Privacy policy

The short version

What you type or say into the finder is processed in your own browser and never reaches us. The only information we hold is what you deliberately hand over — a name and email if you join the community list, or contact preferences if a practice invites you. Everything below is the detail of those two sentences.

The finder, and what you type into it

The whole finder runs in your browser. The words you type about what you are looking for are matched against the clinicians' declared information on your own device: they are not sent to ADHD.ME, not stored anywhere, and are gone when you close the tab. You can use every part of the finder without telling us who you are.

If you type a suburb, that word is looked up on your device too — the site never asks your browser for your location. If you use the microphone, your browser's own speech service (Apple's or Google's, depending on your browser) converts the audio to text, which may happen on that vendor's servers overseas; ADHD.ME never records or receives the audio, and the same in-browser rule applies to the text that comes back.

Some people use the finder for a child or teenager in their care. The same rule covers that completely: nothing typed about a child leaves the browser either. The community interest form is for adults.

What we collect today — the complete list

For the community interest list: the name, email address and interest options a person chooses, with their consent. We use these details only to contact them about community sessions and early product testing, and for nothing else. The form does not ask for clinical records or a description of symptoms.

If a practice invites you to book through a personal link, the contact choices you set on that page — whether we may text you and during which hours — are kept, so they can be honoured. That is the whole of it: no accounts, no profiles, and nothing collected from the finder itself.

When practices connect — not yet in force

ADHD.ME is building software that will offer available appointment times to a practice's existing patients, on the practice's instructions. When that runs, the practice will remain the custodian of its patient records, and ADHD.ME will process only contact details, appointment history and consent flags supplied by the practice's systems — to determine eligibility for invitations, to send them, and to measure whether they led to attended appointments. It will not process clinical notes, diagnoses or test results, and will never use patient information for advertising. None of this happens today: no practice is connected and no real patient data is processed.

Access, correction and deletion

If you are on the community interest list, email us and we will show you what we hold, correct it, or delete it — you do not need to be anyone's patient to ask. The same goes for contact preferences set through a booking link.

When practice data flows exist, patients will additionally be able to ask through their practice. Deletion removes identifiable records and leaves a hashed deletion record as proof, and a suppression entry ensures a deleted patient is never contacted again, even after a later data refresh.

Retention

Community interest details are kept while the program is being developed or until the person asks for them to be removed, whichever comes first. Practice-supplied records, when they exist, will be retained per practice-configured windows and pruned automatically when they age out. Opt-out and deletion records are kept — they are the evidence that a request was honoured.

Who is responsible for your care

Your practice provides your care. ADHD.ME is software your practice uses to offer you appointment times. It does not provide treatment, does not give clinical advice, and is not part of your care team. Anything about your health goes to your practice, not to us.

Automated decision-making

Two things are automated. The finder orders clinicians using nothing but the words of your current request and what each clinician has declared — no history, no profile of you. And when appointment invitations run, automation will decide which patients are offered available times. Our automated-decisions statement describes what is automated, what never is, and the human controls in force.

How information is held

The service runs on Vercel's hosting platform, and information it holds may be stored on infrastructure in the United States. Access is limited to the owners, transport is encrypted, and no production credentials live in the codebase — the product's own build gates enforce that.

If something goes wrong

If we suspect information we hold has been lost or accessed without authority, we will assess it promptly, tell the people affected what happened and what we are doing about it, and notify the Office of the Australian Information Commissioner where the Notifiable Data Breaches scheme requires it.

Cookies and local storage

The site sets no advertising cookies. One value is kept in your browser's own storage: a record that you have seen and agreed to this policy, which never leaves your device.

The hosting platform (Vercel) counts page visits without cookies: visits are grouped by a short-lived hash that is discarded within 24 hours, and no profile of you is built or kept. When you follow a booking link to Healthengine, we count that the link was used — not who used it — and from the moment their page opens, Healthengine's own privacy policy governs what you enter there.

Complaints

If you think we have mishandled your information, contact us first and we will respond within two business days. If you are not satisfied with the outcome, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

Contact and changes

Questions about this policy go to stefan.thottunkal@gmail.com. If the policy changes, the date and the change will be stated here — while it is marked draft, it is not yet in force and no real patient data is processed.