Privacy Policy - SpeechWise Therapy

Privacy Notice

This privacy notice is in three parts:

Part 1 lets you know what happens to any personal data that you may give to us about a child or Young Person (YP), or any that we may collect from or about a child/YP when we are providing them with Speech and Language Therapy (SALT) support.

Part 2 relates to data we may collect and store data about people working in and around any school/organisations that we work with to provide Speech and Language Therapy Services.

Part 3 gives information on what happens to any personal data you may give us when you subscribe to or make a purchase from our online training hub.

Part 1: Privacy Notice – Personal Data of Children/Young People

This privacy notice applies to a child/YP’s personal information processed to, by or on behalf of SpeechWise Ltd for use when providing SALT services.

This Notice explains:

The information that we collect and use

The reason why we collect this information

Keeping a child/YP’s information safe and secure

Where we store a child/YP’s information

How we use a child/YP’s information

Who we share a child/YP’s information with

Deciding not to share a child/YP’s information

How long we store a child/YP’s information for

Accessing a child/YP’s information

Changes to a child/YP’s personal Information

Complaints or Objections

Introduction

The General Data Protection Regulation (GDPR) came into force on 25th May 2018. This is a regulation about the protection of any confidential and sensitive information.

This Notice explains how we collect and process a child/YP’s personal data and how we meet our obligations to a child/YP.

As a Speech and Language Service working with a child/YP, we are the data controller for any personal data that we hold about a child/YP.

We are committed to protecting a child/YP’s privacy and will only use information collected lawfully in accordance with:

Data Protection Act 2018
The General Data Protection Regulations 2016
Human Rights Act 1998
Common Law Duty of Confidentiality
Health and Social Care Act 2012
HCPC Guidelines on Confidentiality, Information Security and Records Management
Caldicott Principles
Information sharing principle – To Share or Not to Share Review

The information that we collect and use

When a child/YP is registered with SpeechWise we must collect basic ‘personal data’ about them. This includes their name, address, contact details for parents/carers such as email and mobile. We may also ask a parent/carer or a child/YP’s school for health information, ethnicity and educational information. This type of information is called ‘Special data’. We are required to do this to ensure that our assessment and care for a child/YP is appropriate to their needs.

We may collect the following types of information from a child/YP or about a child/YP from a third party for example a school or NHS Speech Therapy Department:

Details about a child/YP, such as address, persons with parental responsibility, emergency contact details
Notes and reports about a child/YP’s health and education
Details about a child/YP’s treatment and care
Results of investigations such as hearing tests etc.
Relevant information from other health or educational professionals, relatives or those who care for a child/YP
A child/YP’s records will be retained in accordance with the Royal College of Speech and Language Therapists and Health Care Professions Council guidelines on information governance and the Data Protection Action 2018

The reason why we collect this data

In order to provide the right kind of support for a child/YP, we need to collect and keep information about them on our records. A child/YP’s records are used to:

Provide information to make decisions about their Speech, Language and Communication needs
Make sure any intervention provided is as effective as possible
Work with others providing your with support

We also may use, or share, a child/YP’s information for the following purposes:

Making sure that our service can meet patient needs in the future
Reporting back to schools on outcomes of our service. If this information goes outside of a child/YP’s school, it will be anonymised so no personal data is included
Investigating concerns, complaints or legal claims
Helping staff to review the care they provide to make sure it is of the highest standards
Training and educating staff

The Speech and Language Therapist(s) who provide a child/YP with care must maintain records about their communication, health and educational needs and any treatment or care they have received previously. This information may come from or be shared with (with your consent) an NHS or Local Authority Service, or another private provider. These records help to provide a child/YP with the best possible Speech and Language Therapy Support.

We need to know a child/YP’s personal, sensitive and confidential data so that we can provide a child/YP with Speech and Language Therapy Services. Under the new rules called General Data Protection Regulation (GDPR) we will be using a child/YP’s data within the following regulations:

Protect a child/YP’s vital interests as a provider of Speech and Language Therapy Services
Legal obligations
Contractual obligations

Keeping a child/YP’s information safe and secure

Every member of staff who works for SpeechWise has a legal obligation to keep information about a child/YP confidential. We maintain our duty of confidentiality by conducting regular training and awareness, ensuring access to personal data is limited to the appropriate staff and information is only shared with organisations and individuals that have a legitimate and legal basis for access.

