and other special-category information used for direct care, Leeds GP Confederation relies on UK GDPR Article 9(2)(h) and the Data Protection Act 2018, Schedule 1 Part 1 paragraph 2: provision or management of health or social care under an appropriate duty of confidentiality.

Where safeguarding information must be used to protect a child or an individual at risk, additional conditions may include UK GDPR Article 9(2)(g) and the Data Protection Act 2018, Schedule 1 Part 2 paragraph 18. In a genuine emergency, vital-interests conditions may apply.

Criminal-offence information is processed only where necessary for care, safeguarding or safety, under UK GDPR Article 10 and an applicable Data Protection Act 2018 Schedule 1 condition. Accepting the website terms is not consent to this processing and Leeds GP Confederation does not rely on consent as its routine legal basis for direct care.

Saving progress on your device

When secure saving is available, your answers, progress and reference are encrypted before they are saved in this browser. They are not saved as readable questionnaire text in browser storage. Your answers are also held in browser memory while you use the questionnaire.

The service creates a temporary key for your browser session. A secure, HttpOnly cookie holds the key and expiry information protected by server-side encryption; it does not contain your answers. The cookie cannot be read directly by website JavaScript, but the website can request the key while the session is valid to restore your progress.

An incomplete session lasts for up to 30 days from when its secure storage session starts. A failed-submission copy lasts for up to 7 days, and a submitted copy for up to 24 hours; either may expire sooner if the original session expires first.

When a session expires, the service will no longer use its key to restore your saved answers; the encrypted browser record is removed when the service detects expiry. You can clear saved data earlier. If you use a shared or public device, clear saved data when you finish.

If secure saving is unavailable, you can continue in the current page, but your progress may be lost if you leave or reload. A second tab in the same browser may ask you to close the first tab and reload before continuing.

What happens when you submit

Your answers are sent over an encrypted connection. The service creates the email and PDF report during submission and sends them only to the approved Leeds GP Confederation service mailbox. The questionnaire application does not keep a separate database copy of your answers or PDF after the submission request has completed.

When secure saving is available, your browser can keep an encrypted submitted copy for up to 24 hours so that you can view and download your report; it may expire sooner with the original session. The report is not emailed to you. Leeds manages its mailbox and patient-record copies under its own arrangements.

Who receives your information

The approved Leeds GP Confederation service team receives the report and limits access to people who need the information to provide or administer your care. The team adds the PDF to the appropriate patient record.

StrideMed and approved technology providers may process information only where needed to host, secure, support or deliver the service. They are subject to contractual confidentiality, security and data-protection requirements. Information is not sold.

How long information is kept

Encrypted browser drafts are kept for up to 30 days, failed submissions for up to 7 days, and successfully submitted browser copies for up to 24 hours. General operational logs are kept for up to 30 days and should contain limited technical information rather than questionnaire answers.

Leeds GP Confederation manages the report in the patient record and any temporary mailbox copy under its approved records-management policy and the NHS Records Management Code of Practice. Limited delivery-audit information may be retained for the period approved by Leeds GP Confederation for accountability, investigation and clinical safety.

When StrideMed no longer needs personal information to provide the service, it deletes or returns it in accordance with Leeds GP Confederation's documented instructions and the data-processing agreement.

How your information is protected

Information is protected using measures including encryption in transit, encrypted temporary browser storage, expiry controls, restricted access, audit records and contracts with processors and technology providers.

No online service can remove every risk. Please avoid using a shared device where possible, keep your device and browser secure, and clear saved data if somebody else may have access to the device.

Your rights and how to contact us

You may have rights to ask about, access or correct your information, and in some circumstances to restrict or object to its use. Some rights, including deletion, may be limited where information must be retained for direct care, safety or legal reasons.

To ask about this questionnaire, exercise your data-protection rights or raise a concern, contact the Leeds GP Confederation service at lmh-tr.adhdsupport@nhs.net or telephone 0113 221 3545. You can also view Leeds GP Confederation's published data-protection and information-governance policies at https://www.leedsgpconfederation.org.uk/about-us/policies/.

You also have the right to complain to the Information Commissioner's Office at https://ico.org.uk/make-a-complaint/.