​

Last updated: 31 August 2026

​

1. Who we are

Staff Partners Mental Health Ltd, trading as Everywhere Health, provides autism spectrum disorder, also referred to as ASD or autism, and attention deficit hyperactivity disorder, also referred to as ADHD, assessment services.

We provide services to:

• NHS organisations;

• private patients and families;

• employers and occupational health clients;

• educational organisations;

• healthcare providers;

• insurers;

• solicitors and courts; and

• other organisations that commission or refer people to our services.

For the purposes of data protection law, the organisation responsible for deciding how and why your personal information is used is:

​

Staff Partners Mental Health Ltd, trading as Everywhere Health
Widbury Barns
Widbury Hill
Ware
SG12 7QE

​

Telephone: 01992 245580
Data protection email: privacy@everywherehealth.co.uk

​

Data Protection Officer: Kevin Thomas

​

Depending on the service and the contractual arrangements, Everywhere Health may act as a data controller, a joint controller with another organisation, or a processor acting on the instructions of an NHS or other commissioning organisation. Where another organisation is also responsible for your information, its privacy notice may also apply.

​

2. Purpose of this privacy notice

This privacy notice explains:

• what personal information we collect;

• where we obtain it;

• how and why we use it;

• the legal basis on which we use it;

• who we may share it with;

• the systems and suppliers we use;

• how long we retain it;

• how we protect it; and

• your rights in relation to it.

This notice applies to patients and service users, parents and carers, relatives, informants, people making enquiries, website visitors and other individuals whose personal information is processed in connection with our services.

Separate or supplementary privacy information may be provided for a particular service, NHS contract, assessment pathway, consultation recording or other processing activity.

​

3. The laws and professional requirements we follow

We process personal information in accordance with applicable legal and professional requirements, including:

• the UK General Data Protection Regulation;

• the Data Protection Act 2018;

• the common-law duty of confidentiality;

• the Human Rights Act 1998;

• the Caldicott Principles;

• NHS information-governance requirements;

• the NHS Records Management Code of Practice;

• safeguarding legislation and requirements;

• applicable professional codes and clinical standards; and

• guidance issued by the Information Commissioner’s Office.

 

4. The information we collect

The information we collect depends on the service being provided and may include the following.

4.1 Identification and contact information

This may include:

• your name;

• date of birth;

• address and postcode;

• telephone number;

• email address;

• NHS number;

• hospital or other patient identifier;

• GP and healthcare-provider details;

• emergency contact details;

• preferred contact arrangements; and

• communication or accessibility requirements.

4.2 Health and clinical information

This may include:

• physical and mental health information;

• developmental and medical history;

• presenting symptoms and concerns;

• previous assessments, diagnoses and treatment;

• medication information;

• disability and support needs;

• family and social history;

• education and employment information relevant to the assessment;

• information about behaviour, communication and daily functioning;

• information supplied during consultations;

• clinical observations, notes and professional opinions;

• assessment results and diagnostic conclusions;

• care, support and treatment recommendations;

• safeguarding information; and

• information contained in correspondence, referrals and reports.

Health information is special-category personal data and is subject to additional legal protection.

4.3 Questionnaires and assessment information

We may collect information through:

• referral forms;

• screening questionnaires;

• clinical assessment tools;

• patient-completed questionnaires;

• questionnaires completed by parents, carers, relatives, teachers, employers or other informants;

• structured interviews;

• supporting documents;

• school or employment reports;

• previous clinical reports; and

• information provided by other professionals.

People providing information about another individual should only provide information that is relevant and that they are authorised or reasonably expected to provide.

4.4 Appointment and communication information

This may include:

• appointment dates and times;

• appointment confirmations and reminders;

• attendance, cancellation and rescheduling information;

• portal messages;

• email and telephone correspondence;

• communication preferences;

• delivery and message status information; and

• administrative notes relating to the assessment pathway.

4.5 Consultation recordings and transcripts

Where consultation recording or transcription is used, we may process:

• audio recordings;

• information spoken during the consultation;

• automated or manually prepared transcripts;

• corrections made to a transcript;

• the identity of consultation participants; and

• information derived from the consultation for inclusion in the clinical record or assessment report.

