Privacy Notice

1. GENERAL

As part of our Speech and Language therapy work, we need to handle personal and sensitive data relating to clients and their families.

When you use Core Speech and Language you trust us with your information. This privacy policy is meant to help you understand what data we collect, why we collect it, and what we do with it. We have tried to make it as simple as possible but if you have any questions please contact us. All references to your personal information shall include where applicable the personal information of your child also.

Core Speech and Language holds personal data as part of conducting a professional service. The data follows under the following headings: healthcare records, educational records, clinical records, general administrative records, and financial records.

You are being asked to read the terms of our data collection and processing practices in connection with our Speech and Language therapy work as set out below (“Notice”). To proceed further, you must read this Notice in its entirety and check the I have read the privacy notice box on the enquiry form /or consent page document.

1. CONTACT DETAILS

You may contact Carolyn Smith, with any questions relating to this Notice, and in order to exercise your rights (set out in section 7) at carolyn@corespeechandlanguage.com

1. WHAT PERSONAL DATA IS COLLECTED AND PROCESSED?

The personal data we collect may include the following:

• Identifiable information – e.g. name, date of birth, gender
• Contact details – e.g. address, telephone number, email address
• Contact details for close family members e.g. next of kin
• Appointment details – e.g. previous appointments, invoices etc
• Health information and reports – both historical and current, including information such as milestones and developmental history
• Educational information and reports – e.g. IEPs, educational psychology reports
• Test results – e.g. private laboratory testing or previous NHS test results
• Audio or video recordings – if appropriate for the client
• Information on family structure and history – e.g. who lives at home, family history of learning or health difficulties.
• If your enquiry does not result in your child being seen by Core Speech and Language then this personal information will be deleted once your enquiry has been dealt with.
• Our website contains links to other internet sites that are outside of our control and are not covered by this Notice. We are not responsible for any data that you provide through these websites.

We may obtain your personal or sensitive data:

• When you provide this information in phone calls and emails outlining your concerns or so we can offer you further information
• When you provide this in other communications through post, phone, SMS or email
• When you sign Consent Forms
• When you complete a Case History Form or questionnaires and return them before or during a session
• From third parties such as doctors, healthcare professionals and educational practitioners
• From assessment and therapy sessions.

1. HOW WILL YOUR PERSONAL DATA BE USED

Lawful basis for processing:

Under Article 6 of the GDPR, our lawful bases for processing data include:

• LEGITIMATE INTERESTS for which Special Category data is processed for the purpose of healthcare as set out in Article 9 (2) of the GDPR. 

Core Speech and Language cannot deliver a service to your child without processing their personal information. It is within the legitimate interests of our company and client to process and store their data.

• CONSENT A client’s parents’/carers’ consent is required in order to make a referral, or share information about the client’s care with a third party involved in the client’s healthcare such as a doctor or educational or healthcare professional.  Data will not be shared with any third party for the purposes of marketing.  The client reserves the right to withdraw consent at any time.

We use the data to:

• To deliver appropriate therapy service to the client’s child and to plan and provide assessment and therapy.
• Communicate with parents and with consent, other professionals and people known to the child.
• Unless required to do so by law, we will not disclose any personal information collected to any other person than those set out above.
• We may be required to disclose information where there is a public interest such as to safe guard an individual or prevent a serious crime.
• Core Speech and Language will not give or sell clients details to third parties.
• In the event of a non-payment and failure to respond to email or post reminders regarding the non-payment, personal details may be passed to a small claims court in order to obtain the unpaid fees. 

1. HOW WILL WE STORE YOUR PERSONAL DATA?

In accordance with the General Data Protection Regulation (GDPR), we will endeavour to protect your personal data. We are committed to maintaining the security and confidentiality of your records. Actively implementing security measures to ensure the information is safe. All persons working in and for Core Speech and Language in a professional capacity are briefed on the management, storage and safekeeping of data.

We have technical and organisational security measures in place (as set out below) and invest appropriate resources to protect your personal data from deliberate or accidental manipulation, destruction, loss, misuse, unauthorised access, modification or disclosure. Wherever possible, we will ensure that our systems, and procure that our third party service providers’ systems, are appropriately secure for processing your personal data, and that the risks of your personal data being unlawfully used, amended, deleted, lost or stolen are minimised.

The personal data that you provide will be retained by us in accordance with applicable laws. However, we will take reasonable steps to destroy or de-identify personal data we hold, in accordance with our internal data retention policies and our legal obligations, if it is no longer needed for the purposes set out in section 4 above, including if you no longer have an active and on-going relationship with us. In general, this means that we will only hold your personal information for the relevant limitation period – i.e. the amount of time within which you can bring claims against us arising from our relationship.

How we keep your information secure: 

• Information in paper format is stored in locked filing cabinet. The minimum amount of confidential information is taken out of the therapists/assistant’s base.
• Information in electronic format is stored on an encrypted, password-protected laptop and backed up to an encrypted, password-protected hard drive.  The hard drive is stored in a locked filing cabinet.
• Emails are accessed only from password-protected devices.
• Video and audio recordings will be temporarily stored on a password-protected tablet and deleted after use (the tablet is stored in a locked filing cabinet)
• Telephone numbers are stored on PIN-protected mobiles as ‘Parent/carer of (child’s first name)

1. HOW LONG DO WE KEEP THE DATA?

Core speech and Language keep both physical and electronic records of clinical data to provide a service.

