How we use your information

This notice explains how we handle personal information about you when you have an account on Neuraplex, the digital neurodevelopmental assessment and clinical workflow platform provided and operated by Neurodevelopmental Services Limited (“we”, “us” or “our”).

It applies to clinicians, administrative staff and other authorised users, including users of a Trial or User Acceptance Testing (“UAT”) environment.

This notice is about you as a Neuraplex user. It is not a patient or service-user privacy notice. Section 9 explains how patient information is handled.

If you would like this notice in another format, such as large print, please contact us using the details in section 17.

For the information described in this notice, the data controller is:

Neurodevelopmental Services Limited
Company number 12197807, registered in England and Wales
Registered office: Asm House, Keymer Road, Hassocks, West Sussex, BN6 8QL
ICO registration reference: ZA560187
Email: info@neuraplex.co.uk · Telephone: 07486 531240

Your employing or contracting organisation may also hold information about you, for example in its staff records. It is responsible for that information and will have its own privacy notice.

We collect only what we reasonably need to provide, administer, secure and support your access to Neuraplex. This includes:

• your name, work email address, organisation and professional role;
• your telephone number, where provided (for example, to receive one-time passcodes);
• your user account details, assigned roles and access permissions;
• account activation information, including your acceptance of any terms of use;
• login and authentication information, including one-time passcode (OTP) events;
• dates and times of access;
• security and audit logs, including actions taken through your account;
• technical information about your access, such as IP address, browser and device type; and
• information you give us when you contact Neuraplex Support.

We do not ask for special category information about you as a user, such as information about your health.

• From your organisation, when it asks us to create your account: usually your name, work email address, role and the access you need.
• From you, when you activate your account, update your details or contact Support.
• From your use of Neuraplex, which automatically creates login, security and audit records.

Under UK data-protection law we must have a lawful basis for each purpose. Where we rely on legitimate interests, our interest is in providing a secure, reliable and accountable platform to the organisations that use it, under our contract with your organisation. We have balanced this against your interests and rights, and you can object (see section 14).

What we use it for	Lawful basis
Creating and administering your account, and giving you the right role-based access	Legitimate interests
Verifying your identity and authenticating your logins, including one-time passcodes	Legitimate interests; legal obligation to keep personal data secure
Keeping security and audit records, and investigating technical or security incidents	Legitimate interests; legal obligation to keep personal data secure
Operating, maintaining and improving the reliability, security and performance of Neuraplex	Legitimate interests
Giving you technical and user support, and contacting you about your account	Legitimate interests
Managing our relationship and contract with your organisation	Legitimate interests
Meeting our legal and regulatory obligations, and responding to lawful requests	Legal obligation

We do not use your information for marketing, and we do not make decisions about you based solely on automated processing.

Neuraplex is a clinical platform, so every account is individual and its use is recorded. Records may include:

• account activation, login, logout and authentication;
• the areas of the platform you access;
• actions you take and changes you make; and
• relevant technical or security events.

These records are used for security, accountability, investigation, clinical governance, audit and compliance. Your organisation may ask us for audit records about your account, for example to investigate a security or information-governance concern.

Access is limited to people who need it for a legitimate purpose. This may include:

• authorised staff of Neurodevelopmental Services Limited;
• authorised administrators within your organisation;
• our contracted service providers, such as cloud hosting, email and passcode delivery, and support tools, who act only on our instructions under contracts with confidentiality, security and data-protection requirements;
• our professional advisers, such as lawyers and auditors, where needed; and
• regulators, law enforcement or other public authorities, where the law requires it.

We do not sell your information.

If you are using a Neuraplex Trial or UAT environment, you must follow the Trial/UAT Agreement and terms of use that apply to it.

This notice does not replace the privacy information that a healthcare organisation gives to its patients, service users, parents or carers.

When a healthcare organisation uses Neuraplex to record patient or service-user information, that organisation decides why and how the information is used and is normally the data controller. We process that information on its behalf as a data processor, under a data processing agreement.

Questions about a patient’s clinical record, including access or correction, should go to the healthcare organisation responsible for that person’s care.

We keep your information only as long as we need it for the purposes above and to meet legal, contractual, security and governance requirements. When you no longer need access, your organisation should ask us to deactivate your account.

Information	How long we keep it
Account and contact details	While your account is active, then 2 years after deactivation
Login, authentication and OTP records	2 years from the date of the event
Audit records of actions taken in patient records	As long as the patient record they relate to is kept, because the audit trail forms part of that record’s integrity
Support correspondence	2 years after the query is closed

At the end of these periods, information is securely deleted or anonymised.

Neuraplex is hosted securely in the United Kingdom.

If personal information is ever transferred outside the UK, we will make sure it is protected by safeguards required under UK data-protection law, such as UK adequacy regulations or approved contractual clauses.

We use proportionate technical and organisational measures to protect your information and the platform, including individual accounts, multi-factor authentication, role-based access and audit logging.

You play an important part too. Please:

• keep your login details and one-time passcodes to yourself;
• never share your account or let someone else use it;
• lock or log out of your device when you leave it; and
• report suspected unauthorised access, lost credentials or other security concerns to us straight away.

We need your name, work email address and role to create your account. Without them we cannot give you access to Neuraplex.

Depending on the circumstances, you have the right to:

• be informed about how your information is used;
• ask for a copy of your information;
• ask us to correct inaccurate information;
• ask us to delete your information in certain circumstances;
• ask us to restrict how we use your information in certain circumstances;
• object to our use of your information where we rely on legitimate interests; and
• data portability, where it applies.

These rights are not absolute. For example, we may need to keep audit records to protect the integrity of clinical records. To use any of your rights, contact us using the details in section 17. There is normally no charge, and we will respond within one month.

Neuraplex uses cookies and similar technologies that are strictly necessary for secure authentication, session management and security. If we introduce non-essential cookies, we will tell you and give you a choice where the law requires it.

We may update this notice when Neuraplex, our processing or the law changes. The current version and date will always be available in Neuraplex. If we make a significant change, we will tell you.

For questions about this notice or how we handle your information:

Neuraplex, Neurodevelopmental Services Limited
Asm House, Keymer Road, Hassocks, West Sussex, BN6 8QL
Email: info@neuraplex.co.uk · Telephone: 07486 531240

If your question is about information your employer or healthcare organisation controls, please contact that organisation directly.

If you are concerned about how we handle your information, please contact us first so we can try to put it right.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent data-protection regulator:

Website: ico.org.uk/make-a-complaint
Telephone: 0303 123 1113
Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF