Last updated: 14th December 2023
This Privacy Policy covers the use of your personal information by King’s College London, a university incorporated by Royal Charter, of Strand, London WC2R 2LS, United Kingdom (“KCL”), in connection with the use of PACES+, a tool designed for use by adult caregivers and healthcare professionals to help support children with Attention Deficit Hyperactivity Disorder (ADHD).
Any references in this Privacy Policy to “we” or “us” are to KCL. Any references to “you” or “them” refers to responsible adult caregivers of children with ADHD using PACES+, healthcare professionals using PACES+, and the child with ADHD for whom the adult caregiver is responsible and who is under the clinical care of healthcare professionals using PACES+.
The Privacy Policy applies to all personal information collected in respect of the child whose data is collected, stored, analysed and used by PACES+, their responsible adult caregivers, and by healthcare professionals using PACES+. “Personal information” means any information relating to a living identifiable individual.
Protecting your personal information is of utmost importance to us. Please take time to read this Privacy Policy carefully, so that you understand how we use your personal information. KCL’s Core Privacy Notice supplements this PACES+ Privacy Policy, and should be read in conjunction with the PACES+ Privacy Policy.
This Privacy Policy sets out:
PACES+ is a digital health smartphone-based software application (‘app’) and clinician dashboard designed to help responsible adult caregivers and registered healthcare professionals to support children with Attention Deficit Hyperactivity Disorder (ADHD). PACES+ is a medical device, registered with the Medicines and Healthcare Regulatory Agency in the UK, device ID: 0000028761. You may only use the PACES+ device in accordance with the Terms and Conditions of Service, which can be found here. Please read this document carefully and ensure that you understand it.
Although PACES+ collects, stores and processes data about children with ADHD, and therefore this PACES+ Privacy Policy applies to them, PACES+ is not intended to be used by children and is not targeted for use by children.
PACES+ was developed by the Child and Adolescent Mental Health Digital Lab at King’s College London, in collaboration with approved researchers and clinicians from South London and Maudsley NHS Foundation Trust.
We will collect, process and store personal information about you where it is lawful to do so which may include:
This may include, for adult caregivers and children for whom they are responsible, your email address, name, home address, date of birth, medical history, school diary information, and responses to questionnaires accessed through PACES+. For healthcare professionals, this may include your name, job title or role, email address and contact details. In other words, this may include personal information that is necessary for delivering you the PACES+ product/service or to enhance your customer experience with us. We only collect this information when you expressly provide it to us.
This includes actigraphy data collected using a compatible wrist-worn activity tracker, which collects data on physical activity and sleep during the day and night. PACES+ collects anonymous information on user engagement (e.g., number of app log-ins, length of time in use of the PACES+ app) in order to improve the customer experience, however this is anonymous and aggregated and does not constitute personal information.
We do not collect information including GPS location, web-browser history, and email or text message correspondence.
We gather information from Healthcare Providers with confirmation that they have legal grounds to share that information with us, including the South London and Maudsley NHS Foundation Trust myHealthE identifier. This is either information you have provided to them directly or information they have gathered about you on other legal grounds. Currently, the only Healthcare Provider that we work with is South London and Maudsley NHS Foundation Trust.
PACES+ does not use cookies (cookies are small text files that save and retrieve information about your visit, such as how you entered and navigated the app and what information was of interest to you).
How we use your personal information depends on the service that we are offering and who uses it. KCL offers the following services through PACES+:
The PACES+ smartphone-based app is a service intended to be used by responsible adult caregivers who have responsibility for a child diagnosed with ADHD. Both the responsible adult caregiver and their child diagnosed with ADHD are data subjects.
The PACES+ clinical dashboard is intended to be used by healthcare professionals during the care of a child with ADHD, who is the data subject. The healthcare professional may also be a data subject.
PACES+ is not intended to be used by children, and we do not provide our services directly to children. However, PACES+ collects, stores and processes personal information about children. In doing so, we aim to comply with the Information Commissioner’s Office Guidance on Children and the GDPR.
In order to process your personal information, we must have a valid, legal reason to process that data. This is called a ‘lawful basis for processing’ under GDPR.
We use your personal information through reliance on the following lawful bases:
The responsible adult caregiver enters into the contract on behalf of the child, in accordance with our terms and conditions of use of PACES+. The use of your personal information may include:
For example, we may use your information:
Where we have relied on our legitimate interests to process your personal information, you may contact us to obtain more information, including in relation to our assessment of the impact on you.
For example, we may use your information:
We use your personal information through reliance on the following lawful bases:
For example, we may use your information:
For example, we may use your information:
Where we have relied on our legitimate interests to process your personal information, you may contact us to obtain more information, including in relation to our assessment of the impact on you.
