GDPR and Privacy Policy
Purpose
When you use Speech Connect Ltd, trading as Speech Connect, an independent speech and language therapy service, you trust us with your information. This policy explains what data we collect, why we collect it, and how we protect it.
Scope
Speech Connect Ltd acts as the Data Controller and complies with the UK General Data Protection Regulation (GDPR) and Data Protection Act 2018.
1. Lawful Basis for Processing
We process personal and special category data under:
Article 6(1)(b) – Performance of a contract (providing therapy services)
- We collect and use your personal data because it is necessary to provide the speech and language therapy services you have requested. This means we need certain details (like contact information and case history) to fulfil our agreement with you.
Article 9(2)(h)
- Provision of health or social care
We process health-related information because it is essential for assessing and treating communication needs. This is permitted under GDPR for healthcare providers, as long as we maintain confidentiality and professional standards.
These legal bases ensure that your data is processed fairly, securely, and only for the purposes of delivering therapy and meeting legal obligations.
2. Information We Collect
Speech Connect Ltd holds personal data as part of conduction a professional service as follows:
- Healthcare Records: Name, DOB, GP details, medical history, developmental data
- Educational Records: EHCPs, school reports
- Clinical Records: Assessments, reports, audio/video (with consent)
- Administrative Records: Attendance, accident reports
- Financial Records: Invoices, payment details
3. How We Use Your Data
- To provide assessment and therapy
- To manage bookings and accounts
- To comply with legal and tax obligations
- For research (only with written consent)
4. Retention Periods
Following the retention deadline, all data will be destroyed under confidential means. In accordance with law, all records will be kept securely as follows:
- Clinical Records: Until child is 25 (or 26 if treatment at 17)
- Financial Records: 6 years (Revenue requirement)
- Exceptions: Litigation or investigation – retain indefinitely
5. Sharing Information
We do not share personal information with companies, organisations and individuals outside of Speech Connect Ltd unless one of the following circumstances apply:
- With Consent: Hospitals, GPs, schools
- Legal Obligations: Child protection, court orders
- Financial Compliance: Accountant for tax purposes
6. Consent
Signed consent is obtained before services start. A copy of the GDPR and Data Protection Policy will be provided to clients. It will also be made available on Speech Connect Ltd website.
Clients can withdraw consent at any time.
7. Data Security
We use trusted third-party service providers (such as WriteUpp for clinical records and accountants for financial compliance). Each provider must comply with GDPR and has signed a Data Processing Agreement (DPA)
- We use encrypted electronic systems (e.g., WriteUpp, password-protected)
- Locked filing cabinets for physical files
- Annual review of security measures
- Staff trained in GDPR compliance
8. Data Breach Procedure
If a breach occurs:
- We will be report to the Information Commissioner’s Office within 72 hours
- We will notify the affected individuals promptly
9. International Transfers
We do not transfer data outside the UK. If this changes, we will apply UK GDPR safeguards.
10. Your Rights
Individuals have the right to:
- Access, rectification, erasure, restriction, portability
To make a subject access request (SAR):
- Submit a written request via email or post
- We will respond within one month of receipt
- If requests are complex, we may extend by two months and inform you
- No fee unless requests are excessive or repetitive
Children and young people have the right to access their personal data. We will assess whether they have sufficient understanding to make a request. If not, a parent or guardian may act on their behalf. We may restrict access if disclosure could cause harm or conflict with safeguarding duties.
11. ICO Complain Details
If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office (ICO):
Website: www.ico.org.uk
Phone: 0303 123 1113
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
12. ICO Registration
Speech Connect Ltd is registered with the Information Commissioner’s Office as a Data Controller.
13. Questions
Any questions regarding this policy should be directed to the Director of Speech Connect Ltd:
Name: Andrea McCloskey
Email: info@speechconnect.co.uk
Phone: +44 (0) 7379 100 043