Privacy notice
Plain language about what we collect, why, who processes it and how long we keep it.
Last updated 29 September 2026
Who we are
MyADHDCheck is operated by an independent operator in Australia. The site is for adults 18 and over. Your screening answers and preparation notes are health information, which is sensitive information under Australian privacy law, and we handle them under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. This notice is written for the site as it currently works; it has not yet been reviewed by a lawyer.
What we collect and why
| Information | Why | Required? |
|---|---|---|
| Your six screening answers and the computed result | To show you your result and let you return to it | Yes, to see a result |
| Confirmation that you are 18 or older and have read this notice | Consent record | Yes |
| Email address | Only to send a link to your result, a receipt, or a recovery/verification link you request | No for the screening; yes if you buy the preparation pack (receipt and recovery only) |
| Your appointment preparation notes (examples, history, diary, questions, checklist, optional name) | To save, show back to you and print the notes you write in the optional preparation pack. Never analysed, scored or emailed. | Only if you buy the pack; every field is optional |
| Payment facts (amount, date, Stripe or PayPal payment reference) | To record a purchase, handle refunds and keep financial records | Only if you buy something (the preparation pack, or a historical summary) |
| Campaign tags (source, medium, name) from the link you arrived on | To count which channels bring visitors; values are restricted to a short allow-list. The campaign tags are remembered in your browser tab only until you close it, not in a cookie, and are sent with your screening or preparation start. | No |
| Anonymous funnel counts (page viewed, offer seen) | To see where people stop; only recorded if you accept optional analytics | No |
| Account email and password hash | Only if you choose to create an account | No |
We do not record your IP address, browser details or referring pages against your screening. We do not use advertising pixels or session recording.
Optional notes on your result page. After a completed six-question screening, the result page offers a few optional, unscored questions to help you prepare for an appointment. Anything you type there stays only in the browser tab while it is open. It is not sent to us, not saved on our servers, not saved to browser storage, not analysed and never added to your result or its PDF. Refreshing, navigating away or closing the tab may lose these notes. If you choose to print or save those notes, that copy is on your own device and is yours to keep or discard.
Who processes it
- Neon hosts our database in Amazon Web Services' Sydney region (ap-southeast-2), as configured at the time of this notice.
- Vercel runs the website from its Sydney region. Vercel Web Analytics counts page views without cookies or cross-site tracking, using anonymised, aggregated data; no screening answers or notes are sent to it.
- Stripe processed payments for older purchases and still holds those payment records. We never see your card number. Stripe's own privacy policy applies to the payment.
- PayPal processes payments where PayPal checkout is offered. We send PayPal only a generic product name, the price and an opaque order reference — never your name, email address or notes; PayPal knows you through your own PayPal account. PayPal's own privacy policy applies to the payment.
- Resend sends the emails you ask for (result links, receipts, recovery and verification links).
- Microsoft Azure OpenAI is used to draft blog articles. No screening data or personal information is sent to it.
- Backups. A read-only backup of the database is made nightly to the operator's own computer in Australia, where only the operator's Windows account can open it, and kept for 14 days. An encrypted copy is also kept in the operator's Google Drive for 30 days. It is encrypted before it is uploaded, with a key only the operator holds, so Google cannot read it.
Some processing providers operate or store data outside Australia. Emails are sent through Resend, which may process them in Japan and the United States. Payments are handled by PayPal, and by Stripe for older purchases; under their own policies, payment information may be processed outside Australia. Where information leaves Australia, we choose providers with published security and privacy commitments, and we send them only what they need.
Data in transit is encrypted (HTTPS). Data at rest is encrypted by the database provider. The operator, when administering the site, can read stored records; encryption does not prevent that.
How long we keep it
Automatic age-based cleanup is not currently running. Records may remain longer than the target periods below, including older records without reliable completion dates. You can still request deletion or use the deletion controls on your result or preparation workspace; you do not need to wait for automatic cleanup.
Our target retention periods are:
- • Screenings started but not finished: target removal after 90 days of inactivity.
- • Answers and results of completed screenings: target anonymisation 24 months after completion.
- • Appointment preparation notes: target anonymisation 24 months after the last change. You can delete them earlier from the workspace.
- • Payment facts: kept 7 years, then reviewed, as required for financial records.
- • Emailed links and verification tokens: expire within minutes to days and no longer grant access. Expired token records may remain until cleanup runs.
You can delete your data earlier at any time (see below).
How results are protected
A result opens only in the browser that created it (through a secure cookie), through a time-limited link we emailed you, or to the account it belongs to. Knowing a result's web address is not enough to open it.
Your data: get a copy or delete it
Enter the email address you used. We will send a confirmation link. Nothing is disclosed or changed until you use it. If you did not give an email address, your result is only reachable from the browser you used; contact us if you need help.
Deletion removes answers, results, preparation notes, name and email. If you paid for anything we keep a minimal payment record (amount, date, payment reference). Preparation pack owners can also export or delete their notes directly from the workspace, whatever the payment or refund state.
Complaints
Contact us first through the contact form. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).
Changes
We will update the date at the top of this notice when it changes, and summarise material changes on this page.
This update clarifies that automatic age-based cleanup is not running, records may remain beyond our targets, and deletion requests remain available.