My Autism Passport – Privacy Policy

Last updated: 30 September 2026

My Autism Passport is provided by ASD Helping Hands. We designed the app around data minimisation: most information entered into the app remains on the user’s own device and is not routinely sent to ASD Helping Hands.

This Privacy Policy explains what information the app uses, when information leaves the device, why it is processed, and how long it is kept.

1. Who we are

ASD Helping Hands is responsible for My Autism Passport and for personal information processed through our servers.

Address:
ASD Helping Hands
Assembly Rooms
Ruthen Place
Dereham
Norfolk
NR19 2TX
United Kingdom

Email: contact@asdhelpinghands.org.uk

You can contact us at this address if you have questions about privacy or the way information is handled by the app.

2. No account is required

You do not need to create an ASD Helping Hands account or sign in to use My Autism Passport.

We do not require your email address, telephone number or other account credentials to use the app.

3. Information stored on your device

The main Autism Passport information is stored locally on your device.

This may include information you choose to enter about:

  • your preferred name;
  • pronouns;
  • communication preferences;
  • sensory needs;
  • routines and changes;
  • what happens when you are overwhelmed;
  • things that help;
  • things people should avoid;
  • strengths and important information;
  • useful contact information;
  • communication cards;
  • a profile photograph;
  • saved Prepare Me plans;
  • your own notes about previous visits;
  • accessibility and app preferences.

Some of this information may relate to health, disability or support needs and may therefore be sensitive personal information.

ASD Helping Hands does not routinely receive or store this locally held Passport information simply because you use the app.

You can delete individual Passports and Prepare Me plans in the app, or use the reset option to remove locally stored Passport profiles from the device.

4. Backup and restore

The app allows you to create a backup of your Passport information.

The backup file is created for you to save or move yourself. ASD Helping Hands does not automatically receive a copy of your backup.

If you choose to store a backup with another service, such as a cloud storage provider, that provider’s privacy arrangements will also apply.

5. Communication Cards and “Say It”

Communication Cards are stored with the relevant Passport on your device.

The Say It function uses speech-synthesis functionality available on the device. Depending on the speech service or text-to-speech provider configured on your device, that provider may process the text being spoken in accordance with its own settings and privacy policy.

ASD Helping Hands does not separately store recordings of the speech produced by this feature.

6. Prepare Me

Prepare Me creates a personalised preparation plan for a place, appointment, activity or experience.

Prepare Me requires an internet connection when researching or personalising a new plan.

Place or activity research

When you enter a place or activity, the text you enter is sent to ASD Helping Hands’ server so that Prepare Me can research publicly available information about it.

The research request does not contain your name or your complete Autism Passport.

The place or activity may be sent to OpenAI to perform the research and generate structured information. Public web sources may be searched as part of this process.

We store a reusable, anonymous venue-research record so that the same publicly available information does not need to be researched repeatedly. This may include:

  • the place or activity searched for;
  • venue type;
  • publicly available venue information;
  • sources used;
  • the date the information was checked.

The venue cache is not linked to a named Passport or individual user. Our current cache period is normally around 45 days, after which the information expires or is refreshed.

Personalising a plan

After venue research, the app converts relevant choices from the Passport into anonymous preference tags.

Examples might include:

  • sensitivity to noise;
  • difficulty with crowds;
  • needing additional processing time;
  • headphones being helpful;
  • needing a quiet space.

Prepare Me may also use a general age group selected by the user and whether the plan is for the user themselves or somebody they support.

We do not send OpenAI the person’s name, profile photograph, contact details, full Passport, or free-text Passport notes for personalisation.

OpenAI receives the venue information and the limited anonymous preference information needed to create the personalised wording.

OpenAI states that data sent through its API is not used to train its models unless the customer has explicitly opted in. OpenAI may retain API content for security and abuse-monitoring purposes for a limited period, normally up to 30 days. OpenAI Platform

Completed Prepare Me plans are saved locally on the device.

Prepare Me plans are not made public and are not included when you share your Autism Passport.

7. Prepare Me images

If you choose Include pictures, some preparation-plan illustrations may be loaded from the ARASAAC pictogram service.

