Legal
What we collect, why we collect it, and what happens to it. Written to be readable rather than impressive.
Last updated: 15 September 2026
ADHDementia provides screening, training and consultancy for care homes supporting people living with dementia who also have ADHD. ADHDementia is the trading name of Kerry Billson, a sole trader established in the United Kingdom. For the purposes of UK data protection law, the data controller is Kerry Billson, trading as ADHDementia.
Our trading address for correspondence is:
Kerry BillsonIf you have any question about this policy or about your personal data, contact us at kerry@adhdementia.com or through our contact page.
We are registering with the Information Commissioner's Office and will publish our registration number here as soon as it is issued.
The life-history reflection tool runs entirely in your web browser. The answers you give, the name or initials you enter, and the report the tool produces are processed on your own device and are never transmitted to us or to anyone else. We do not receive them, we cannot see them, and we do not store them.
This means you remain responsible for any report you save, print or share. If you complete a screening about a resident or a family member, the resulting report is personal information about that person, and your organisation's own data protection policies apply to how you store and share it.
Both versions of the Personhood Profile, the one a person writes about themselves and the one a care home builds, run entirely in your web browser. Everything you enter is saved on the device you are using so that you can come back to it, and is never transmitted to us. We hold no copy, no database and no account, and we could not read a profile if we wanted to.
Because a profile contains detailed personal information, and often health information, please treat the file and any printout as you would a care record. Where a care home builds a profile about a resident, the care home is the data controller for it. We are not a processor of it because we never receive it.
If you clear your browser data, or change or lose the device, without first saving your file, the profile is gone and we cannot recover it. Save your file regularly.
The course stores the learner name, the care home name and your module progress in your browser's local storage, on your device. This is what allows you to leave the course and resume where you left off. It is not sent to us.
Certificates are generated in your browser and printed or saved by you. Each carries a browser-generated record ID that can detect some accidental changes. It is not proof of identity, attendance or authenticity. The calculation happens on your device and no record of it reaches us. We do not hold a copy of any certificate and we cannot tell you whether a given person completed the course.
When you press "Save my record for my manager", a file containing your name, care home, completion date and score downloads to your own device. You choose who to send it to. It is not uploaded anywhere.
The training matrix a manager keeps is stored in that manager's browser, on that manager's computer. Where it contains the names of staff, the care home is the data controller for it, exactly as it is for any other training record it keeps. We are not a processor of it because we never receive it.
You can clear this stored information at any time by clearing your browser data for this site. Doing so on a manager's computer will delete the training matrix, so take a backup first.
The optional feedback form available throughout the course is the only part of the course that sends anything to us. If you complete it we receive your rating, your role if you give one, and your written answers. We do not ask for your name and you do not have to identify yourself. We use it to improve the course. The form also includes the course version so that we know which material you reviewed. Feedback is processed through Netlify. Avoid resident details or other sensitive information. Free-text feedback is not guaranteed to be anonymous.
Lawful basis: our legitimate interest in evaluating and improving our training.
Retention: feedback is kept for up to three years, after which it is deleted or fully anonymised.
We collect your name and email address to manage the session you request. Organisation, role and a general topic are optional. We also receive the event date and campaign source parameters included in the registration link, if present. Please do not include identifiable resident information.
Registration is processed through Netlify. Kerry sends confirmation, joining instructions and session resources separately by email. We use these details for our legitimate interest in administering the session you have requested. Event correspondence follows the enquiry retention period in section 6.
The optional, unticked newsletter box is separate from registration. We send future marketing emails only when you choose that option or sign up separately. That consent can be withdrawn at any time as described in section 7.
The session takes place on Microsoft Teams. Your display name and anything you choose to say, show or type may be visible to other attendees. Microsoft processes meeting information to provide the service. Please keep discussion general and do not disclose resident information. No recording is promised as part of this event.
When you use our contact form we collect your name, email address, organisation (if you give one), your area of interest and your message. We use this only to respond to your enquiry and, where relevant, to provide the services you have asked about.
Lawful basis: our legitimate interest in responding to enquiries about our services, and, where you become a customer, performance of a contract.
Retention: enquiry correspondence is kept for up to two years from our last contact, unless you become a customer, in which case business records are kept for six years to meet accounting and tax requirements.
Form submissions are processed by our website host, Netlify, which acts as a data processor on our behalf.
