This privacy notice tells you what to expect us to do with your personal information.

We collect, store and process personal information for the purpose of providing independent Occupational Therapy services. 

Benjamin Newton is the person responsible for data protection.

Our contact details:

This email is in picture form to protect from spam. It reads enquiry at ndkids dot co dot uk

We are registered with the Information Commissioner’s Office – registration number ZB958682.

What information we collect, use, and why

We collect personal information to provide Occupational Therapy services. We also collect health information, and may collect information of racial or ethnic origin and sexual orientation. This information is subject to additional protection due to its sensitive nature. The information we process includes:

Therapy services to children and families

  • Parent / Carer’s name, address, email address, phone number, gender and pronoun preference
  • Who has parental consent
  • Parent / Carer’s support or access needs you have, any neurodivergence you or close family members may have
  • Name, role and contact details for professionals involved (i.e. teachers, health professionals, local authority staff).
  • Child’s name, address and date of birth, gender and pronoun preference
  • Unique identifiers such as NHS number
  • Child’s developmental history, diagnosis and relevant health conditions, medication and dietary requirements, disabilities and support needs.
  • Information about the child’s education including the name of their educational setting and class, additional needs and associated documentation including EHCPs.
  • Information about professionals involved including any reports or correspondence from professionals.
  • Records of meetings and decisions including audio and video recordings.
  • Notes from therapy sessions including assessments and reports.
  • Any videos or voice notes you have supplied.
  • Work produced by the child during assessment / sessions and samples of work or handwriting you provide.
  • Correspondence.
  • Payment details – we do not receive or store your credit card details. Credit card payments are handled by Square in accordance with their data security policies. We will receive limited information from Square to match your payment with your invoice. If you pay by bank transfer, we will receive only the information provided by the bank – normally the name of the person paying, the amount and any reference number.

Website Users

We process the following information to protect our website:

  • Location
  • IP address

Clinical Supervision Clients

We process the following information:

  • Name, address, phone number, email address and date of birth, gender and pronoun preference of supervisee.
  • Your OT role / job title and responsibilities.
  • Any support or access needs you have.
  • No personal identifiable data of your clients is used, collected or stored.

Marketing

If you opt in to marketing, we collect or use the following personal information for information updates, marketing or market research purposes:

  • Names and contact details
  • Marketing preferences
  • IP addresses
  • Records of consent

How do we get the personal information and what do we do with it?

Therapy services to children and families

Information is either provided by parents, guardians, or professionals working with your child. We use the information gathered to:

  • Contact you regarding appointments, general communication, sending you reports and recommendations, sending you invoices.
  • Manage our appointment diary.
  • Plan and carry out Occupational Therapy assessment and support for your child.
  • Write a report with our findings and recommendations.
  • Keep accurate records as required by the professional organisations – the Health Care Professions Council and the Royal College of Occupational Therapists.
  • Make referrals to other agencies with your permission (unless there is a safeguarding concern in which case permission may not be asked and does not have to be given. Any safeguarding concerns will be shared with the school.)

Clinical Supervision Clients

  • The supervisee provides the information. We use the information to provide supervision services.

Lawful bases and data protection rights

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. Which lawful basis we rely on may affect your data protection rights which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website.

Under data protection law, you have rights including:

  • Your right of access – You have the right to ask us for copies of your personal information. Parents or carers have the right to ask for the child’s personal information.
  • Your right to rectification – You have the right to ask us to put right any information that you think is wrong. You have the right to ask us to complete any information that you think is missing. 
  • Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances.
  • Your right to object to processing – You have the right to object to the processing of your personal information in certain circumstances. (This data right doesn’t apply if we are using ‘contract’ as the lawful basis of processing your data. It doesn’t apply to if we are using ‘consent’ as the lawful basis of processing but you do have the right to withdraw your consent at any time).
  • Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances. (This data right doesn’t apply if we are using the ‘legitimate interest’ as the lawful basis for your data.)
  • Your right to erasure – Although GDPR provides for the right to be forgotten, health data falls under one of the special categories where the right to erasure does not apply. This is because health professionals have a legal obligation to retain health records.

For supervisees: guidance produced by the College of Occupational Therapists (2015) is followed:

“The record, when complete, should be agreed by both parties and a copy may be held by each person. Supervision records need to be kept confidential, with the proviso that if access is needed for the purpose of public interest, this should be enabled. Decisions made in a supervision meeting concerning the care provided to a service user can be seen as part of the care process. Such decisions need to be recorded in the care records (COT 2010b, section 2.2). Identifiable service user information should not be recorded within supervision records. If cases are discussed, these need to be anonymised in any supervision record”.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

Our lawful bases for collecting or using personal information to provide occupational therapy services are:

  • Contract – we have to process information so we can enter into or carry out a contract with you.
  • Legitimate interests – process your information or that of a child’s because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone e.g. we gather information at the inquiry stage to determine if therapy services are appropriate; gather assessment information; share advice with others; share safeguarding information. We have a legitimate interest in collecting, processing and retaining all data provided as we cannot provide a therapy service without processing your and your child’s personal information. This is managed according to: HealthCare Professions Council (HCPC) standards, the Royal College of Occupational Therapists (RCoT) Professional standards, and the principles of the Caldicott Guidelines, 2013.
  • Consent – we use your personal information for service updates, marketing or market research purposes after you consented and opted in to this and we gave you all the relevant information. Please note, we may send important privacy policy updates to you without consent to ensure we uphold your data protection rights.

