Privacy Policy
ESSENCE INSTRUMENTS LTD
Last updated: 13 October 2026
This policy explains how ESSENCE INSTRUMENTS LTD collects, uses and protects personal data when you visit essence-in.com, create an account, buy instruments or use our portal. Our instruments are used in the UK, across the European Union and internationally. This policy is written to meet the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), and, for people in the European Economic Area (EEA), the EU General Data Protection Regulation (EU GDPR). Where we refer to “GDPR”, we mean whichever of these applies to you.
1. Who we are
| Item | Details |
|---|---|
| Company name | ESSENCE INSTRUMENTS LTD |
| Company number | 15527320 (registered in England and Wales) |
| Registered address | Brookfield Court, Selby Road, Leeds, LS25 1NB |
| Website | https://essence-in.com |
| Privacy contact | support@essence-in.com |
| ICO registration number | C2055051 |
In this policy, “we”, “us” and “our” mean ESSENCE INSTRUMENTS LTD. “You” means anyone whose personal data we handle: website visitors, account holders, customers, and people who contact us.
Our two roles. We act in two different capacities, and your rights work slightly differently in each:
- As a controller — for data about our website visitors, account holders and customers (for example your name, email, order history). We decide how and why this data is used, and this policy applies in full.
- As a processor — for questionnaire and screening data that a healthcare, research or educational professional enters or collects about a patient, participant, pupil or other respondent through our portal. In that case the professional or their organisation is the controller, and we process the data only on their documented instructions under a data processing agreement. If you are a respondent, please contact the professional or organisation that asked you to complete the instrument; we will help them respond to your request.
2. Personal data we collect
| Category | Examples | Source |
|---|---|---|
| Identity and contact data | First and last name, email address, job title, organisation, professional role (healthcare, research, education) | You, when you sign up, buy or contact us |
| Account data | Login email, encrypted password, “remember me” and magic-link login records, account settings | You, and our systems |
| Professional eligibility data | Qualifications or credentials needed for instruments with restricted use (for example the 5-15R) | You |
| Transaction data | Instruments and licences purchased, order history, billing address, VAT number, invoices | You and our payment provider |
| Payment data | Card or payment details — handled directly by our payment provider; we do not store full card numbers | Our payment provider |
| Communications data | Messages sent through our contact form, emails, support requests, feedback | You |
| Technical and usage data | IP address, browser and device type, pages visited, time and date of visits, referring site, error logs | Your device, via cookies and server logs |
| Marketing preferences | Whether you have agreed to receive updates from us | You |
| Instrument response data (processor role) | Answers to questionnaires and interviews, scores, results and reports about a respondent, which may include health data about adults or children | The professional using the portal, or the respondent at their request |
Special category data. Instrument response data may reveal information about a person’s health, development or neuropsychiatric conditions. This is “special category data” under UK GDPR. We only process it as a processor on behalf of the professional or organisation that controls it, and we apply additional safeguards (see section 6).
Children’s data. Some instruments concern children (for example SAB 0-2, ESSENCE-Q Child, 5-15R). Children do not hold accounts on our site. Data about a child is entered by, or collected at the request of, a professional who is responsible for having a lawful basis and any necessary parental consent.
We do not knowingly collect special category data in our controller role. Please do not include health information about yourself or others in contact-form messages.
3. How we use your data and our lawful bases
| Purpose | Data used | Lawful basis (UK GDPR Art. 6) |
|---|---|---|
| Create and manage your account and give you access to the portal | Identity, contact, account | Contract |
| Process orders, deliver instruments and licences, issue invoices | Identity, contact, transaction, payment | Contract; legal obligation (tax and accounting records) |
| Check eligibility for restricted instruments | Identity, professional eligibility | Contract; legitimate interests (ensuring instruments are used by qualified professionals, as required by their authors) |
| Respond to enquiries and provide support | Identity, contact, communications | Legitimate interests (answering you); contract where it relates to an order |
| Send service messages (order confirmations, security alerts, changes to terms) | Identity, contact | Contract; legal obligation |
| Send news about new instruments and updates | Identity, contact, marketing preferences | Consent, or legitimate interests for existing customers (soft opt-in under PECR). You can unsubscribe at any time |
| Keep the site secure, prevent fraud and misuse, fix errors | Technical, account | Legitimate interests (protecting our service and users) |
| Understand how the site is used and improve it | Technical and usage | Consent (for non-essential cookies); legitimate interests |
| Comply with law, enforce our terms, handle legal claims | Any relevant data | Legal obligation; legitimate interests |
| Host, store and score instrument response data on behalf of professionals | Instrument response data | Processed on the controller’s instructions (Art. 28). The controller relies on its own lawful basis and Art. 9 condition |
Anonymised and aggregated data. We may create anonymised, aggregated statistics from instrument use (for example, how often an instrument is used or general score distributions) to improve our instruments and support research. Anonymised data cannot identify any individual and is not personal data. We only do this where the controller’s agreement with us permits it.
Automated decision-making. Instruments produce scores and flag results against cut-off values. These outputs support, and never replace, the judgement of a qualified professional. We do not make decisions with legal or similarly significant effects about anyone based solely on automated processing.
Where we rely on legitimate interests, we have balanced our interests against your rights. You can ask us for details of that assessment.