• The preferred format for clinical data is paper.
• Clinical records are held as guided by the Royal College of Speech and Language therapists (/www.rcslt.org) and the Health Care Professions council (www.hcpc-uk.org ). Currently they recommend we keep data until the client is 25 years old, unless there is a lawful reason to keep it longer.
• Currently clinical records recorded by a Speech and Language Therapy Assistant will be kept for 2 years from the child’s last therapy session .
• When no longer needed paper records will be shredded and electronic files will be deleted.
• Video recordings / voice recordings may be recorded with consent analysed and then destroyed.

You have the option to withdraw consent at any time.

Financial Data

• Core Speech and Language keeps electronic records of financial data from those who use our services.
• Core Speech and Language is also required to share financial data with their accountant (Hicks Chartered Accountants) to comply with local tax laws.

Section 886 of the direct tax act states that the Revenue Commissioners require that the records to be retained for a minimum of 6 years after the completion of the transactions, acts or operations to which they relate.

How and when we gain consent

• A consent form will be attached to our enquiry form or will be provided along with the client contract. Users will be directed to the privacy policy statement and asked to tick to agree the terms as per section 1 above. We cannot begin our services until we have ticked or signed consent.

Should a client wish to withdraw their consent for data to be processed they can do this by contacting Core Speech and Language at carolyn@corespeechand language.com

WHAT RIGHTS DO I HAVE IN RELATION TO MY PERSONAL DATA?

Right to access personal information

You have a right to request that we provide you with a copy of your personal information that we hold and you have the right to be informed of; (a) the source of your personal information; (b) the purposes, legal basis and methods of processing; (c) the data controller’s identity; and (d) the entities or categories of entities to whom your personal information may be transferred.

Right to rectify or erase personal information

You have a right to request that we rectify inaccurate personal information. We may seek to verify the accuracy of the personal information before rectifying it. We rely on you to ensure that your personal information is complete, accurate and current. Please do inform us promptly of any changes to or inaccuracies to your personal information using the contact details above. You can also request that we erase your personal information in limited circumstances where:

• it is no longer needed for the purposes for which it was collected; or
• you have withdrawn your consent (where the data processing was based on consent); or
• following a successful right to object (see  right to object); or
• it has been processed unlawfully; or
• to comply with a legal obligation to which we are subject.

We are not required to comply with your request to erase personal information if the processing of your personal information is necessary:

• for compliance with a legal obligation; or
• for the establishment, exercise or defence of legal claims;

Right to restrict the processing of your personal information

You can ask us to restrict your personal information, but only where:

• its accuracy is contested, to allow us to verify its accuracy; or
• the processing is unlawful, but you do not want it erased; or
• it is no longer needed for the purposes for which it was collected, but we still need it to establish, exercise or defend legal claims; or
• you have exercised the right to object, and verification of overriding grounds is pending.

We can continue to use your personal information following a request for restriction, where:

• we have your consent; or
• to establish, exercise or defend legal claims; or
• to protect the rights of another natural or legal person.

Right to transfer your personal information

You can ask us to provide your personal information to you in a structured, commonly used, machine-readable format, or you can ask to have it transferred directly to another data controller, but in each case only where:

• the processing is based on your consent or on the performance of a contract with you; and
• the processing is carried out by automated means.

Right to object to the processing of your personal information

You can object to any processing of your personal information which has our legitimate interests as its legal basis, if you believe your fundamental rights and freedoms outweigh our legitimate interests.

If you raise an objection, we have an opportunity to demonstrate that we have compelling legitimate interests which override your rights and freedoms.

Right to object to how we use your personal information for direct marketing purposes

You can request that we change the manner in which we contact you for marketing purposes.

You can request that we do not transfer your personal information to unaffiliated third parties for the purposes of direct marketing or any other purposes.

Right to obtain a copy of personal information safeguards used for transfers outside your jurisdiction

You can ask to obtain a copy of, or reference to, the safeguards under which your (or your child’s) personal information is transferred outside of the European Union.

We may redact data transfer agreements to protect commercial terms.

Right to lodge a complaint with your local supervisory authority

You have a right to lodge a complaint with your local supervisory authority if you have concerns about how we are processing your (or your child’s) personal information.

We ask that you please attempt to resolve any issues with us first, although you have a right to contact your supervisory authority at any time. 

You have the right to give directives relating to your digital legacy after your death.

You have the right to register on the relevant national phone solicitation opt-out list.

We may ask you for additional information to confirm your identity and for security purposes, before disclosing the personal information requested to you. We reserve the right to charge a fee where permitted by law, for instance if your request is manifestly unfounded or excessive.

You can exercise your rights by contacting us (see section 2 of this Notice above), with subject heading “Exercise of Data Subject Right(s)”. Subject to legal and other permissible considerations, we will make every reasonable effort to honour your request promptly or inform you if we require further information in order to fulfil your request. 

We may not always be able to fully address your request, for example if it would impact the duty of confidentiality we owe to others, or if we are legally entitled to deal with the request in a different way.

Core Speech and Language is registered with the ICO, their reference number is ZA516392

.

1. COOKIES

Our website uses cookies. Please refer to our Cookie Policy by clicking here.

1. CHANGES TO THIS NOTICE

Any changes we make to our Notice in future will be posted here on our website. We encourage you to check this link whenever you use the website for any updates or changes.

We hope you find this document helpful. If your questions have not been answered please contact Carolyn Smith data controller at carolyn@corespeechandlanguage.com  for further information.

ICO number ZA516392

Version as at April 2019