Joy Wills (Cumbria Speech and Language Consultancy) is registered with the Information Commissioner's Office (ICO) as a Data Controller. Joy Wills assumes the function of data controller and supervises the compliance with the General Data Protection Regulation (GDPR) within the business. This Privacy Policy explains what personal data Cumbria Speech and Language Consultancy holds, why we hold and process it, who we might share it with and your rights and freedoms under the law. Please contact us with any queries.
Cumbria Speech and Language Consultancy provides independent speech and language therapy to children in the home, clinical setting and/or educational setting. It is managed by Joy Wills, Speech and Language Therapist. As per the professional obligations, Joy Wills is is registered with the Health and Care Professions Council (HCPC), a member of The Royal College of Speech and Language Therapists (RCSLT) and a member of The Association of Speech and Language Therapists in Independent Practice (ASLTIP).
Further information on the professional standards can be found here https://www.hcpc-uk.org/
standards/standards-of-proficiency/speech-and-language-therapists/ Cumbria Speech and Language Consultancy operates a website at www.cslc.uk
Cumbria Speech and Language Consultancy is committed to protecting the privacy of information provided by clients.
- Information we collect
- Where we get our information
- How we use the information we collect
- Information we share
- How and when consent is obtained
- How we protect your data
- Protecting your rights to data
- Security of your personal data
Information we collect
Cumbria Speech and Language Consultancy holds personal data as part of conducting a professional service. Our lawful basis for processing and storing personal information is one of
‘legitimate interest’ (under article 6 of GDPR). We cannot adequately deliver a service to your child without processing their personal information. As it is both a necessity for our service delivery and of benefit to your child, we have a legitimate interest to process and store their data.
Data relating to an individual’s health is classified as ‘Special Category Data’ under section 9 of the GDPR. The regulations specify that health professionals who are “legally bound to professional secrecy” may have a lawful basis for processing this data. Speech and Language Therapists are legally bound to keep client information confidential and it is under this condition that we process and store personal information.
The data follows under the following headings: healthcare records, educational records, clinical records, general administrative records, and financial records.
1.1. Healthcare records
A healthcare record refers to all information collected, processed and held both in manual and electronic formats pertaining to the service user and their care. Speech and language problems can be complex, and a wide range of information may be collected in order to best meet the needs of the client, and to maintain a high quality service which meets best practice requirements. In order to provide a high quality service, a range of information may be collected.
Examples of data collected and held on all current and active clients include the following:
- Contact details: Name, address, phone numbers, e-mail address,
- Personal details: date of birth,
- Other contacts: name and contact details of GP and any other relevant healthcare and
education professionals involved.
- Parent/guardian details
- Description of family
- Educational placements
- Pre- and post-natal history: This can include information relating to mother’s pregnancy,
and child’s birth
- Developmental data: developmental milestones, feeding history, audiology history
- Medical details: such as any relevant illnesses, medications, and relevant family history.
- Reports from other relevant allied health professionals such as: Audiology, Psychology,
CAMHS (Child & Adolescent Mental Health Services), Occupational therapy,
Physiotherapy, Ophthalmology.
1.2. Educational records
Relevant Personal Learning Plans/ Support Plans (Individual Educational Plans) or other such target setting records, progress notes from educational staff and school reports may be held and stored securely.
1.3. Clinical records
Specific data in relation to communication skills will be collected and held, such as assessment forms, reports, case notes, e-mails and text messages. Audio and video files may also be collected and stored securely in accordance with professional standards.
1.4. General administrative records
Cumbria Speech and Language Consultancy may hold information regarding attendance reports and accident report forms.
1.5. Financial records
A financial record pertains to all financial information concerning the practice, e.g. invoices, receipts, information for HMRC. Cumbria Speech and Language Consultancy may hold data in relation to: on-line purchasing history, card payments, bank details, receipts and invoices. Information will include name of bill payer, client name, address and record of invoices and payments made.
- Where we get our information
Personal data will be provided by the client, or in the case of a child (under 18 years), their parent(s)/guardian(s). This information will be collected as part of an initial consultation and a case history form prior to, or on the date of first contact. Personal information may be collected from a phone call, text message, email or from Cumbria Speech and Language Consultancy website.
Information may also be provided directly from relevant third parties such as nurseries, schools, childminders, Local Authority Specialist Advisory Teams, NHS Speech and Language Therapists, medical professionals and allied health professionals, with prior consent from the parent(s)/ guardian(s). We may also collect information about family members where this relates to your child e.g. contact details for parents/carers and relevant medical or developmental history. Details of the Cumbria Speech and Language Consultancy consent form can be requested from joycslc@gmail.com.
You may use the Cumbria Speech and Language Consultancy website without providing any personal information. However, if you wish to make an enquiry via the website, you are requested to provide relevant contact details, such as your name, e-mail address and contact telephone number to enable us to respond to your enquiry. You may add comments or queries which might also contain personal information.