SpeechWise records may be electronic, on paper or a mixture of both. Our electronic patient records are processed by a third party processor. The software used is called Writeupp provided by Pathway Software, who we work with to ensure that records are kept securely and confidentiality is safeguarded.

Their Privacy Notice can be viewed here:

https://www.writeupp.com/privacy-policy/

Details on their security measures and compliance with the Data Protection Act 2018 can be found here:

https://www.writeupp.com/secure/

We also keep some documents containing personal information, such as reports and therapy programmes within Google Workspace. This is a secure cloud-based system specifically designated to SpeechWise, to which only our staff have access via a secure login. It is provided by Google and more information can be found here about their security measures:

https://support.google.com/a/answer/10209882

We will only ever use or pass on information about a child/YP if others involved in their care have a genuine need for it.

We will not disclose a child/YP’s information to any third party without your permission unless there are exceptional circumstances (i.e. if they are at serious risk of harm), where the law requires information to be passed on.

Our SpeechWise policy is to respect the privacy of our patients and their families, the schools/organisations and colleagues we work with and our staff and to maintain compliance with the General Data Protection Regulations (GDPR) and all UK specific Data Protection Requirements.

All the personal data we hold about a child/YP is processed in the EU.

We are registered with the Information Commissioners Office, who are an independent organisation designed to protect people’s rights regarding their personal information.

Where we store a child/YP’s information

A child/YP’s information is collected electronically using a secure system provided by Pathway Software (see above). We also keep some documents containing personal information, such as reports and therapy programmes within Google Workspace. This is a designated SpeechWise online workspace to which only our staff have access via a secure login.

How we use a child/YP’s information

We will only use a child/YP’s information to inform the care we provide for them and to report back to other professionals involved with a child/YP, which may include a child/YP’s school. We will not share it with a third party unless we have your consent, except for instances where the law requires us to do so to prevent a child suffering significant harm.

Who we share a child/YP’s information with

We may also share a child/YP’s information, subject to strict agreements on how it will be used, with the following organisations;

NHS Trusts / Foundation Trusts
GP’s
Community services such as school nurses, Audiology
Child health services that undertake routine treatment or health screening
Community hospitals
Mental Health Trusts
Hospitals
Social Care organisations
Independent Contractors such as dentists, opticians, pharmacists
Private Sector Providers
Voluntary Sector Providers
Local Authorities
Education Services
Police & Judicial Services
Voluntary Sector Providers
Other ‘data processors’ which a parent/carer will be informed of

A child/YP’s information will only be shared if we have consent to do so and it is for the provision of a child/YP’s care or required for our statutory function and legal obligations.

If a parent/carer decides not to share a child/YP’s Information (Opting –Out)

A parent/carer has the right to withdraw consent at any time for any particular instance of processing, provided consent is the legal basis for the processing. Please contact SpeechWise for further information and to raise your objection.

Right to object: If we are using a child/YP’s data because it is necessary for our legal requirements to do so, and a parent/carer does not agree, they have the right to object. We will respond to the request within 30 days (although we may be allowed to extend this period in certain cases). Generally, we will only disagree with a parent/carer if certain limited conditions apply.
Right to withdraw consent: Where we have obtained your consent to process a child/YP’s personal data for certain activities (for example for a research project), a parent/carer may withdraw consent at any time.

How long will we store a child/YP’s information?

We will hold a child/YP’s information in accordance with the requirements laid out by Records Management Code of Practice for Health and Social Care 2016 and our professional bodies; the Royal College of Speech and Language Therapists and the Health Professions Council. This retention period is up until the child’s 25th birthday or 26th birthday if 17 years old at the conclusion of their treatment. This retention period ensures that we are compliant with section 7 of the Data Protection Act 2018; the ‘Right to Access’ (also called ‘Subject Access’) – that a child has the right to access their records once they become an adult.

Access to a child/YP’s personal information

The General Data Protection Regulations allows a parent/carer to find out what information is held about a child/YP including information held within any kind of health records, either in electronic or physical format. This is known as a ‘Subject Access Request ‘

A parent/carer also has the right to have it amended should it be inaccurate or erased entirely. These situations are called:

Right to rectify: In certain situations a parent/carer has the right to request us to amend things that are incorrect within a child/YP’s personal data. We will respond to your request within 30 days (although we may be allowed to extend this period in certain cases) and will only disagree with a parent/carer if certain limited conditions apply.