Common law duty of confidentiality

Health information is subject to the duty of confidentiality. However, there are circumstances where we will share relevant health and care information. These are where:

  • You have provided us with your consent (we have taken it as implied to provide you with care, or you have given it explicitly for other uses);
  • We have a legal requirement (including court orders) to collect, share or use the data;
  • On a case-by-case basis, the public interest to collect, share and use the data overrides the public interest served by protecting the duty of confidentiality (for example sharing information with the police to support the detection or prevention of serious crime);

Who might I share your child’s or your information with?

Data processors

We share information with the following data processers who provide us with electronic services e.g. storing electronic notes securely, processing payments:

  • Pathway Software (UK) Limited trading as Writeup (electronic notes).
  • Squareup Europe Ltd. trading as Square (payments).
  • Pearson Education Limited (online assessments).
  • Proton AG (secure and encrypted emails).
  • Intuit Limited trading as MailChimp (marketing).
  • Heidi Health Trading Pty Limited (AI transcription).
  • Defiant Inc – trading as Word Fence (protecting our website).

We have data processing agreements in place with these organisations and we have undertaken due diligence. Proton AG and Defiant Inc are located outside of the UK. Proton AG is based in Switzerland and this has achieved an adequacy decision. Defiant Inc is based in USA and we rely on the UK Data Transfer Addendum we have entered into via a data processing addendum. We have also carried out a risk assessment to ensure your data rights are respected.

Therapy services to children and families

With your permission we may share information with other health or social care professionals e.g. GP, Speech and Language Therapist.

There may be rare instances where individuals disclose information where a serious criminal offence has been committed and this represents a threat to life. There may also be instances where individuals disclose information highlighting a risk to their own or other’s wellbeing. In these rare instances, information may be shared with appropriate authorities using the lawful basis of vital interests and in line with our Safeguarding Policy.

In the rare instances where there is a prospect of litigation, we may share personal information with third parties such as insurers and solicitors. We would rely on legitimate interests as the lawful basis for this.

Clinical Supervision Clients

Supervision records will be kept confidential except if there is a safeguarding concern or fitness to practice concern. For example, the HCPC could request supervision records as part of any fitness to practice hearing.

How do we keep your and your child’s information safe?

We look after your information carefully.As a professional therapist, registered with Health Care Professions Council and British Association of Occupational Therapists Faith Newton follows the record keeping and data protection standards set by these organisations. She is legally bound to keep client data confidential.

  • All records concerning you and the child are electronic and stored within the secure cIoud based server WriteUp.
  • Heidi does not record audio of any meetings or sessions, it produces a written transcript which is checked and uploaded securely.
  • Computer files are encrypted and stored on password protected secure cloud-based providers.
  • Emails containing personal information are sent using secure, encrypted email.
  • Our phones and laptops are password protected and securely locked in a car boot or not left unattended on school visits or in public places.

How long do we store information for?

Enquiries that are not followed up

Initial contact information is stored for three months. If you have not pursued further assessment or engagement by this time the enquiry will be deleted.

Inactive Clients

When a child is discharged or a supervisee ends supervision, their records will be archived.

Health Records

The Records Management Code of Practice for Health and Social Care 2016 states that children’s health records should be kept until the child reaches 25, or 26 if the child was 17 when the treatment ended. Records will be cleared annually in April, so records will be destroyed the first April after your child reaches 25 (or 26 if applicable). 

Files where an adult is the client (e.g. supervision, parent coaching with no direct work with the child) will be retained for 8 years in line with guidance.

Therapists Diary

The Records Management Code of Practice states that therapists’ diaries should be kept for 2 years. The diary is kept electronically on WriteUp.

Marketing

Until consent if withdrawn or we no longer require the information.

How do we safely dispose of your data?

Electronic records will be deleted. Any temporary paper notes are shredded using a high-quality shredder.

Further Information

This privacy policy provides an overview of our processes. Please contact us if you require more detailed information or have any questions. We have information on data flows, information assets etc. and balancing tests available on request.

Complaints

If you are still unhappy after contacting us, you can contact the Commissioner:

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow

Cheshire, SK9 5AF

0303 123 1113

https://www.ico.org.uk

August 2025