Privacy Policy
Privacy Policy
Chloë Hall Speech and Language Therapy
Chloë Hall Speech and Language Therapy is committed to protecting the privacy, confidentiality and security of the personal information entrusted to me.
I am registered with the Information Commissioner’s Office (ICO) as a Data Controller and am responsible for deciding how personal information is collected, used and stored within my independent practice.
This Privacy Policy explains what information I collect, why I need it, how it is used and stored, who it may be shared with and the rights you have in relation to your information.
Information I collect
To provide Speech and Language Therapy services, I may need to collect and process information about your child and family.
This may include:
- names, addresses, telephone numbers and email addresses
- your child’s date of birth
- parent or guardian details
- developmental and medical history
- information about your child’s speech, language and communication
- assessment results, clinical observations, therapy notes and reports
- relevant educational information, including information provided by nurseries and schools
- details of other professionals involved in your child’s care
- correspondence relating to your child’s assessment or therapy
- photographs, audio or video recordings where these are clinically appropriate and consent has been obtained
- appointment and attendance information
- invoices, payment records and other financial information
Some of this information, particularly information relating to health and development, is classed as special category dataunder UK data protection law and requires additional protection.
Where information comes from
Most information is provided directly by parents or carers, for example when making an enquiry, completing a case history questionnaire or during assessment and therapy.
With appropriate consent, I may also receive relevant information from other people involved with your child, such as nursery or school staff, Speech and Language Therapists, healthcare professionals or other professionals.
Why I use personal information
Personal information is used where necessary to:
- respond to enquiries and arrange appointments
- provide Speech and Language Therapy assessment and intervention
- maintain appropriate clinical records
- analyse assessment findings and monitor progress
- plan therapy and prepare appropriate resources
- provide recommendations and information to families
- communicate with schools, healthcare professionals and other relevant professionals where appropriate
- manage appointments and communication
- prepare invoices and maintain financial records
- meet my professional, safeguarding, insurance, legal and regulatory responsibilities
Lawful basis for processing information
Under UK data protection law, I must have a lawful basis for processing personal information.
For personal information needed to respond to enquiries and provide Speech and Language Therapy services, I generally rely on Article 6(1)(b) of the UK GDPR, as the processing is necessary to take steps at your request before entering into a contract or to provide the service agreed with you.
Where processing is necessary to meet a legal obligation, I may rely on Article 6(1)(c) of the UK GDPR.
Information about health, development and communication is special category data. For clinical information needed to provide Speech and Language Therapy assessment, treatment and care, I rely on Article 9(2)(h) of the UK GDPR and the relevant provisions of the Data Protection Act 2018 relating to health and social care. I process this information in my capacity as a registered health professional and am subject to a professional duty of confidentiality.
In some circumstances I may also need to process or share information to meet a legal obligation, protect someone’s vital interests or fulfil safeguarding responsibilities.
Consent may be sought for particular activities, such as sharing information with another professional or making and using photographs, audio or video recordings. Where processing is based on consent, you may withdraw that consent.
How information is stored and protected
I take reasonable technical and organisational measures to protect personal information from loss, inappropriate access, alteration or disclosure.
WriteUpp is my primary electronic clinical record system and is used to manage client records, case history and consent information, appointments and clinical documentation.
Some larger clinical documents, such as scanned assessment records that cannot be accommodated within WriteUpp, may be securely stored within a dedicated business Google Drive account with restricted access.
Other secure electronic systems may be used where necessary during my work, including:
- iCloud Mail for professional email communication
- WhatsApp Business, using a dedicated work number, for communication with families and professionals
- FreeAgent for invoicing, accounting and financial records
- password-protected devices and secure cloud storage for necessary working documents
Where temporary working copies of clinical information are created, these are retained only for as long as they are required and are securely deleted when no longer needed.
Access to clinical information is restricted and accounts and devices containing confidential information are protected using appropriate security measures.
Photographs, audio and video
Occasionally, photographs, audio or video recordings may be clinically useful, for example when analysing speech or communication.
Recordings will only be made where appropriate consent has been obtained.