4. Who we share data with
We do not sell personal data. We share it only with the following, and only as far as needed:
| Recipient | Why | Location |
|---|---|---|
| Website and portal hosting provider [Internal Hosting] | Hosting the website, accounts and portal data | [UK / EEA] |
| Payment provider [e.g. Stripe / PayPal] | Taking payments securely | [UK / EEA / US] |
| Instrument authors and licensors, including the Gillberg Neuropsychiatry Centre | Confirming licence holders and eligibility for restricted instruments; never instrument response data without the controller’s instruction | [Sweden / UK] |
| Regulators, courts and law enforcement | Where the law requires it | UK / EEA |
Our service providers act as processors. They may use your data only on our instructions and must keep it secure.
Instrument response data is never shared with anyone other than the professional or organisation that controls it and our approved sub-processors, unless the controller instructs us or the law requires it. A list of current sub-processors is available to customers on request.
5. International transfers
We are based in the UK and our main systems are hosted in [the UK / the EEA]. Because our instruments are used internationally, personal data may move between countries as follows:
- From the EEA to the UK. The European Commission has recognised the UK as providing adequate protection for personal data (adequacy decisions renewed until 27 December 2031). Data can therefore flow from the EEA to us without additional safeguards. If that recognition changes, we will put the EU Standard Contractual Clauses in place.
- From the UK to the EEA. UK law recognises the EEA as adequate, so no additional safeguards are needed.
- To other countries. If we or our service providers transfer data to a country without an adequacy decision (for example the United States), we use an approved safeguard: the UK International Data Transfer Agreement or UK Addendum, the EU Standard Contractual Clauses, or the UK Extension to the EU–US Data Privacy Framework, together with a transfer risk assessment where required.
- Customers outside the UK and EEA. When a professional or organisation in another country uses our portal, instrument response data is sent from their country to our servers. They remain responsible, as controller, for meeting any transfer rules in their own country, and we will sign any reasonable transfer terms they need.
You can ask us for a copy of the relevant safeguard.
Users in other countries. If you live outside the UK and EEA, local privacy laws may give you additional rights. We will respect those rights where they apply to us. Contact us at support@essence-in.com with any request.
6. How we keep data secure
We use appropriate technical and organisational measures, including:
- encryption of data in transit (HTTPS/TLS) and at rest;
- hashed passwords and secure login links;
- access limited to staff and providers who need it, bound by confidentiality;
- separation of instrument response data by customer account;
- regular backups, updates and security monitoring.
No system is completely secure. If a personal data breach occurs that is likely to put your rights at risk, we will notify the Information Commissioner’s Office (ICO) within 72 hours where required, and tell you or the relevant controller without undue delay.
7. How long we keep data
| Data | Retention period |
|---|---|
| Account data | While your account is open, then up to 12 months after closure or 24 months of inactivity |
| Transaction and invoice records | 6 years after the end of the financial year they relate to (HMRC and Companies Act requirements) |
| Contact and support messages | Up to 24 months after the enquiry is resolved |
| Marketing preferences | Until you unsubscribe, then a suppression record so we do not contact you again |
| Server and security logs | Up to 12 months |
| Instrument response data | As instructed by the controller; deleted or returned when the customer’s account or agreement ends, subject to any legal hold |
We may keep data longer if needed to deal with a legal claim or complaint.
8. Cookies
Cookies are small files placed on your device. We use:
- Strictly necessary cookies — to keep you signed in, remember your basket, process checkout and protect against fraud. These do not need consent.
- Preference cookies — for example “Remember me” on sign-in.
- Analytics cookies [if used] — to understand how visitors use the site. We only set these if you agree through our cookie banner.
You can change your choice at any time via [Cookie settings] in the site footer, or by adjusting your browser settings. Blocking strictly necessary cookies may stop the portal and checkout working.
9. Your rights
Under UK data protection law you have the right to:
- access the personal data we hold about you;
- correct inaccurate or incomplete data;
- erase your data in certain circumstances;
- restrict how we use your data;
- object to processing based on legitimate interests, and to direct marketing at any time;
- data portability — receive data you gave us in a machine-readable format;
- withdraw consent where we rely on it, without affecting earlier processing.
To use any of these rights, email support@essence-in.com. We will respond within one month, which may be extended by two months for complex requests. We may ask you to verify your identity. There is normally no charge.
If your request concerns instrument response data, we will pass it to the professional or organisation that controls that data and help them respond.
10. Complaints
Please contact us first so we can try to resolve your concern. You also have the right to complain to a data protection supervisory authority:
- In the UK: the Information Commissioner’s Office, ico.org.uk/make-a-complaint, helpline 0303 123 1113.
- In the EEA: the supervisory authority in the country where you live, work or where the issue happened. A list is available from the European Data Protection Board.
- Elsewhere: the data protection authority in your country, where one exists.
11. Children
Our website and accounts are intended for adult professionals only. We do not knowingly allow anyone under 18 to create an account.
12. Links to other sites
Our site links to other websites, including 5-15.org and our social media pages (Facebook, X, LinkedIn). Those sites have their own privacy policies, and we are not responsible for them.
13. Changes to this policy
We may update this policy from time to time. The “Last updated” date at the top shows when it last changed. We will notify account holders by email of significant changes.
14. Contact us
ESSENCE INSTRUMENTS LTD, Brookfield Court, Selby Road, Leeds, LS25 1NB
Email: support@essence-in.com