You will be informed if a consultation is to be recorded or transcribed. Where recording or transcription is not appropriate or is declined, we will explain whether an alternative method of clinical documentation is available.

A recording or transcript may contain health information and other highly sensitive personal information. Access is restricted to authorised people who require it for the assessment, documentation, quality, safety or administration of the service.

4.6 Equality and demographic information

Where relevant and lawful, we may collect information about:

• sex;

• gender identity;

• race or ethnicity;

• religion or belief;

• language;

• disability;

• reasonable adjustments; and

• other demographic information relevant to accessibility, equality monitoring, clinical care or contractual reporting.

We will only use this information where it is necessary and where an appropriate legal basis applies.

4.7 Information about criminal convictions or offences

We may process information relating to criminal convictions or offences where this is relevant and lawful, for example for safeguarding, risk assessment, legal proceedings or the delivery of a commissioned service.

4.8 Website, enquiry and recruitment information

When you use our website or contact us, we may collect:

• your IP address;

• browser and device information;

• pages viewed and website usage information;

• information submitted through an enquiry form;

• correspondence and messages; and

• information submitted in connection with employment or contractor opportunities.

Further information about cookies should be provided in our cookie notice or website cookie controls.

​

5. Where we obtain information

We may obtain personal information from:

• you directly;

• a parent, carer, guardian, relative or other person supporting you;

• an NHS commissioning or referring organisation;

• your GP;

• another healthcare or social-care professional;

• a school, college, university or other educational organisation;

• an employer or occupational health provider;

• an insurer;

• a solicitor or court;

• a local authority or public body;

• previous assessment or healthcare records;

• questionnaires completed by an informant;

• our clinical and administrative staff;

• our patient-record and assessment systems; and

• other organisations involved in providing or funding your assessment.

Where information is obtained from someone other than you, we will provide relevant privacy information within the period required by data protection law, unless an applicable exemption applies.

​

6. Why we use your information

We may use personal information to:

• receive and validate referrals;

• establish your identity and contact details;

• determine whether a service is suitable;

• arrange and administer appointments;

• provide portal access;

• issue and receive questionnaires;

• obtain relevant information from informants and professionals;

• conduct ASD and ADHD assessments;

• maintain an accurate clinical record;

• record or transcribe consultations where applicable;

• prepare, review and approve assessment reports;

• communicate assessment findings and recommendations;

• send reports to authorised recipients;

• communicate with GPs, referrers, NHS organisations and other relevant professionals;

• provide reasonable adjustments and accessible services;

• respond to enquiries, complaints and requests;

• protect patients and others from harm;

• identify and respond to safeguarding concerns;

• monitor service quality and clinical safety;

• investigate incidents and concerns;

• manage information-security risks;

• comply with NHS contracts and reporting requirements;

• maintain financial and business records;

• establish, exercise or defend legal claims;

• comply with legal, regulatory and professional obligations; and

• improve our services.

We will not use your information for a purpose that is incompatible with the purpose for which it was collected unless this is permitted by law and appropriate privacy information has been provided.

​

7. Our legal bases for using personal information

Data protection law requires us to identify a lawful basis under Article 6 of the UK GDPR when we process personal information.

Depending on the service and circumstances, our lawful basis may include:

7.1 Performance of a contract

We may need to use information to provide a service requested by you or to administer a contract with you.

7.2 Legal obligation

We may need to process information to comply with legal, regulatory, safeguarding, employment, taxation, accounting or professional obligations.

7.3 Public task

Where we provide NHS-commissioned services, processing may be necessary for the performance of a task carried out in the public interest or under official authority.

7.4 Legitimate interests

We may process information where necessary for our legitimate interests or those of another organisation, provided that these interests are not overridden by your rights and interests.

Legitimate interests may include:

• administering and improving our services;

• maintaining information and system security;

• preventing fraud or misuse;

• responding to enquiries;

• establishing or defending legal claims; and

• managing our business appropriately.

We will not rely on legitimate interests where another legal basis is more appropriate or where your rights and interests override those interests.

7.5 Consent

We may rely on your consent for specific optional activities where consent is the appropriate legal basis.

