Privacy Policy

Data Controller

The data controller responsible for your personal data is:

Noodle
30 Churchill Place
London
England
E14 5RE

Email: informationrights@noodlehealth.com

Data Controller: Noodle
Data Protection Officer (DPO): Mason Fitzgerald, Chief Governance Officer

What Information We Collect

We only collect the minimum data necessary to provide safe and effective ADHD and Autistic Spectrum Condition (ASC) care.

We may receive some information from trusted external sources such as your GP, referrers, pharmacies, or NHS systems including Summary Care Records (where enabled). This helps ensure we have accurate and up to date information when providing your care.

We do not collect or store payment card details. Payments are processed securely by Stripe, an external payment provider. We only retain transaction records necessary for accounting and refunds. 

Telephone Call Recording

We record telephone calls made to and from Noodle as part of the delivery of our services.

Call recordings may be used for a number of purposes including: 

• quality assurance and staff training; 

• patient safety and safeguarding; 

• investigating complaints, incidents and concerns; 

• service monitoring and improvement; 

• verifying information provided during calls; and 

• protecting the interests of patients, staff and the organisation.

Call recording is a standard feature of our telephone system and recordings cannot normally be disabled for individual calls.

We take appropriate technical and organisational measures to protect recorded information. Access to recordings is restricted to authorised personnel who require access for legitimate business, clinical, governance or legal purposes. 

Telephone call recordings are retained in accordance with our Records Retention Schedule and are securely deleted when no longer required. 

How We Use Your Data

We use your personal data for the following purposes:

• Healthcare Services: To provide you with healthcare services, including diagnosis, treatment, and follow-up care. We record and transcribe clinical assessments (audio and/or video), as part of your medical record. These recordings are used to support accurate documentation, patient safety, and quality of care 

  
  

• Appointment Management: To manage your appointments and consultations. 

• Communication: To communicate with you regarding your healthcare, send appointment reminders, and handle administrative matters. 

• Service Quality: To ensure the safety and quality of our healthcare services. 

• Research and Analysis: To conduct research and analysis aimed at improving our services and contributing to scientific knowledge in the field of ADHD and ASC, with your consent. 

• Service Monitoring and Audit: To review and improve the quality, safety, and effectiveness of our services. Any analysis is carried out using the minimum data necessary and does not identify patients unless required for clinical or legal purposes. 

Where and How We Store Your Data

Your data is stored securely in NHS-compliant systems, with encryption, access controls, and usage restrictions in place. 

We use the following systems to store and manage your information: 

Recordings of clinical assessments are stored securely within our approved systems and form part of your medical record. 

Our commitment to security: 

We take every reasonable step to ensure patient data is not stored on personal devices. Staff use centrally managed, encrypted laptops with controlled access. 

We avoid sending sensitive information by email wherever possible. If email is necessary, we use secure methods and minimise the data shared. 

We apply strict role-based access controls (RBAC) so that only authorised team members can access the information they need to perform their duties. 

AI Notetakers and Ambient Voice Scribes

Heidi Healthcare is a speech technology and generative AI tool that can convert spoken words into structured medical notes and letters. 

Where these tools process personal data, such processing is carried out under the relevant lawful bases set out in Section 2 (Article 6 UK GDPR). Where health data (special category data) is processed, we rely on the condition in Article 9(2)(h) UK GDPR. For limited supporting purposes (e.g. IT security and auditing), we may also rely on Article 6(1)(f) UK GDPR (Legitimate Interests). All processing is subject to data minimisation, strict access controls, and appropriate safeguards ensuring compliance with data protection principles. 

We use AI note‑taking tools to help clinicians reduce administrative workload so they can focus more on your care. These tools support note writing only and do not assess, diagnose, guide treatment, or make any decisions about your care. They are not used for automated decision making or profiling. Your clinician reviews, checks, and finalises all notes before anything is added to your medical record, and all clinical decisions are always made by qualified healthcare professionals. 

Clinical assessments are recorded using Microsoft Teams. These recordings and transcripts may then be used to support AI-assisted transcription tools (such as Heidi) to produce clinical notes.

Sharing Your Data / Legal Basis for Processing

We may share your personal data with the following recipients: 

Where recordings form part of your medical record, they may be shared with relevant healthcare professionals involved in your care where necessary. 