Right to erasure: In certain situations a parent/carer has the right to request us to “erase” a child/YP’s personal data. We will respond to your request within 30 days (although we may be allowed to extend this period in certain cases) and will only disagree with a parent/carer if certain limited conditions apply. It is important to note that the Data Protection Act 2018 (Article 9, section (2)(h) says that the right to be forgotten/erased does not apply when data is processed for Health or Social Care purposes. Speech and Language Therapists are Healthcare Professionals (registered with the Health Care Professions Council), so the information we process about a child is considered to be a Health Record.

In order to request access to a child/YP’s information, a parent/carer needs to do the following:

Your request must be made in writing to:

Ele Leatherbarrow

Director

SpeechWise Ltd
Stockport Business & Innovation Centre
3rd Floor Broadstone Mill
Stockport
SK5 7DL

For information from the school a parent/carer should write direct to them
We are required to respond to a parent/carer within 30 days
A parent/carer will need to give adequate information (for example full name, address, date of birth) and details of your request
We will also ask a parent/carer to provide additional information before we release information to a parent/carer

A parent/carer should however be aware that some details in a child/YP’s records may not be able to be given to a parent/carer. This will be in the interests of a child/YP’s wellbeing or to protect the identity of a third party.

What should a parent/carer do if a child/YP’s personal information changes?

It is important that a parent/carer tell a child/YP’s Speech and Language Therapist if any of a child/YP’s details such as a child/YP’s name or address have changed or if any of their details such as date of birth is incorrect in order for this to be amended. A parent/carer has a responsibility to inform us of any changes so our records are accurate and up to date for a parent/carer.

Objections / Complaints

Should a parent/carer have any concerns about how a child/YP’s information is managed at SpeechWise please contact the Director. If a parent/carer is still unhappy following a review by the SpeechWise, a parent/carer has a right to lodge a complaint with the Information Commissioner.

Information Commissioner:

Wycliffe house

Water Lane

Wilmslow

Cheshire

SK9 5AF

Tel: 0303 123 1113 (local rate) or 01625 545 745 if a parent/carer prefer to use a national rate number

www.informationcommissioner.gov.uk

If you are happy for a child/YP’s data to be extracted and used for the purposes described in this privacy notice, then you do not need to do anything. If you have any concerns about how a child/YP’s data is shared, then please contact the Director & Data Protection Officer of SpeechWise.

If you would like to know more about your rights in respect of the personal data we hold about a parent/carer, please contact the Data Protection Officer as below.

Data Protection Officer:

The Practice Data Protection Officer is Ele Leatherbarrow, Director.

Registration Number: ZA375187

Any queries in regard to Data Protection issues should be addressed to:

hello@speechwisetherapy.co.uk

Changes:

It is important to point out that we may amend this Privacy Notice from time to time. If you are dissatisfied with any aspect of our Privacy Notice, please contact the Data Protection Officer.

Part 2: Privacy Notice for Schools, Organisations or Professionals working with SpeechWise

This privacy notice lets you know what happens to any data that you give to us about you or people working in and around your school/organisation, or any that we may collect from you or about people in your school/organisation. This includes information that we collect and process on SpeechWise staff/workers. For information on what happens to personal data that we collect on children/Young People who we have provided with or are providing with Speech and Language Therapy Support, please refer to our ‘Privacy Notice – Personal Data of Children/Young People’.

This privacy notice applies to personal information processed by or on behalf of SpeechWise Ltd.

This Notice explains:

The information that we collect and use

The reason why we collect this information

Keeping personal information safe and secure

Where we store personal information

How we use personal information

Who we share personal information with

Deciding not to share personal information

How long we store personal information for

Accessing personal information

Changes to personal Information

Complaints or Objections

Introduction

The General Data Protection Regulation (GDPR) came into force on 25th May 2018. This is a regulation about the protection of any confidential and sensitive information.

This Notice explains how we collect and process personal data and how we meet our obligations to the schools/organisations and professionals we work with

As a Speech and Language Service, we are the data controller for any personal data that we hold about you or people in your school/organisation.