Where consent is used, you may withdraw it at any time by contacting us. Withdrawal will not affect processing that took place before consent was withdrawn.

Withdrawal of consent does not necessarily require us to delete information where another lawful basis or legal, clinical, contractual or professional requirement permits or requires us to retain it.

7.6 Vital interests

In exceptional circumstances, we may process information where this is necessary to protect your life or the life of another person.

​

8. Our legal bases for using health information

Health information and certain other sensitive information are special-category data under Article 9 of the UK GDPR.

Depending on the circumstances, we may rely on one or more of the following conditions:

• processing necessary for medical diagnosis, the provision of health or social care, or the management of health or social-care systems and services;

• processing necessary for reasons of substantial public interest, including safeguarding and protecting individuals at risk;

• processing necessary for establishing, exercising or defending legal claims;

• processing necessary to protect vital interests where the individual is physically or legally incapable of giving consent;

• processing based on explicit consent where this is the appropriate condition; or

• processing necessary for reasons of public interest in the area of public health, where applicable.

We will also apply the conditions and safeguards required by the Data Protection Act 2018.

​

9. Consent and the common-law duty of confidentiality

Consent under data protection law is not the legal basis for every use of health information.

We may process information for the provision of healthcare, medical diagnosis or an NHS-commissioned service using another lawful basis. However, we must also respect the common-law duty of confidentiality.

Confidential information may be used or shared where:

• you have provided consent or there is a reasonable basis to understand that the information will be used in that way for your direct care;

• the disclosure is required or permitted by law;

• there is an overriding public interest;

• it is necessary to protect someone from serious harm; or

• another recognised confidentiality basis applies.

Where we specifically ask for consent, we will explain what you are being asked to agree to and how you can withdraw that consent.

​

10. How we use Cerebric and other technology

Everywhere Health uses secure digital systems to manage aspects of its ASD and ADHD assessment services.

Cerebric may be used for functions including:

• creating and maintaining patient records;

• presenting and collecting questionnaires;

• managing assessment information;

• appointment administration;

• patient and service communications;

• consultation recording and transcription where enabled;

• storing clinical and administrative information;

• preparing draft assessment content;

• supporting review and quality-assurance processes; and

• maintaining audit information.

Other approved systems may be used for secure communications, identity and access management, document handling, business administration, security monitoring and service continuity.

Access to patient information is restricted according to role and business need.

​

11. AI-assisted preparation of assessment reports

Technology may be used to assist clinicians in preparing a draft ASD or ADHD assessment report from information collected during the assessment.

This may include information from:

• referrals;

• questionnaires;

• clinical notes;

• consultations;

• transcripts;

• supporting evidence; and

• other relevant information within the patient record.

AI-assisted content is used as a drafting aid. It does not make the diagnosis, determine the clinical outcome, or replace professional judgement.

A suitably qualified clinician remains responsible for:

• reviewing the relevant source information;

• assessing the patient;

• reaching the diagnostic or clinical conclusion;

• reviewing and correcting draft content;

• ensuring that the report is accurate and appropriate; and

• approving the final report before it is issued.

We do not make solely automated clinical decisions that produce legal or similarly significant effects without appropriate human involvement.

If you have questions or concerns about the use of AI-assisted drafting in your assessment, please contact us using the details in this notice.

​

12. Children and young people

We may provide services to children and young people as well as adults.

Where a child or young person receives a service, we will consider:

• their age and understanding;

• their capacity or competence to make relevant decisions;

• parental responsibility;

• their confidentiality rights;

• the involvement of parents, carers and guardians;

• safeguarding requirements;

• the need for accessible and age-appropriate information; and

• the lawful and appropriate basis for sharing information.

A parent or carer does not automatically have unrestricted access to all information about a child or young person. Decisions about access and sharing will take account of the circumstances, the child or young person’s rights, capacity, best interests, safeguarding considerations and applicable law.

We may provide a child-friendly or simplified version of this notice where appropriate.

​

13. Who may access your information

Access is limited to people who require the information for an authorised purpose. This may include:

• clinicians involved in your assessment;

• clinical reviewers and supervisors;

• administrative staff supporting the service;

• safeguarding personnel;

• information-governance, clinical-safety and quality staff;

• authorised IT and system administrators;

• approved contractors; and

• approved suppliers providing systems or support.

