The Sensory Smart Child, LTD – Privacy Policy

Contact details:

Head Office: Unit 6 Walton Business Centre, 44-46 Terrace Road, Walton on Thames, Surrey KT12 2SD
Registered Office: Streathbourne House, Redehall Road, Smallfield, Surrey, RH6 9QA
Data Protection Officer: Karen Jane Garner

This practice keeps clinical records confidential and complies with the General Data Protection Regulation, a full description of which is available from the information commissioner’s office (ICO): www.ico.org.uk

The Sensory Smart Child, LTD acts as both a data controller and data processor, and processes personal data and Sensitive personal Data.

Personal data means any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier.
This definition provides for a wide range of personal identifiers to constitute personal data, including name, identification number, location data or online identifier, reflecting changes in technology and the way organisations collect information about people.

Sensitive personal data means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation
The Sensory Smart Child, LTD does not utilise automated decision making technologies, including profiling.

Our lawful bases for processing personal data are:

Legal obligation – We hold your child’s medical record and your contact details so that we can provide you child with safe care and treatment and are able to contact you regarding the same.

In accordance with the Information Governance Alliance, Records Management Code of Practice for Health and Social Care 2016 and The Royal College of Occupational Therapists Code of Practice, once you have commenced receipt of a service form us, we are legally obliged to securely store your child’s data, which includes contact information for their carer(s), until your child reaches the age of 25 (or 26 if they are 17 when treatment ends) at which point we will destroy all documentation.

Until your child is 25 (or 26 if they are 17 when treatment ends) years old we store the pre-assessment data you have provided, along with assessment data gathered in the session, formal assessment reports and therapy notes, important email correspondence and accounts information in paper form in secure locked cabinets and in electronic form on our encrypted computer server.

Post-discharge we will only keep assessment forms, assessment reports and clinical case notes, all other documentation that is not legally required will be removed from our systems and destroyed.
One year post-discharge, your child’s paper file is transferred to our secure offsite archive provider who securely stores this data until your child is 25 (or 26 if they are 17 when treatment ends) years old in line with the above legal requirements. Once your child turns 25 or 26 we will manually extract the file and securely dispose of all data held. We will also delete all electronic data held at this stage.

Contract fulfilment – We hold your details (name, address, contact details, etc) so that we may fulfil our contractual obligations to you, during the time that you are a client of ours. We will also process card payments using a PCI compliant payment gateway, if you choose to pay for our services via credit or debit card.

Our standard practice is to retain this information for the same period as your child’s medical records. Please contact the practice if you wish to discuss the possibility of an earlier erasure.

Legitimate interest – We may also use your information and that of your child, so that this practice can check and review the quality of the care we provide. This helps us to improve our services to you.

We retain information that relates to quality of care (for example, accident books, room utilisation, services offered and consumed) for as long as it is relevant.

Consent – We may send you information regarding special offers or services (for example holiday groups, training opportunities and new developments relevant to your child’s therapy needs) that we believe may be of interest or benefit to you or your child. This is known as Direct Marketing.

You have the absolute right to opt out of direct marketing at any time and you may also opt back in, if you wish.

Please contact the practice or email us at unsubscribe@thesensorysmartchild.com if you wish to be removed from any future direct marketing emails.

The kinds of personal data that we may collect regarding you or your child:

• Names
• Addresses
• Phone numbers
• Email addresses
• Ages
• Genders
• Birthplace
• Medical history
• Pre-assessment questionnaires
• OT reports
• Associated professional reports (e.g. Speech and language, physio)
• Marketing preferences
• Treatment session notes
• Photographs
• Video recordings
• Sound recordings
• Heart rate data
• Practice-defined therapy programmes
• Annual reviews/EHCP Documents
• Therapy goals
• Sessions attended and dates / times
• Preferred payment methods
• Bank payment confirmations
• Any other data deemed relevant in the provision of our services to you and your child

Your rights:

You have the right to be informed about the collection and use of your personal data, including our purposes for processing your data, our retention periods and with whom it may be shared. This Privacy Notice details this information for you.

You have the right of access, meaning you may request visibility of, or a copy of, all personal data undergoing processing. Typically, we would expect to make copies available to you within 28 days, however in certain circumstances it may take up to 84 days. In this event, we would notify you of the expected timeframe within 28 days. If you have any queries regarding this right or if you wish to make an access request, please email privacy@thesensorysmartchild.com or alternatively contact the practice on 01932 259831.

You have the right of rectification, meaning the right to have any mistakes or errors corrected (this may include a change of surname, or address, for example). Please advise the practice if any of your, or your child’s, details have changed and we will ensure that our records are updated. If you have any queries regarding this right, please contact us via email privacy@thesensorysmartchild.com or alternatively contact the practice on 01932 259831.

You have the right to erasure, often known as the right to be forgotten. This right is not absolute and only applies in certain circumstances. If you have any queries regarding this right, please contact us via email privacy@thesensorysmartchild.com or alternatively contact the practice on 01932 259831.

You have the right to request the restriction or suppression of your personal data. This right is not absolute and only applies in certain circumstances. If you have any queries regarding this right, please contact us via email privacy@thesensorysmartchild.com or alternatively contact the practice on 01932 259831.

You have the right to data portability. This right applies to data where the lawful basis for processing is consent or the performance of a contact and that is processed by automated means. The Sensory Smart Child, LTD does not process data by automated means and therefore this right does not apply. If you have any queries regarding this right, please contact us via email privacy@thesensorysmartchild.com or alternatively contact the practice on 01932 259831.

You have the right to object to the processing of your personal data. This may be done in person, via telephone, or by email and we will respond to your objection within one month from the date of receipt. If you have any queries regarding this right, please contact us via email privacy@thesensorysmartchild.com or alternatively contact the practice on 01932 259831.

You have the absolute right to stop your details being used for direct marketing. If you wish to opt out of marketing emails, or letters, which may include information regarding special offers or services (for example holiday groups, training opportunities and new developments relevant to your child’s therapy needs).

Please contact the practice or email us at unsubscribe@thesensorysmartchild.com if you wish to be removed from any future direct marketing emails.

Please note that the retention of your child’s record is a legal requirement and we are unable to accept any request that conflicts with this legislation.

If you are unhappy with our use of your personal data, or our response to any objection that you may raise, then you have the right to lodge a complaint with the Information Commissioner’s Office at any time. The ICO’s contact details can be found on the ICO’s website.

Storage of Data

We store physical data (paper-based) in secure onsite and offsite facilities. Electronic data is stored both onsite and offsite in secure locations, with encryption where appropriate and with adequate security controls (for example, strong passwords and individual user accounts).

Sharing data

We do not share your data with any third-party company for the purpose of data gathering or external marketing.

Your details may be shared with and processed by third party companies for the following reasons:

• Accountancy and invoicing
• Payment processing (credit cards and bank transfers)
• Delivery couriers and postal services
• Secure backups, or storage of data
• IT support services
• Independent advice regarding your child’s treatment (with your consent)
• Any requirement under UK law

This list is not exhaustive and may change from time-to-time in line with our business processes. Please be assured that we will only ever share your information with trusted parties who adhere to GDPR and the correct standards of security, as required by UK law.