Recordings made for clinical analysis are deleted when that analysis has been completed unless there is a specific reason and appropriate consent for them to be retained.
On occasion, a recording from a session may be shared with a child’s parent or carer, for example to demonstrate progress or support practice at home. My copy will be deleted when it is no longer required for its clinical purpose.
Recordings will not be used for teaching, publicity or other purposes without separate consent.
Email, messaging and online meetings
I may communicate with families and relevant professionals by email, telephone, WhatsApp Business or SMS.
Where appropriate, meetings may also take place using platforms such as Microsoft Teams or Zoom. Client meetings conducted through these platforms are not routinely recorded.
Electronic communication can never be completely risk-free. I therefore take reasonable steps to minimise the amount of identifiable clinical information shared and to use secure methods where appropriate.
Use of Artificial Intelligence (AI)
I may use artificial intelligence tools to support aspects of my professional work, for example to help develop therapy resources, explore ideas, organise information or assist with drafting materials.
I do not enter client-identifiable or reasonably re-identifiable clinical information into general-purpose AI tools. Names, dates of birth, addresses, school names and other identifying information are removed, together with combinations of information that could reasonably identify an individual.
I do not upload client photographs, audio or video recordings, identifiable assessment materials or identifiable clinical documents to general-purpose AI systems.
AI is used as a supporting tool and does not replace professional judgement. I remain responsible for reviewing and verifying AI-assisted content and for all clinical decisions, recommendations and records relating to my clients.
Sharing information
I treat information about clients and families as confidential.
With appropriate consent, relevant information may be shared with people involved in supporting your child, such as nursery or school staff, healthcare professionals or other Speech and Language Therapists.
I will only share information that is relevant and necessary for the purpose concerned.
There are limited circumstances in which information may need to be shared without consent, for example where:
- I am required to do so by law
- there is a safeguarding concern
- disclosure is necessary to protect a child or another person from serious harm
- information is required by an appropriate regulatory or legal authority
Organisations that process information on my behalf
I use a small number of third-party services to support the running of my practice. These may include:
- WriteUpp – clinical records and practice management
- Google Drive – secure storage of some clinical documents
- Apple/iCloud – professional email and secure electronic services
- FreeAgent – invoicing and financial administration
- WhatsApp Business – professional communication
- Microsoft Teams or Zoom – occasional online professional meetings
I select third-party services with consideration for their privacy, security and data-protection arrangements. Where these organisations process personal information on my behalf, I remain responsible for ensuring that appropriate data-protection arrangements are in place.
I do not sell client information or provide it to organisations for marketing purposes.
How long information is kept
Clinical records relating to children are normally retained until the child’s 25th birthday, or 26th birthday where the child was 17 when treatment ended, in line with professional record-retention guidance.
Records may be retained for longer where there is a legal, safeguarding, insurance or other professional reason to do so.
At the end of the relevant retention period, records will be reviewed and, where no longer required, securely deleted or confidentially destroyed.
Financial records are retained for the period required by HM Revenue & Customs.
Your rights
Under UK data protection law, you have rights relating to your personal information. Depending on the circumstances, these may include the right to:
- be informed about how your information is used
- request access to personal information held about you or your child
- ask for inaccurate information to be corrected
- ask for information to be erased in certain circumstances
- ask for processing to be restricted in certain circumstances
- object to certain uses of personal information
- withdraw consent where consent is the basis on which information is being processed
Some rights are subject to legal and professional requirements and may not apply in every circumstance.
If you would like to exercise any of these rights, please contact me using the details below.
Concerns or complaints about your information
If you have any questions or concerns about how your personal information is handled, please contact me in the first instance so that I can investigate your concerns.
You also have the right to raise a concern with the Information Commissioner’s Office (ICO), the UK’s independent regulator for data protection.
Changes to this Privacy Policy
I may update this Privacy Policy from time to time to reflect changes in my practice, technology, professional guidance or legal requirements.
The current version will be available on my website.
Contact
Chloë Hall Speech and Language Therapy
Email: Email Chloë
Telephone: Show number