In certain circumstances, we share your personal information with trusted partners, specifically your healthcare provider and trusted providers of IT services. We only work with processing partners who are able to ensure and demonstrate that appropriate technical and organisational security measures are used for the processing of your personal information. Our trusted provider of IT services is currently Amazon Web Services, who are able to demonstrate the highest levels of industry-standard data protection and security, however we reserve the right to amend our trusted providers of IT services at any time.
We may need to disclose your personal information to law enforcement authorities, regulators or because we are legally obliged to disclose your personal information to third parties or public officials. We might also disclose your personal information to other third parties if you have consented to it or if there are other lawful bases for it. If we need to make such disclosures, we will always reduce the risk to you by anonymising or pseudo-anonymising your personal information where possible.
Who we share your information with depends on the services that we are offering.
We may share your personal information with our trusted partners where necessary for the reasons specified:
We may also share your personal information with our trusted partners where necessary for the reasons specified:
The PACES+ app contains links to other apps and websites. These sites have been carefully selected by PACES+ to provide further mental health support for children and young people. If you click on a third-party link, you will be directed to that site. Therefore, we recommend that you review the Privacy Policy of these apps or websites separately. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services. We do not share your personal information with third-party sites or services linked to within the PACES+ app.
We may completely anonymise personal information gathered and continue to use any such anonymised data. We will use information outside the scope of this Privacy Policy only when it is anonymised. In completely anonymising personal information, we follow the Information Commissioner’s Office Anonymisation Code of Practice or equivalent guidance if this is amended.
Where your personal data relates to PACES+, a regulated medical device we offer, it will be retained in line with medical device regulations. For other personal information, we will balance your data rights against the basis of processing and document the retention period in our records retention policy.
PACES+ is not targeted towards children. However, in order to deliver the PACES+ product/services to responsible adult caregivers and healthcare professionals, we collect, process, store and use data about children with ADHD. In using children’s personal information, we follow the UK Information Commissioner’s Office guidance on processing children’s personal information, or equivalent guidance if this is amended. We do not consider that our processing is likely to result in high risks to the rights or freedoms of children. We do not contact children for newsletters or campaign offers or any forms of marketing, or for any form of communications about PACES+ services.
You have the following rights regarding your information:
You have the right to be provided with clear, transparent and easily understandable information about what personal information is gathered, who we obtained it from (if a third party), why and by whom it is processed. This is why we are providing you with the information in this Privacy Policy.
You have the right to obtain access to your personal information (if we are processing it), and certain other information (similar to that provided in this Privacy Policy).
You are entitled to have your information corrected if it is inaccurate or incomplete.
In certain circumstances you can request for your personal information to be erased from our records. This is not a general right to erasure; there are exceptions, for example in keeping medical records and archiving scientific research.
You have rights to ‘block’ or suppress further use of your information. When processing is restricted, we can still store your information, but may not use it further. We keep lists of people who have asked for further use of their information to be ‘blocked’ to make sure the restriction is respected in future.
You have the right to object to certain types of processing, in certain circumstances. In particular, you have the right to object to the processing of your personal information based on legitimate interests grounds.
Subject to some limited exceptions, you also have the right to object to automated processing, including profiling; and not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you. While PACES+ uses automated processing, we consider that such processing is not automated decision-making, and does not result in legally significant effects.
You have the right to obtain and reuse your personal information in a structured, commonly used and machine readable format in certain circumstances. In addition, where certain conditions apply, you have the right to have such information transferred directly to a third party.
If you have given your consent to anything we do with your personal data, you have the right to withdraw your consent at any time (although if you do so, it does not mean that anything we have done with your personal data with your consent up to that point is unlawful). If we have fully anonymised your data which you originally provided with consent, we will not be able to identify your specific personal information and therefore we may continue to process it.
If an automated decision has been made about your child’s healthcare, you have the right to request for any such decision to be reviewed by a human. PACES+ does not currently make automated decisions about healthcare.
To exercise your rights or to contact us with any questions or complaints about this Privacy Policy or about how we handle your information, please contact us:
Email: paces@kcl.ac.uk
Post: PACES+, CAMHS Digital Lab, Department of Child and Adolescent Psychiatry, PO85, Institute of Psychiatry, Psychology & Neuroscience, King’s College London, 16 De Crespigny Park, London, SE5 8AF.
Additionally, you may contact the KCL Data Protection Officer:
Email: info-compliance@kcl.ac.uk
Telephone: +44(0)20 7848 7816
Post: Data Protection Officer, Department of Business Assurance, King’s College London, Room 5.35, James Clerk Maxwell Building, 57 Waterloo Road London, SE1 8WA
If you are not satisfied with our response or you believe our use of your personal information does not comply with data protection law, you can make a complaint to a relevant data protection supervisory authority. In the UK, this is the Information Commissioner’s Office (ICO): https://ico.org.uk/make-a-complaint/.
From time to time we may make changes to this Privacy Policy to ensure that it is accurate and up to date and to reflect any changes in the law. If the Privacy Policy changes, users will be notified by email and/or via the PACES+ app.
This policy was last updated on 14 December 2023.