Staff and contractors are subject to confidentiality and data-protection requirements and must complete appropriate training.

​

14. Who we may share information with

Where necessary, lawful and consistent with confidentiality requirements, we may share information with:

• the NHS organisation commissioning or referring you to the service;

• your GP;

• other healthcare or social-care professionals;

• a parent, carer, guardian or representative where appropriate;

• schools, colleges, universities or educational professionals where appropriate;

• employers, occupational health providers or insurers where applicable;

• solicitors, courts or other legal representatives;

• safeguarding organisations;

• regulators and professional bodies;

• law-enforcement agencies or public authorities where legally required;

• clinical-system, hosting, transcription, communications and IT-support suppliers;

• professional advisers, including legal and insurance advisers; and

• another provider involved in continuing your care.

We only share information that is necessary for the relevant purpose.

Before sending sensitive information, we take reasonable steps to confirm the recipient and use an approved secure method.

We do not sell patient information.

​

15. Suppliers and data processors

We use specialist suppliers to provide systems and services that support our operations. These may include:

• clinical and patient-record platforms;

• secure hosting and data-storage services;

• questionnaire and patient-portal services;

• transcription and report-drafting technology;

• video consultation and communication services;

• IT support;

• information-security services;

• backup and business-continuity services;

• payment providers; and

• professional advisers.

Where a supplier processes personal information on our behalf, it must do so under a written contract containing appropriate data-protection and security requirements.

We assess relevant suppliers before use and periodically thereafter. This may include reviewing security certification, data-protection documentation, processing locations, sub-processors, incident arrangements, business continuity, deletion arrangements and other assurance evidence.

​

16. NHS National Data Opt-Out

The NHS National Data Opt-Out allows people to opt out of their confidential patient information being used for certain research and planning purposes.

The National Data Opt-Out does not generally prevent information being used for your individual care or where another exception applies.

You can find information about the National Data Opt-Out through https://www.nhs.uk/your-nhs-data-matters/ or by telephoning 0300 303 5678.

Where the National Data Opt-Out applies to processing undertaken by Everywhere Health, we will apply it in accordance with NHS requirements.

​

17. International processing

Our intended position is that identifiable patient information is stored and processed within the UK, except where an approved and lawfully safeguarded arrangement applies.

If personal information is transferred to, accessed from, or processed in a country outside the UK, we will ensure that an appropriate legal safeguard is in place. This may include:

• a UK adequacy regulation;

• the UK International Data Transfer Agreement;

• the UK Addendum to the EU Standard Contractual Clauses; or

• another lawful transfer mechanism.

We will also complete any risk assessment required for the transfer and provide further information where necessary.

You may contact us for further information about applicable international-transfer safeguards.

​

18. How we protect information

We use organisational and technical controls designed to protect personal information against unauthorised access, loss, alteration, disclosure or destruction.

These controls may include:

• unique user accounts;

• multi-factor authentication;

• role-based and least-privilege access;

• managed devices;

• device encryption;

• malware protection;

• security updates and patching;

• screen locking;

• secure communications;

• audit logging;

• backup and recovery arrangements;

• access reviews;

• joiner, mover and leaver controls;

• supplier assurance;

• incident-management procedures;

• staff confidentiality requirements; and

• annual data-protection and information-security training.

No method of electronic storage or transmission is entirely free from risk. We therefore keep our controls under review and respond to identified risks and incidents.

​

19. How long we retain information

We retain information only for as long as it is needed for the purpose for which it was collected and to meet legal, contractual, regulatory, clinical and professional requirements.

Retention periods depend on:

• the type of record;

• whether the service relates to an adult or child;

• the type of assessment or care provided;

• NHS contractual requirements;

• clinical and professional record-keeping requirements;

• safeguarding considerations;

• limitation periods for legal claims;

• any ongoing complaint, incident or investigation; and

• applicable records-management guidance.

Our retention schedule covers records including:

• referrals;

• questionnaires;

• clinical records;

• assessment evidence;

• final reports;

• correspondence;

• appointment information;

• consultation recordings;

• transcripts;

• draft reports and working material;

• portal messages;

• audit logs;

• safeguarding information;

• complaints;

• incidents; and

• financial and contractual records.

