1. About this privacy notice

The Autism Centre Limited provides autism assessment and related clinical services, including services commissioned by NHS organisations.

This privacy notice explains how we collect, use, store and share personal information when you are referred to, access or receive services from The Autism Centre, including through our Patient Portal.

We process personal information in accordance with UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

The Autism Centre Limited is the data controller for the personal information covered by this notice where it determines the purposes and means of processing.

Our Data Protection Officer can be contacted at matt@autismcentre.co.uk. General enquiries can be sent to hello@autismcentre.co.uk.

2. What information we collect

Depending on the service you receive, we may collect and process information including:

• your name, date of birth, address, postcode and contact details;
• your NHS number;
• information contained in referrals and correspondence from your GP, NHS organisation or other healthcare professional;
• developmental, medical and relevant mental-health history;
• information supplied by parents, carers, family members or other informants involved in an assessment;
• assessment responses, clinician observations and clinician-entered scores;
• appointment and scheduling information;
• correspondence between you and The Autism Centre;
• audio or video recordings of assessment sessions where you have agreed to recording;
• transcripts produced from recorded assessment sessions;
• clinical assessment reports, outcome letters and associated clinical records; and
• information required to administer and audit the delivery of our services.

Because we provide healthcare services, much of the information we process is special category health data, which receives additional protection under data protection law.

3. Where we obtain your information

We may obtain personal information:

• directly from you;
• from a parent, carer or other person involved in your assessment;
• from your GP or another healthcare professional;
• from an NHS commissioning or referring organisation;
• from referral documents and relevant existing clinical records;
• from questionnaires or forms completed as part of your assessment; and
• during appointments and clinical assessment sessions.

Where information is provided by someone other than you, we only use it where there is an appropriate lawful basis and where it is relevant to the delivery of your assessment or our legal and clinical responsibilities.

4. Why we use your information

We use personal information to:

• receive and manage referrals;
• confirm eligibility and route NHS referrals to the appropriate commissioning organisation where required;
• arrange and manage appointments;
• communicate with you about your assessment;
• conduct autism assessments;
• enable clinicians to record assessment evidence, observations and scores;
• prepare clinical reports and outcome correspondence;
• provide appropriate follow-up after assessment;
• maintain an appropriate clinical record;
• respond to complaints, concerns and requests;
• meet safeguarding, clinical governance and patient-safety responsibilities;
• meet NHS commissioning, audit and reporting requirements; and
• protect the security and integrity of our systems and services.

5. Our lawful basis for using your information

We must have a lawful basis for processing personal information.

Depending on the circumstances, we process personal information where it is necessary for the performance of our contractual arrangements for providing services and where processing is necessary to comply with legal and regulatory obligations applying to us.

Because autism assessment involves health information, we also process special category data where this is necessary for medical diagnosis and the provision and management of health care by, or under the responsibility of, health professionals.

5.1 Recording assessment sessions

Recording an assessment session is treated separately.

Where an assessment session is recorded, we will ask for your explicit consent before recording begins. You can decline recording without withdrawing from the assessment itself.

Where processing is based on your consent, you can withdraw that consent. Withdrawal does not affect the lawfulness of processing which took place before consent was withdrawn.

6. How we use technology during assessments

The Patient Portal supports clinicians in recording and managing assessment information.

For the ADI-R assessment, the system may perform an arithmetic calculation using scores entered by the clinician and the published scoring method. The resulting score is provided to the clinician as reference information.

The system does not make an autism diagnosis. Diagnostic interpretation and decisions are made by appropriately qualified clinicians using the available assessment evidence and their professional judgement.

The Autism Centre does not use solely automated decision-making to make diagnostic decisions about patients.

Technology may also be used to assist with transcription and preparation of clinical documentation. Any resulting clinical documentation remains subject to professional review and responsibility before it forms part of the clinical record or is issued as an assessment outcome.

7. Who we share information with

Where necessary and lawful, information may be shared with organisations or professionals involved in your care or the commissioning of your assessment. These may include:

• your GP;
• the NHS organisation responsible for referring or commissioning your assessment;
• other healthcare professionals involved in your care where appropriate;
• organisations with which we have a legal obligation to share information; and
• organisations acting as processors on our behalf to provide secure technology and infrastructure.