We are committed to protecting your privacy and that of the people we work with and will only use information collected lawfully in accordance with:

Data Protection Act 2018
The General Data Protection Regulations 2016
Human Rights Act 1998

The information that we collect and use

When you or your school/organisation is working with SpeechWise we must collect basic ‘personal data’ about the people we are working with. This includes their name, work or home address and contact details such as email and mobile.

The reason why we collect this data

In order to run our service efficiently and keep appropriate employment records, we need to collect and keep information about the people we are working with. Personal information is used to:

Work jointly to make decisions about the service provided to your school/organisation
Share information on children/Young People we are working with jointly
Work together with other services who are working in your school/organisation

We also may use, or share, personal information for the following purposes:

Making sure that our service can meet patient needs in the future
Reporting back to schools on outcomes of our service. If this information goes outside of your school/organisation, we will seek your consent and it will be anonymised so no identifying details are included
Investigating concerns, complaints or legal claims
Helping staff to review the care they provide to make sure it is of the highest standards
Training and educating staff

In the case of SpeechWise staff/workers, it is used to keep accurate employment records and perform necessary recruitment checks.

We need to know personal, sensitive and confidential data so that we provide Speech and Language Therapy Services. Under the new rules called General Data Protection Regulation (GDPR) we will be using personal data within the following regulations:

Protect your the vital interests of the children/Young People we work with as a provider of Speech and Language Therapy Services
Legal obligations
Contractual obligations

Keeping personal information safe and secure

Every member of staff who works for SpeechWise has a legal obligation to keep personal information confidential. We maintain our duty of confidentiality by conducting regular training and awareness, ensuring access to personal data is limited to the appropriate staff and information is only shared with organisations and individuals that have a legitimate and legal basis for access.

We will not disclose personal information to any third party without your permission unless there are exceptional circumstances (i.e. if a child or Young Person is likely to be at serious risk of harm), where the law requires information to be passed on.

Our SpeechWise policy is to respect the privacy of patients and their families, the schools/organisations and colleagues we work with and our staff, and to maintain compliance with the General Data Protection Regulations (GDPR) and all UK specific Data Protection Requirements.

Where we store personal information

SpeechWise records pertaining to schools and the people who work in/with them may be electronic, on paper or a mixture of both. We also keep some documents containing personal information, such as reports and therapy programmes within Google Workspace. This is a secure cloud-based system specifically designated to SpeechWise, to which only our staff have access via a secure login. It is provided by Google and more information can be found here about their security measures:

https://support.google.com/a/answer/10209882

For information on the records held for the children/Young People we work with, please see ‘Privacy Notice – Personal Data of Children/Young People’.

Any paper records are stored securely by Speech and Language Therapist and/or retained at our Head Office at the above address.

We are registered with the Information Commissioners Office, who are an independent organisation designed to protect people’s rights regarding their personal information.

How we use personal information

We will only use personal information to inform the service we provide and to report back to other professionals involved with your school/organisation. We will not share it with a third party unless we have consent, except for instances where we feel a child/Young Person may be likely to suffer significant harm if we do not.

Who we share personal information with

We may also share personal information, subject to strict agreements on how it will be used, with the following organisations;

NHS Trusts / Foundation Trusts
GP’s
Community services such as school nurses, Audiology
Child health services that undertake routine treatment or health screening
Community hospitals
Mental Health Trusts
Hospitals
Social Care organisations
Independent Contractors such as dentists, opticians, pharmacists
Private Sector Providers
Voluntary Sector Providers
Local Authorities
Education Services
Police & Judicial Services
Voluntary Sector Providers
Other ‘data processors’ which you will be informed of

Personal information will only be shared if it is for the provision of personal care for a child/Young Person or required for our statutory function, legal or contractual obligations.

If you decide not to share personal Information (Opting –Out)

Any individual has the right to withdraw consent at any time for any particular instance of processing, provided consent is the legal basis for the processing. Please contact SpeechWise for further information and to raise your objection.

Right to object: If we are using personal data because it is necessary for our legal requirements to do so, and you do not agree, you have the right to object. We will respond to your request within 30 days (although we may be allowed to extend this period in certain cases). Generally, we will only disagree with you if certain limited conditions apply.
Right to withdraw consent: Where we have obtained your consent to process personal data for certain activities (for example for a research project), you may withdraw your consent at any time.