All third‑party IT providers enter into a Data Processing Agreement (DPA) with Noodle. This agreement requires them to handle personal data safely, act only on our instructions, and maintain security measures that meet UK GDPR and other applicable legal requirements. We carry out due diligence checks to ensure that any organisation processing data on our behalf is trustworthy, operates to recognised compliance standards, and provides appropriate safeguards to keep your information secure. 

We do not sell your data or share it with advertisers. 

International Support Services

Noodle is supported by authorised members of the CARE ND India Global Capability Centre (GCC), who provide administrative and operational support services to the organisation. 

Where authorised CARE ND India staff process personal information on behalf of Noodle, they do so under the direction of Noodle and in accordance with Noodle's policies, contractual requirements and applicable UK data protection legislation. 

Access to personal information is limited to authorised individuals with a legitimate business need and is protected through appropriate technical and organisational safeguards, including secure remote access, role-based access controls, audit logging and ongoing governance oversight. 

Noodle remains the Data Controller for UK patient information and retains overall responsibility for ensuring that personal information is processed lawfully, fairly, securely and transparently.

Data Retention

We follow NHS data retention policies, ensuring that data is only kept for as long as necessary. 

Your Rights

You have the following rights regarding your personal data: 

• Right to Access: You can request access to your personal data and information about how it is processed. Audio or video recordings that form part of your medical record may be included when you exercise your right of access. 

• Right to Rectification: You can request corrections to any inaccurate or incomplete data. 

• Right to Erasure: You can request the deletion of your personal data under certain circumstances. In some circumstances, we may not be able to delete clinical records where retention is required for legal or healthcare purposes. 

• Right to Restrict Processing: You can request restrictions on the processing of your data in certain situations. 

• Right to Data Portability: You can request a copy of your data in a commonly used, machine-readable format. 

• Right to Object: You can object to the processing of your data based on legitimate interests or for direct marketing purposes. 

If you object to data processing based on our legitimate interests, we will review your request and consider whether we can stop or limit the processing. Some types of processing are essential for providing safe healthcare, so we may not always be able to agree to a request; however, we will always explain our decision and discuss available options with you. 

• Right to Withdraw Consent: If we process your data based on consent, you can withdraw your consent at any time. 

Use of recording in clinical assessments

We record clinical assessments conducted via video consultation as a standard part of how we deliver our services. Recording supports accurate clinical documentation, patient safety, and the overall quality of care. These recordings form part of your medical record and are used to assist clinicians in producing reliable notes and transcripts. Recording is a standard part of how we provide assessments and, as a result, assessments are not offered without recording. Recordings are not used to make automated decisions about your care; all clinical decisions are made by qualified healthcare professionals. Access to recordings is strictly limited to authorised staff on a need-to-know basis and is controlled in line with our confidentiality and data protection obligations.

How to Contact Us

If you have any questions, concerns, or requests regarding your personal data or this policy — including data subject access requests (DSARs) or any other information access requests — please contact our Data Protection Officer at:

Email: informationrights@noodlehealth.com

For our adults service, call: 020 4642 7098
For our U18s service, call: 020 4642 7103

Changes to This Policy 

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Any updates will be published on our website and communicated to you as appropriate.

Confidentiality Policy 

Introduction

At Noodle, we are committed to maintaining the confidentiality of all personal and sensitive information entrusted to us by our patients, staff, and stakeholders. This Confidentiality Policy outlines our commitment to safeguarding the privacy of individuals' information in accordance with legal and ethical standards

Policy Statement

Noodle aims to: 

• Respect Privacy: Respect the privacy and confidentiality of all individuals associated with our clinic, including patients, staff, volunteers, and stakeholders. 

• Secure Handling: Ensure that all personal and sensitive information is handled securely and disclosed only on a need-to-know basis for legitimate purposes. 

• Legal Compliance: Comply with relevant data protection legislation and professional standards governing the handling of confidential information.

Confidential Information

Definition

Confidential information includes, but is not limited to: 

• Personal details (e.g., name, address, contact information) 

• Medical records and health information 

• Financial information 

• Staff records and employment details 

• Any other information deemed sensitive or confidential 

Handling

All confidential information must be stored, transmitted, and accessed securely to prevent unauthorised disclosure or access. 

Access to Confidential Information

Authorised Access

Access to confidential information is restricted to individuals who require it for legitimate purposes, such as providing healthcare services, conducting administrative tasks, or fulfilling legal requirements. 

Confidentiality Agreements

All staff, volunteers, and third-party contractors with access to confidential information must sign confidentiality agreements acknowledging their responsibilities and obligations. 

