This privacy notice was last updated on 29 June 2026. If you have any questions please contact our Data Protection Officer by emailing team@neurotype.uk.
Neurotype is a UK-based company that works with healthcare providers to streamline and enhance neurodiversity assessment workflows. Our tools help clinicians reduce administrative workload, improve documentation quality, and support more efficient and person-centred assessments.
We think data protection is important. Your rights do not exist because of your nationality, the colour of your skin, your language, or your culture; instead, your rights derive simply from your humanity.
This privacy notice explains what personal data we use, how we use it, and why. We have tried to keep this as plain English as possible, though we will use some legal terms from time to time.
How data protection law applies to Neurotype depends on the context in which we are processing personal data. We operate in two legally distinct capacities, and it is important to understand which applies to you.
When healthcare providers, whether NHS organisations or private clinics, use our platform to support neurodiversity assessment workflows, we act as a data processor on their behalf. In this role, we process patient data only on the instructions of the healthcare provider, who is the data controller.
Because the healthcare provider is the controller, they are responsible for telling you how your personal data is used and for upholding your data protection rights. If you are a patient or service user whose data has been processed through our platform, please refer to the privacy notice of your healthcare provider for full details of:
If you are unsure who your healthcare provider is or how to contact them, please get in touch with us at team@neurotype.uk and we will help direct your query.
There are several situations in which Neurotype acts as a data controller in its own right, that is, where we determine the purpose and means of processing personal data and are directly responsible for it:
The sections below set out how we process personal data in each of these controller contexts.
If you are a Neurotype employee or contractor, please refer to our internal privacy notice, which sets out in full how we collect and use your personal data, the lawful basis for doing so, your rights, and how long we retain your information.
You can request a copy of the internal privacy notice from team@neurotype.uk.
This section applies if you have applied for a role at Neurotype, or if we have identified you as a potential candidate and made contact with you.
This data will have come directly from you, or from a third party such as a recruitment agency or LinkedIn. If we sourced your data from a third party, we will let you know within 30 days of doing so.
If your application is unsuccessful, we will retain your data for six months from the end of the recruitment process, in case the situation should change. If you consent to us keeping your details in our talent pool for future opportunities, we will retain your data for up to two years from our last contact with you. If you are successful, your data will be covered by our internal employee privacy notice going forward.
We share information with data processors (our suppliers who provide services to us), such as our applicant tracking and collaboration tools. We do not sell your data.
This section applies to the personal data of individuals working on behalf of our client organisations, for example, clinicians, administrators, or managers employed by or contracting with a healthcare provider that uses our platform.
Organisations are required to have a 'lawful basis' for processing personal data. We have provided the legal reference in case you want to explore it further.
We retain your contact data for six years after the termination of our contract with your organisation.
We do not sell your data to anybody, and we do not share it with any third party for their own purposes. Like most companies, we use a number of other companies (our processors) as part of our data processing, for example, cloud and technology services such as Google and Slack. Using a processor is not the same as sharing your data: these providers act only on our instructions and on our behalf, and we remain the controller of your data. We have Data Processing Agreements in place with these providers. Where data is transferred outside the UK or EEA, we ensure that appropriate protection and mechanisms are in place, for example, Standard Contractual Clauses or the UK International Data Transfer Agreement (IDTA).
If you have taken part in a Neurotype research study, you will have been provided with a Participant Information Sheet and privacy notice at the start of the study. Those documents set out in full how your personal data is used, the lawful basis for processing, your rights, and how long we retain your information.
If you would like a copy of the privacy information provided to you, or if you have any questions about how your data is being used, please contact us at team@neurotype.uk and we will be happy to help.
This section applies if you visit our website.
When you visit our website, we may collect information about your usage, including your IP address and browsing activity on the site. This data is collected via cookies and similar technologies. Essential cookies are used to enable the site to function properly. We only use non-essential cookies and trackers with your consent, based on your choices when presented with our cookie banner.
If you submit a contact form or book a demo via our website, please refer to the Clients section of this notice for how that data is handled.
For essential cookies, our lawful basis is legitimate interest (UK GDPR Article 6(1)(f)), for enabling website functionality. For non-essential cookies and trackers, our lawful basis is your consent (UK GDPR Article 6(1)(a)).
Cookie and website usage data is retained for up to 14 months.
Under data protection law, individuals have a number of rights which are set out below. Some of these only apply in specific circumstances and are qualified in several respects by exemptions in data protection law. We will advise you in our response to your request if we are relying on any such exemptions. All requests should be directed to team@neurotype.uk.
You have the right to request a copy of the personal data that we hold about you. Your request will be dealt with as soon as possible and within one month.
You can ask us to correct any personal data we hold about you that is inaccurate or incomplete.
Where we have relied on your consent to process your personal data, you have the right to withdraw that consent at any time.
You can ask us to erase your personal data in certain circumstances, for example, if you believe we no longer need to retain it. This is not an absolute right; where we are not able to honour your request, we will explain why.
Where you have provided personal data to us with your consent or where it was necessary for us to provide you with a service, you can ask us to provide it in a portable electronic format, or to transfer it directly to another organisation where technically feasible.
You have the right in certain circumstances to request that we suspend processing of your personal data. Where we do so, we may still store your data but will not carry out further processing without your consent, subject to certain exemptions.
You have the right to object to our use of your personal data where we rely on legitimate interests. We may continue to process your data despite your objection where there are compelling legitimate grounds or where it is needed in connection with legal claims.
We do not currently utilise automated decision making.
You have the right to lodge a complaint directly with us as controller under section 164A of the Data Protection Act 2018. If you have a concern about how we have handled your personal data, please contact our Data Protection Officer at team@neurotype.uk. We will acknowledge your complaint within 30 days of receipt and respond without undue delay. If you are not satisfied with our response, you have the right to escalate your complaint to the ICO.
If you remain dissatisfied after raising your complaint with us, you have the right to escalate it to the Information Commissioner's Office (ICO), the UK's data protection regulator. The ICO will generally expect you to have given us the opportunity to resolve your complaint first.
Information Commissioner's OfficeWe may change this Privacy Notice from time to time, for example, if the law changes or we begin processing personal data in a new way. We recommend that you check this page regularly to keep up to date.
If we make any material changes to the way we process and use your personal data, we will contact you to let you know.
We may, from time to time, expand or reduce our business, and this may involve the sale and/or transfer of control of all or part of our business. Any personal data that you have provided will, where it is relevant to any part of our business being transferred, be transferred along with that part. The new owner or newly controlling party will, depending on the lawful basis, be permitted to use that data only for the same purposes for which it was originally collected by us.
In the event that any of your data is to be transferred in such a manner, you will be contacted in advance and informed of the changes.