If you sign up to the ADHDementia letter we collect your email address and nothing else. We use it only to send you the newsletter, which goes out roughly once a month and carries news of new guides, new research and dates for free sessions.
Lawful basis: your consent, given by submitting the sign up form. You can withdraw it at any time and that is as easy as giving it.
How to unsubscribe: every email carries an unsubscribe link. One click removes you. You can also email kerry@adhdementia.com and we will take you off by hand.
Retention: we keep your address until you unsubscribe, and then we remove it. If you unsubscribe we keep a note that you have done so, and only that, so we do not add you back by mistake.
Sharing: we never sell, rent, share or swap the mailing list. Sign ups are collected by our website host, Netlify, which acts as a data processor on our behalf.
We do not use tracking pixels in our emails, so we do not know whether you opened one or which links you followed.
When you book a webinar place or take out a subscription, payment is handled by our payment processor, Stripe Payments Europe. We do not receive or store your full card details. We receive your name, email address, billing details and a record of your transaction, which we use to provide the service, issue invoices and meet our accounting obligations.
We sometimes approach care providers directly to introduce our services. If you have received an email from us that you did not ask for, this section explains where your details came from and how to stop it.
What we hold: your name, your job title, your work email address or telephone number, and your organisation. Nothing more.
Where it comes from: publicly available business sources such as your organisation's own website, the Care Quality Commission register, Companies House or LinkedIn. We do not buy contact lists and we never will.
Lawful basis: our legitimate interest in offering relevant services to organisations that we have reason to believe would find them useful. We have weighed that against your interests, and we hold only work contact details, approach only in a professional capacity, and stop immediately on request. Where our contact is by email, we rely on the position under the Privacy and Electronic Communications Regulations that unsolicited business email may be sent to corporate subscribers. We do not send unsolicited marketing email to sole traders or ordinary partnerships without consent.
Retention: two years from our last contact with you, unless you become a customer.
How to stop it: reply to any message, or email kerry@adhdementia.com, and we will stop. We keep a note of your request, and only your request, so that we do not approach you again by mistake. That record is the reason we do not simply delete everything, and you can ask us to erase that too.
Outreach records are held in a spreadsheet on our own encrypted cloud storage. No information about any resident is ever recorded there, and we would refuse it if it were offered.
We do not use advertising cookies and we do not track you across other websites.
The online course uses your browser's local storage to hold progress. The life-history reflection tool holds answers in page memory only; leaving or reloading the page loses them. This is essential to how those tools work and stores nothing on our servers.
This site sets no cookies of its own.
We use Cloudflare Web Analytics to count visits. It sets no cookies, stores nothing on your device, uses no fingerprinting, and does not follow you to any other website. Because it neither stores nor reads anything on your device, you are not asked to consent to it and there is no cookie banner.
What it records is the page visited, the site or search engine that sent you, roughly which country you are in, and whether you were on a phone or a computer. Your IP address is used momentarily by Cloudflare to work out the country and is not stored, not shared with us, and never used to identify you. We see aggregate counts only. There is nothing in it that could tell us who you are, and no way for us to single out one visitor.
Cloudflare's privacy commitments for this product are published at cloudflare.com/web-analytics. Our lawful basis is legitimate interests: understanding which pages are useful so we can improve them. If we ever adopt anything that does need your consent, you will be asked for it before it loads.
Our pages load two fonts from Google Fonts. When they load, your IP address is visible to Google as part of that request. This can be removed entirely by hosting the fonts ourselves, which is on our improvement list.
We share personal data only with service providers who help us operate, and only as far as necessary:
We may also disclose information where we are legally required to do so. We never sell personal data.
Some of our service providers operate outside the UK. Where personal data is transferred internationally, we rely on the safeguards those providers have in place, such as UK International Data Transfer Agreements or adequacy regulations.
Under UK data protection law you have the right to: be informed about how your data is used; request a copy of your data; have inaccurate data corrected; request erasure; restrict or object to processing; and request data portability. Where we rely on consent, you may withdraw it at any time.
To exercise any of these rights, contact us using the details in section 1. We will respond within one month.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Our services are intended for care professionals, families and adults. The site is not directed at children and we do not knowingly collect data about them.
We may update this policy as the service develops, particularly when subscriptions and analytics go live. The date at the top shows when it was last changed.