Loading an external image means that the external service may receive technical information normally associated with an internet request, such as an IP address.

No complete Autism Passport is sent to ARASAAC by the app.

8. Secure Passport sharing

Sharing is optional and only happens when you choose to use a sharing feature.

When you create a secure link or QR code, the information needed to display the Passport is sent securely to ASD Helping Hands’ server.

This can include:

  • preferred name;
  • pronouns;
  • useful contact information;
  • selected Passport information;
  • notes you have entered into Passport sections.

The profile photograph is not included in the secure sharing payload.

A random secure link is created and the temporary copy is stored for 7 days. After that period, the link expires and the temporary record is removed automatically.

Anyone who has the secure link or QR code during that period may be able to view the information it contains. You should therefore only share the link with people you intend to receive the Passport.

Shared Passport pages are configured not to be indexed by search engines.

9. PDF Passport

If you choose Download PDF Passport, the relevant Passport information is sent to ASD Helping Hands’ server temporarily so that the PDF can be generated.

The PDF is returned to your device. The PDF-generation process does not create a permanent Passport record on our server.

Once downloaded, you control where the PDF is saved and who it is shared with.

10. Security and abuse prevention

The app creates a random device token used to apply reasonable limits to features such as Prepare Me and secure sharing.

Our server also derives a one-way security value from the IP address making a request. These values are used to prevent automated abuse and excessive use of the service.

Rate-limit counters are temporary and normally expire after approximately one day.

We do not use these identifiers to build advertising profiles or track users across other apps.

Information transmitted between the app and ASD Helping Hands’ services is sent using encrypted HTTPS connections.

11. Advertising, tracking and analytics

My Autism Passport does not contain advertising.

The current version does not include advertising SDKs or behavioural-tracking SDKs and we do not sell Passport information to advertisers.

12. External links

The app may contain links to other websites, including ASD Helping Hands’ website, public sources used by Prepare Me, and the donation page.

When you leave the app and visit another website, that site’s own privacy and cookie policies apply.

13. Children and people who are supported by somebody else

My Autism Passport can be used by an autistic person themselves or by a parent, carer or supporter creating a Passport for somebody they support.

If you enter information about another person, you should only enter information you are entitled to provide and should respect that person’s privacy and wishes wherever possible.

Sensitive information should only be shared with people who genuinely need it.

14. How long information is kept

Different information has different retention periods:

Passport information, Communication Cards and saved Prepare Me plans:
Stored on the device until the user edits, deletes or resets them, or removes the app/device data.

Secure Passport links:
Stored temporarily for 7 days.

Prepare Me venue research cache:
Normally retained for around 45 days before expiry or refresh. It is not linked to an identifiable Passport.

Prepare Me security/rate-limit records:
Normally approximately one day.

Information processed by OpenAI:
Subject to OpenAI’s API data-retention arrangements. Standard API abuse-monitoring data may normally be retained for up to 30 days. OpenAI Platform

15. Deleting your information

You can remove locally stored information directly within the app by:

  • deleting a Prepare Me plan;
  • deleting a Passport;
  • using the reset option to remove Passport profiles from the device; or
  • uninstalling the app and removing its stored app data.

Secure links expire automatically after 7 days.

There is no My Autism Passport user account to delete.

If you have a question about information that may have been processed by ASD Helping Hands’ servers, contact:

contact@asdhelpinghands.org.uk

16. Your data-protection rights

Depending on where you live, data-protection law may give you rights relating to personal information held about you, including rights to request access, correction, deletion, restriction or objection to certain processing.

Because most Passport information remains only on your own device, ASD Helping Hands may not possess or be able to identify that information.

You can contact us at contact@asdhelpinghands.org.uk if you wish to make a privacy enquiry.

If you are in the United Kingdom, you also have the right to raise concerns with the Information Commissioner’s Office (ICO).

17. Changes to this Privacy Policy

We may update this Privacy Policy when the app, its services or legal requirements change.

The latest version will always be published on this page and the date at the top will show when it was last updated.

Scroll to Top