Disclosure of Information

Disclosure Purpose

Confidential information may be disclosed only for purposes consistent with the individual's consent or as required by law, regulatory authorities, or professional standards. 

Patient Consent

Patient consent must be obtained before disclosing any confidential information, except where disclosure is necessary to protect the individual's or others' health and safety. 

Medication Information Sharing 

If you are initiated on medication treatment, Noodle will share relevant information with other healthcare professionals, such as your GP, in accordance with the General Medical Council (GMC) guidelines on safe prescribing of medication. 

Objections to Sharing

If a patient objects to the sharing of personal information, we will not disclose it unless justified in the public interest or if it benefits a patient who lacks capacity. Patients will be informed of the potential consequences of such a decision. 

Data Security and Protection

Security Measures

Noodle employs appropriate technical and organisational measures to ensure the security and protection of confidential information against unauthorised access, loss, or disclosure. 

Data Breach Response

In the event of a data breach or unauthorised disclosure, Noodle will promptly investigate, mitigate any potential harm, and notify affected individuals and regulatory authorities as required by law.

Training and Awareness

Staff Training

All staff, volunteers, and contractors receive training on confidentiality policies and procedures during induction and ongoing professional development. 

Awareness Campaigns

Noodle conducts regular campaigns to reinforce the importance of confidentiality and privacy. 

Policy Review

This Confidentiality Policy will be reviewed regularly to ensure compliance with relevant legislation, professional standards, and best practices. Updates or revisions will be communicated to all staff and stakeholders. 

Patient Portal

How We Use Information

Our Patient Portal allows us to securely collect and manage information so we can provide safe and effective care. It also enables secure communication between the young person, their authorised representatives, and our clinical team. When a young person has the capacity to make their own decisions, we will seek their explicit consent before creating or granting access to their portal account. If capacity is unclear or not established, we will obtain consent from a parent or legal guardian who has the appropriate authority to act on the young person's behalf. 

Compulsory Sharing of Outcomes with GPs

To maintain clinical safety and ensure appropriate oversight, it is now a requirement of our service that assessment outcomes and relevant updates are shared with the young person's GP. This ensures that their primary healthcare provider is aware of our involvement and can support coordinated care. This requirement applies to all individuals accessing or continuing to access our services. 

Where recordings form part of the clinical record, they may be accessible as part of your information, subject to system capabilities and applicable safeguards. 

Lawful Basis for Processing

We process personal information through the CYP Portal under the UK GDPR. Our primary lawful basis is Article 6(1)(e), which allows processing necessary for tasks carried out in the public interest, specifically the provision of health and social care. For special category data such as health information, we rely on Article 9(2)(h), which permits processing necessary for the assessment, diagnosis, and delivery of health or social care. 

In limited circumstances, such as the creation of a portal account or communication via a representative, we may rely on explicit consent. Where consent is used, it may be withdrawn at any time, although doing so may affect access to the portal or elements of the service. 

International Transfers

Some of our digital systems may process or store information outside the UK, for example, if a secure cloud provider hosts its servers in another country. When this happens, we ensure that your data remains fully protected. 

Any international transfers are carried out in compliance with UK GDPR, using legally approved safeguards. These safeguards require the provider to keep your information secure, use it only for our purposes, and protect it to the same standard as if it were processed in the UK. 

We only work with trusted suppliers who meet strict privacy, security, and contractual requirements.

Keeping You Informed

If we introduce new uses of personal data or make changes that affect how your information is processed, we will update this notice and inform relevant service users so that our processing remains transparent, fair, and compliant. 

These Privacy and Confidentiality Policies are designed to protect your rights and ensure the highest standards of privacy and confidentiality at Noodle. If you have any questions, please do not hesitate to contact us.

Contacting Us

Contact forms on our website are provided by Noodle, which is responsible for the personal information you submit (the "controller" under UK GDPR). 

Some forms ask for health or other sensitive information. Each form has its own privacy notice that explains what we collect, why, our legal basis, who we share it with, and how long we keep it. Please read it before you submit. 

Only share what a form asks for, and avoid adding detailed medical information in free-text boxes unless the form requests it. Where a form relies on your consent, you'll be asked for it separately on that form, and you can withdraw it at any time. 

Your information is stored and processed in the UK. 

You have rights to access, correct, erase or restrict your data, to object, and to complain to the ICO. Contact us at informationrights@noodlehealth.com