Consultation recordings, transcripts and AI-generated drafts will not necessarily be retained for the same period as the final clinical record. Their retention will be limited to the period needed for the documented clinical, quality, safety or legal purpose, in accordance with our approved retention schedule and the applicable commissioning arrangements.

You may contact us for information about the retention period applicable to a particular record.

​

20. Accuracy of information

We take reasonable steps to ensure that personal information is accurate, complete and up to date.

Please tell us if your contact details or other relevant information change.

Clinical opinions, observations and diagnostic conclusions are professional records. A request for rectification does not necessarily require a professional opinion to be changed, but you may ask for factually inaccurate information to be corrected or for a statement of disagreement to be added where appropriate.

​

21. Your data-protection rights

Depending on the circumstances and the legal basis for processing, you may have the right to:

• be informed about how your information is used;

• request access to your personal information;

• request correction of inaccurate or incomplete information;

• request deletion of information;

• request restriction of processing;

• object to processing;

• receive certain information in a portable format;

• withdraw consent where processing is based on consent;

• object to direct marketing;

• request human review of a solely automated decision; and

• complain to the Information Commissioner’s Office.

These rights are not absolute. A request may be limited or refused where an exemption applies or where information must be retained for legal, clinical, safeguarding, contractual or professional reasons.

We will explain our decision if we cannot comply fully with a request.

To exercise your rights, contact:

Email: privacy@everywherehealth.co.uk
Post: Data Protection Officer, Everywhere Health, Widbury Barns, Widbury Hill, Ware, SG12 7QE

We may need to verify your identity before responding.

​

22. Requests on behalf of another person

A parent, carer, representative, solicitor or other person may make a request on someone else’s behalf.

Before disclosing information, we may require evidence of:

• the individual’s authority or consent;

• parental responsibility;

• legal authority;

• capacity;

• identity; and

• why the disclosure is appropriate.

We will also consider the confidentiality and rights of any other person whose information appears in the record.

​

23. Safeguarding and serious risk

We may use or disclose information without consent where this is necessary and lawful to:

• protect a child or adult at risk;

• respond to a serious and imminent risk of harm;

• meet a safeguarding obligation;

• comply with a court order or statutory requirement;

• prevent or detect serious crime; or

• protect the vital interests of an individual.

Where appropriate, we will record the reason for the disclosure, the information shared and the recipient.

​

24. Data breaches and incidents

If a personal information or cyber-security incident occurs, we will:

• take steps to contain and investigate it;

• assess the risk to affected individuals;

• record our decision and actions;

• notify the relevant NHS organisation, supplier, regulator or other body where required;

• notify the Information Commissioner’s Office where legally required; and

• inform affected individuals without undue delay where the incident is likely to result in a high risk to their rights and freedoms.

 

25. Complaints

If you have a concern about how we use your information, please contact us first so that we can investigate it.

Email: privacy@everywherehealth.co.uk
Telephone: 01992 245580
Post: Data Protection Officer, Everywhere Health, Widbury Barns, Widbury Hill, Ware, SG12 7QE

You also have the right to complain to the Information Commissioner’s Office:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Further information is available from the https://ico.org.uk/make-a-complaint/data-protection-complaints/data-protection-complaints/.

​

26. Changes to this notice

We review this privacy notice regularly and when there is a material change to:

• our services;

• the purposes for which information is used;

• the categories of information collected;

• our systems or suppliers;

• the use of recording, transcription or AI;

• processing locations;

• retention arrangements;

• legal or regulatory requirements; or

• controller and processor responsibilities.

The latest version will be published on our website.

Where a change would materially affect how existing patient information is used, we will take reasonable steps to bring the change to the attention of affected individuals before the new processing begins.

​

27. Contact us

If you have questions about this notice or how your information is used, please contact:

Data Protection Officer: Kevin Thomas
Email: privacy@everywherehealth.co.uk
Telephone: 01992 245580
Post: Everywhere Health, Widbury Barns, Widbury Hill, Ware, SG12 7QE