We use carefully selected technology providers to support delivery of the service, including providers of secure UK hosting, clinical video communication, telephony, secure cloud storage, and organisational communication and cloud services.

Relevant suppliers are subject to appropriate contractual and data-protection arrangements and are reviewed as part of our information-governance processes.

We may also disclose information where required by law or where this is necessary to protect an individual from serious harm, including where safeguarding obligations apply.

8. Where your information is stored and processed

Core Patient Portal clinical records are hosted in the United Kingdom.

Retained assessment recordings and transcripts are stored in secure cloud infrastructure located in the United Kingdom.

Some suppliers supporting the service may process limited personal information or service and usage information outside the United Kingdom.

For example, Whereby is used to provide clinical video communication. Whereby states that account information is hosted in Ireland and that usage information may be hosted in Ireland and the United States.

Where personal information is transferred internationally, appropriate safeguards are required under applicable data protection law. We maintain contractual arrangements with relevant processors and assess international transfers as part of our supplier due-diligence and data-protection processes.

Further information about the safeguards applying to international transfers can be requested from our Data Protection Officer.

9. How we protect your information

We use technical and organisational measures designed to protect the confidentiality, integrity and availability of personal information. These include:

• encrypted connections to the Patient Portal;
• encryption of stored clinical information where appropriate;
• individual user accounts;
• role-based and least-privilege access controls;
• multi-factor authentication for privileged and clinician access;
• security and audit logging;
• vulnerability management and security testing;
• controlled backups and recovery arrangements;
• information-governance training; and
• contractual security requirements for organisations processing information on our behalf.

Access to clinical information is restricted according to role and the user's legitimate need to access the relevant information.

10. How long we keep your information

We retain personal information only for as long as it is required for the purpose for which it was collected and to meet relevant clinical, contractual and legal requirements.

• Adult clinical records: 7 years.
• Children and young people's clinical records: until age 25.
• Assessment session recordings: 12 months from the date the case is formally closed.
• Assessment session transcripts: 12 months from the date the case is formally closed.
• Appointment scheduling information: 12 months following discharge.
• Enquiries that do not proceed to assessment: 12 months.

Where information is contained within backups, secure deletion occurs in accordance with the applicable backup and retention cycle.

11. Your data-protection rights

Depending on the circumstances and the lawful basis on which information is processed, you may have rights including:

• the right to be informed about how your information is used;
• the right to access personal information we hold about you;
• the right to ask us to correct inaccurate or incomplete information;
• the right to request erasure of information in certain circumstances;
• the right to request restriction of processing in certain circumstances;
• the right to object to certain types of processing;
• the right to data portability where applicable; and
• rights relating to automated decision-making.

These rights are not absolute. For example, we may need to retain clinical information where there is a legal, regulatory or clinical requirement to do so.

If you wish to exercise any of your rights, contact our Data Protection Officer at matt@autismcentre.co.uk. We will normally respond to a valid request within one month.

12. Your right to object

You have the right to object to certain processing of your personal information.

Whether this right applies depends upon the lawful basis and circumstances of the processing. If you wish to object to our use of your information, please contact our Data Protection Officer. We will consider your request in accordance with data protection law and explain the outcome to you.

13. Children and young people

Our services include assessments for children and young people.

We recognise that information about children requires particular care. We process children's information only where necessary for the provision of the assessment and associated clinical, safeguarding, legal and administrative requirements.

Where consent is the appropriate basis for a particular activity, such as recording an assessment session, the appropriate consent arrangements will be applied taking account of the child's age, capacity and the responsibilities of their parent or legal guardian.

Information about children and young people is subject to the same security and confidentiality controls as other clinical information.

14. Complaints about how we use your information

If you have concerns about how we have used your personal information, please contact our Data Protection Officer in the first instance at matt@autismcentre.co.uk.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data-protection regulator.

15. Changes to this privacy notice

We keep this privacy notice under review.

It will be reviewed at least annually and sooner where there is a significant change to our services, technology, suppliers, data processing or applicable legal requirements.

Where a change materially affects how we use personal information, we will take appropriate steps to bring the change to the attention of affected individuals before the new processing begins.

 

The Autism Centre Limited
Company number: 15630919
 ICO registration: ZB823296
 Data Protection Officer: Matthew Wombell
 Email: matt@autismcentre.co.uk