How long will we store personal information?

We will hold personal information only for as long as it is necessary for us to carry out the service in your school. We will retain contact details for you or key people in your school/organisation for 3 years following the end of the contract. With your consent we may retain anonymised information on the service provided and outcomes measured for an indefinite period.

Employment records for SpeechWise staff/workers will be retained for 5 years.

Access to personal information

The General Data Protection Regulations allows an individual to find out what information is held about them. This is known as a ‘Subject Access Request ‘

They also have the right to have it amended should it be inaccurate or erased entirely. These situations are called:

Right to rectify: In certain situations individuals have the right to request us to amend things that are incorrect within your personal data. We will respond to a request within 30 days (although we may be allowed to extend this period in certain cases) and will only disagree if certain limited conditions apply.
Right to erasure: In certain situations individuals have the right to request us to “erase” personal data. We will respond to a request within 30 days (although we may be allowed to extend this period in certain cases) and will only disagree with you if certain limited conditions apply.

In order to request access to personal information, you need to do the following:

Your request must be made in writing to:

Ele Leatherbarrow

Director

SpeechWise Ltd

Stockport Business & Innovation Centre

3rd Floor Broadstone Mill

Stockport

SK5 7DL

We are required to respond to you within 30 days
You will need to give adequate information (for example full name, address, date of birth) and details of your request
We will also ask you to provide additional information before we release information to you

interests of personal wellbeing or to protect the identity of a third party.

What should you do if personal information changes?

It is important that you tell us if any of the details we hold about you change, such as name or contact details. You have a responsibility to inform us of any changes so our records are accurate and up to date.

Objections / Complaints

Should you have any concerns about how personal information is managed at SpeechWise please contact the Director. If you are still unhappy following a review by SpeechWise, you have a right to lodge a complaint with the Information Commissioner.

Information Commissioner:

Wycliffe house
Water Lane
Wilmslow
Cheshire
SK9 5AF

Tel: 0303 123 1113 (local rate) or 01625 545 745 if you prefer to use a national rate number

www.informationcommissioner.gov.uk

If you are happy for your data to be extracted and used for the purposes described in this privacy notice, then you do not need to do anything. If you have any concerns about how your data is shared, then please contact the Director & Data Protection Officer of SpeechWise.

If you would like to know more about your rights in respect of the personal data we hold about you, please contact the Data Protection Officer as below.

Data Protection Officer:

SpeechWise Protection Officer is Ele Leatherbarrow, Director.

Registration Number: ZA375187

Any queries in regard to Data Protection issues should be addressed to:

hello@speechwisetherapy.co.uk

Changes:

It is important to point out that we may amend this Privacy Notice from time to time. If you are dissatisfied with any aspect of our Privacy Notice, please contact the Data Protection Officer.

Part 3: Privacy Notice For On-Demand Training Hub

This privacy notice lets you know what happens to any data that you give to us through our on-demand training hub about you or people working in and around your school/organisation, or any that we may collect from you or about people in your school/organisation. This included personal information collected both for 1-off purchases, individual subscriptions and whole school/organisation subscriptions. This privacy notice applies to personal information processed by or on behalf of SpeechWise Ltd.

This Notice explains:

The information that we collect and use
The reason why we collect this information
Keeping personal information safe and secure
Where we store personal information
How we use personal information
Who we share personal information with
Deciding not to share personal information
How long we store personal information for
Accessing personal information
Changes to personal Information
Complaints or Objections

Introduction

The General Data Protection Regulation (GDPR) came into force on 25th May 2018. This is a regulation about the protection of any confidential and sensitive information.

This Notice explains how we collect and process personal data and how we meet our obligations to anyone who uses our on-demand training hub

As a Speech and Language Service and training provider, we are the data controller for any personal data that we hold about you or people in your school/organisation.

We are committed to protecting your privacy and that of the people we work with and will only use information collected lawfully in accordance with:

Data Protection Act 2018
The General Data Protection Regulations 2016
Human Rights Act 1998

The information that we collect and use

When you or your school/organisation subscribe to or purchase anything from the SpeechWise On-Demand Training Hub we must collect basic ‘personal data’ about the people who have access. This includes their name, work or home address and contact details such as email and mobile.

