Privacy Policy

Our commitment to children's privacy

As a paediatric therapy clinic, a significant proportion of the personal data we hold relates to children under the age of 18. We recognise that children require specific protection in relation to their personal data, as they may be less aware of the risks and consequences of sharing their information. We design all of our data processing with the best interests of the child as our primary consideration, in accordance with the principle of privacy by design and by default under Article 25 of the UK GDPR, and in line with ICO guidance on Children and the UK GDPR.

​

What data we collect about children

In the course of providing Occupational Therapy, Speech and Language Therapy, and related therapeutic and assessment services, we collect and process the following categories of personal data relating to children:

• Full name and date of birth;

• Contact and address information (held via the parent or carer);

• Clinical and therapeutic records including assessment reports, session notes, programme plans, and progress records;

• Education, Health and Care Plan (EHCP) documentation;

• School and educational setting information;

• Referral and correspondence records;

• Any other information necessary to deliver the agreed provision.

​

Special category health data

Clinical and therapeutic records constitute special category data under Article 9 of the UK GDPR as they relate to the physical and mental health of the child. We are required to identify both a lawful basis under Article 6 and a separate condition for processing under Article 9. Our lawful basis for processing children's clinical data is the performance of a contract for the provision of therapeutic services (Article 6(1)(b)), and where applicable, compliance with a legal obligation (Article 6(1)(c)). Our condition for processing special category health data is Article 9(2)(h) processing necessary for the provision of health care or treatment together with the associated Schedule 1 condition under the DPA 2018. We document which categories of special category data we process and maintain appropriate safeguards at all times.

​

Children's rights

Children have the same data protection rights as adults under the UK GDPR. These include the right to access their personal data, request rectification, object to processing, and have their personal data erased. Where a child is of sufficient age and maturity to understand and exercise their own data protection rights, we will respond to requests made directly by the child. In England and Wales, there is no fixed age of competence and we assess this on a case by case basis, having regard to the child's level of understanding and the nature of the request.

​

Where a child is not considered sufficiently mature to exercise their rights independently, a person with parental responsibility may do so on the child's behalf, subject to the conditions set out below. In all cases, the rights belong to the child and not to the parent, and the best interests of the child will always be our primary consideration.

​

Parental access to children's data

Where a parent or person with parental responsibility makes a request for access to a child's personal data, we are required before responding to satisfy ourselves that:

• The person making the request holds parental responsibility for the child;

• There are no court orders in place that restrict or qualify that parental responsibility or the person's ability to access information about the child;

• Disclosure is in the best interests of the child.

​

We will ask any person requesting a child's data to provide confirmation of parental responsibility, to complete our identity verification process via Yoti, and to confirm in writing whether any child arrangements order, prohibited steps order, or other relevant court order is in place.

​

Separated parents

Where parents are separated or not living together, we handle requests for a child's data with particular care. We may notify the other parent or carer before responding to a SAR, where we consider it appropriate and in the best interests of the child to do so. We will consider each situation individually and on its own facts. Where there is a dispute between parents regarding access to a child's data, the best interests of the child will prevail.

​

Sharing children's data with third parties

In the course of delivering therapeutic provision, we may share relevant data about a child with the following categories of recipients:

• Local Authorities, including Special Educational Needs and Assessment Services;

• Schools and educational settings named in or relevant to the child's EHCP;

• Other healthcare professionals involved in the child's care;

• Regulatory bodies where required by law or professional obligation.

​

We will always inform parents and, where appropriate, the child, about any significant sharing of their data, unless doing so would be contrary to the child's best interests or prohibited by law.

​

Retention of children's data

We retain children's clinical records in accordance with the NHS Records Management Code of Practice and the standards of the Health and Care Professions Council (HCPC). Clinical records relating to children are generally retained until the child's 25th birthday, or for eight years following the end of treatment if this is later, unless a longer retention period is required by law or professional regulation. Records relating to serious incidents may be retained for longer periods.

​

Privacy information for children

We are committed to providing privacy information in clear, plain language that is accessible to children. If you would like a version of this Privacy Policy written in child-friendly language, please contact us at info@hopscotchtherapy.co.uk and we will provide one on request.​​​​​​​​​​​​​​