Lighthouse Pathways is a specialist private provider of ADHD assessments. We are committed to protecting your privacy and safeguarding your personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the NHS Records Management Code of Practice 2021, and recognised healthcare information governance standards.
This Privacy Statement explains how we collect, use, store and share your personal information when you use our services or visit lighthousepathways.co.uk.
1. Who We Are
Lighthouse Pathways is a trading name of Your Medical Services, registered in England and Wales, Company No: 08311685, with its registered office at:
4th Floor, 69 Wilson St, London EC2A 2BB
Lighthouse Pathways is the data controller for the personal information we hold about you. This means we decide how and why your personal data is processed.
We are registered with the Information Commissioner's Office (ICO) as a data controller (Registration Number: ZA189221).
Data Protection Officer
Email: dpo@yourworld.com
If you have any questions about this Privacy Statement or how we handle your personal data, please contact our Data Protection Officer.
2. The Information We Collect
To provide safe clinical care and manage enquiries, we collect the following information:
Identity and Contact Information
- Full name
- Date of birth
- Address
- Telephone number
- Email address
- GP details
- NHS number (where applicable)
Health Information (Special Category Data)
- Medical history
- ADHD screening results
- Symptoms and diagnoses
- Clinical notes and consultation records
- Treatment plans and correspondence
Health data is classified as special category data under Article 9 UK GDPR and is subject to enhanced legal protection.
Children's Data
Where services are provided to children, we collect personal data from parents or legal guardians and process this information in accordance with safeguarding legislation and UK GDPR requirements. Where required, we rely on parental consent for children under 16.
Consultation Transcription Data (Heidi Health AI)
With your explicit consent, we may use Heidi Health AI to assist clinicians in drafting consultation notes.
- Audio is processed securely for transcription purposes only.
- Lighthouse Pathways does not permit the use of your consultation data for AI model training.
- Audio files are automatically deleted shortly after transcription.
- All generated notes are reviewed, edited and clinically verified by your clinician before being added to your medical record.
Marketing and Technical Information
When you visit our website, we may collect:
- IP address
- Device and browser type
- Website interaction data
- Cookie preferences
This data may be collected through tools such as:
- HubSpot (CRM and form management)
- Google Ads (conversion tracking and remarketing where consent is provided)
- Meta Pixel (advertising performance measurement)
- Google Analytics (website usage analytics)
- Hotjar (heatmaps and session recording to improve user experience)
We never share clinical diagnoses, assessment outcomes or medical notes with advertising platforms.
3. How We Collect Information
We collect information:
- Directly from you via online forms, assessment bookings, consultations, calls or emails
- Through HubSpot when you submit an enquiry
- From referrals made by healthcare professionals
- From other clinicians involved in your care
- Through website cookies and tracking technologies where consent is provided
4. Use of Marketing, CRM and Advertising Tools
To ensure individuals seeking ADHD support can find our services, we use the following systems:
HubSpot
We use HubSpot as a secure customer relationship management system to manage enquiries, appointment bookings and patient communications. Data submitted through website forms is stored securely and accessed only by authorised staff.
Google Ads
We use Google Ads to show our services to individuals searching for ADHD assessments. Conversion tracking and remarketing tools may be used where consent has been provided.
Meta Pixel
We use Meta Pixel to measure the effectiveness of advertising on platforms such as Facebook and Instagram and to improve campaign relevance.
These tools may collect limited technical information such as IP address and page visits. They do not receive access to clinical records or diagnostic information.
Hotjar
We use Hotjar to better understand our users' needs and to optimise our website experience (for example, which pages are visited and which links are clicked). Hotjar uses cookies to collect pseudonymised data on user behaviour and devices. We have configured Hotjar to automatically suppress any sensitive text entered into forms to ensure personal health information is never recorded.
You can manage your cookie preferences at any time via our cookie consent banner.
5. Lawful Basis for Processing
Under UK GDPR, we rely on:
Article 6
- Performance of a contract (providing requested services)
- Legal obligation as a healthcare provider
- Legitimate interests in operating and improving our services
Article 9 (Health Data)
- Article 9(2)(h): Provision of healthcare and treatment
- Article 9(2)(a): Explicit consent where required (including AI transcription)
Where processing is based on consent, you may withdraw consent at any time.
6. How We Use Your Information
We use personal data to:
- Provide ADHD assessments and clinical care
- Maintain accurate medical records
- Co-ordinate care with your GP or other professionals
- Manage bookings and billing
- Improve service quality and governance
- Comply with regulatory, safeguarding and legal obligations
- Protect patients or others from serious harm where required
- Measure and improve website and advertising performance
7. Data Sharing
We only share personal data when necessary, lawful and proportionate.
This may include:
- Your GP (with consent)
- Other healthcare professionals involved in your care
- Secure clinical system providers such as Semble
- HubSpot (enquiry management)
- Heidi Health (transcription processing)
- Payment providers
- Regulatory bodies or safeguarding authorities where required by law
- Courts or law enforcement where legally compelled
All service providers are contractually bound to comply with UK GDPR and maintain appropriate security standards.
8. Data Retention
Medical Records
Medical records are retained in accordance with the NHS Records Management Code of Practice 2021 and relevant professional body guidance.
Marketing Data
HubSpot records and marketing data are reviewed periodically and deleted when no longer necessary for legitimate business purposes.
AI Transcription
Audio recordings are deleted shortly after processing. Transcriptions are retained as part of your clinical record.
9. Data Security
We implement appropriate technical and organisational security measures to protect personal data, including:
- Encrypted clinical systems
- Secure cloud hosting
- Role-based access controls
- Multi-factor authentication
- Regular security reviews
- Staff confidentiality training
10. International Transfers
Where personal data is transferred outside the UK or EEA, appropriate safeguards such as UK-approved Standard Contractual Clauses are implemented.
11. Your Rights
You have the right to:
- Access your personal data (Subject Access Request)
- Request correction of inaccurate information
- Request erasure in limited circumstances
- Restrict processing
- Object to certain processing activities
- Withdraw consent where applicable
We will respond to Subject Access Requests within one calendar month, as required by UK GDPR.
If you are unhappy with how we handle your data, please contact us in the first instance so we can resolve your concern.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk
12. Cookies
We use:
- Essential cookies for website functionality
- Analytics cookies (Google Analytics and Hotjar) to understand usage patterns
- Marketing cookies for advertising performance measurement
You can manage or withdraw consent at any time using our cookie banner.
13. Changes to This Statement
We review this Privacy Statement regularly. The most current version will always be available on our website.
Lighthouse Pathways treats your personal health information with the same care and confidentiality as any NHS provider and is committed to maintaining the highest standards of clinical governance, transparency and responsible data handling in every aspect of our service.