The reason why we collect this data

In order to provide the service, we need to collect and keep information about the people who are accessing it. Personal information is used to:

Provide you with a login for you to access your account
Allow us to monitor your account, users, subscription and activity to ensure that users have access to what they need
Enable us to contact you about your subscription and provide support with any issues
Allow us to identify any problems with the system or users

Under the General Data Protection Regulation (GDPR) rules we will be using personal data within the following regulations:

Legal obligations
Contractual obligations

Keeping personal information safe and secure

Our SpeechWise policy is to respect the privacy of patients and their families, the schools/organisations, colleagues and customers we work with and our staff, and to maintain compliance with the General Data Protection Regulations (GDPR) and all UK specific Data Protection Requirements.

Where we store personal information

Any data you provide us with will be stored within our training hub, which is hosted on a dedicated server provided by UKFast. This is a high-security UK-based data centre built on enterprise-grade infrastructure. Further information about this can be found here: https://www.ukfast.co.uk/why-ukfast/our-data-centres/

We are registered with the Information Commissioners Office, who are an independent organisation designed to protect people’s rights regarding their personal information.

How we use personal information and who we share it with

We will not use, or share, personal information for any purpose other than to ensure your access to the training hub and our own monitoring of the training hub use. We will not share your information with any third party without your permission unless there are exceptional circumstances (e.g. if a child or Young Person is likely to be at serious risk of harm), where the law requires information to be passed on.

If you decide not to share personal Information (Opting –Out)

Right to object: If we are using personal data because it is necessary for our legal requirements to do so, and you do not agree, you have the right to object. We will respond to your request within 30 days (although we may be allowed to extend this period in certain cases). Generally, we will only disagree with you if certain limited conditions apply.
Right to withdraw consent: Where we have obtained your consent to process personal data for certain activities (for example for a research project), you may withdraw your consent at any time.
How long will we store personal information?

We will hold personal information only for as long as it is necessary for us to provide the subscription and/or purchase. We will retain contact details for you or key people in your school/organisation for 3 years following the end of the subscription or purchase.

Access to personal information

The General Data Protection Regulations allows an individual to find out what information is held about them. This is known as a ‘Subject Access Request ‘

They also have the right to have it amended should it be inaccurate or erased entirely. These situations are called:

Right to rectify: In certain situations individuals have the right to request us to amend things that are incorrect within your personal data. We will respond to a request within 30 days (although we may be allowed to extend this period in certain cases) and will only disagree if certain limited conditions apply.

Right to erasure: In certain situations individuals have the right to request us to “erase” personal data. We will respond to a request within 30 days (although we may be allowed to extend this period in certain cases) and will only disagree with you if certain limited conditions apply.

In order to request access to personal information, you need to do the following:

Your request must be made in writing to:

Ele Leatherbarrow

Director

SpeechWise Ltd

Stockport Business & Innovation Centre
3rd Floor Broadstone Mill
Stockport
SK5 7DL

We are required to respond to you within 30 days
You will need to give adequate information (for example full name, address, date of birth) and details of your request
We will also ask you to provide additional information before we release information to you

interests of personal wellbeing or to protect the identity of a third party.

What should you do if personal information changes?

Objections / Complaints

Information Commissioner:

Wycliffe house
Water Lane
Wilmslow
Cheshire
SK9 5AF

Tel: 0303 123 1113 (local rate) or 01625 545 745 if you prefer to use a national rate number

www.informationcommissioner.gov.uk
If you are happy for your data to be extracted and used for the purposes described in this privacy notice, then you do not need to do anything. If you have any concerns about how your data is shared, then please contact the Director & Data Protection Officer of SpeechWise.

If you would like to know more about your rights in respect of the personal data we hold about you, please contact the Data Protection Officer as below.

Data Protection Officer:

SpeechWise Protection Officer is Ele Leatherbarrow, Director.

Registration Number: ZA375187

Any queries in regard to Data Protection issues should be addressed to:

hello@speechwisetherapy.co.uk

Changes:

It is important to point out that we may amend this Privacy Notice from time to time. If you are dissatisfied with any aspect of our Privacy Notice, please contact the Data Protection Officer.