By providing personal information for initial contact by SMS, voicemail, phone call, e-mail or website enquiry you are consenting to personal details for yourself and your child being held temporarily by Cumbria Speech and Language Consultancy. If your enquiry does not result in your child being seen by Cumbria Speech and Language Consultancy then this personal information will be deleted once your enquiry has been dealt with. If your child is subsequently seen by Cumbria Speech and Language Consultancy these details may be added to their personal record.
Cumbria Speech and Language Consultancy website www.cslc.uk contains links to other Internet sites which are outside our control and are not covered by this Privacy Policy. We are not responsible for data which you provide through any such linked websites.
- How we use the information that we collect
We use the information we collect to provide assessment and therapy as per the relevant professional guidelines, as well as to maintain the general running of the business, such as running our electronic booking system, keeping our accounts and updating you of any changes in policies or fees.
Examples of how we use this information:
- To prepare, plan and provide speech and language therapy services appropriate for your child’s needs.
- To communicate with you via post, email, telephone, mobile messages and SMS in relation to:
- confirming and preparing for appointments
- general communication in between appointments
- sending you reports and programmes for your child (which will be password protected if sent via e mail)
- copying you in to communications with other professionals involved with your child
(your child’s initials or first name, rather than full name will be used in emails)
- sending you resources
- sending you invoices
- For clinical audit to assess and improve our service. Results of audits are always presented with all client identities removed.
- For management and administration, for example, surnames are used on invoices.
- Information may also be used for research purposes, with the written consent of the client or
parent/guardian.
3.1. Data retention periods
The retention periods are the time periods for which the records should be held based on the Cumbria Speech and Language Consultancy’s needs, legal and/or fiscal precedence or historical purposes. Following the retention deadline, all data will be destroyed under confidential means.
3.2. Client Records
3.2.1. Clinical Records
Cumbria Speech and Language Consultancy keeps both physical and electronic records of clinical data in order to provide a service.
- Clinical data is deleted/confidentially destroyed once the child reaches the age of 25 years
old or after 7 years from last invoiced session. (Usually post discharge).
- Clinical data used for research purposes, may be kept for longer than 7 years.
- Video records/ voice recordings relating to client care/video-conferencing records may be
recorded with consent, analysed and then destroyed. If written consent is provided to use
recordings for training purposes, the client will have the option to withdraw consent at any
time.
3.2.2. Financial Records
Cumbria Speech and Language Consultancy keeps electronic/paper records of financial data from those who use our services.
Section 886 of the Direct Tax Acts states that the Revenue Commissioners require records to be retained for a minimum period of 6 years after the completion of the transactions, acts or operations to which they relate. These requirements apply to manual and electronic records equally.
- Financial Data is kept for 6 years to adhere to Revenue guidelines.
- Financial Data (including non-payment of bills) can be given to Revenue at Revenue’s request.
3.2.3. Contact Data
Contact Data is kept for 6 years to allow processing of Financial Data if required. (This may be retained for longer for safety, legal request, or child protection reasons.)
3.3. Exceptions
If under investigation or if litigation is likely, files must be held in original form indefinitely, otherwise files are held for the minimum periods set out above.
- Information we share
We do not share personal information with companies, organisations and individuals outside Cumbria Speech and Language Consultancy unless we are required by law to do so or to provide services effectively. We use third party services to assist with certain functions:
- WriteUpp: a secure online practice management software, to manage client records, scheduling, and communication. WriteUpp is a trusted platform designed to ensure the confidentiality and security of your personal information. When you engage with our services, your personal and health information may be stored and processed within WriteUpp to facilitate the provision of speech and language therapy services. WriteUpp operates in compliance with data protection laws and adheres to strict security protocols to safeguard your information. If you have any questions or concerns about the use of WriteUpp or how your information is managed within the platform, please feel free to contact us using the information provided in Section 10.
We may share your information in one of the following circumstances:
4.1. With your consent:
We will only share your Personal Identifying Information (PII) to third parties when we have express written permission by letter or email to do so. I require opt-in consent for the sharing of any sensitive information.
Third parties may include: hospitals, GPs, other allied health professionals, educational facilities.
4.2. For legal reasons:
We will share personal information with companies or organisations outside of Cumbria Speech and Language Consultancy if disclosure of the information is reasonably necessary to:
▪ Meet any applicable law, regulation, legal process or enforceable governmental request.
▪ Meet the requirements of the Children First Act 2015.
▪ To protect against harm to the rights, property or safely of Cumbria Speech and Language
Consultancy, our service users or the public as required or permitted by law.
4.3. To meet financial requirements:
Cumbria Speech and Language Consultancy engages the services of Seavor Chartered Accountants in relation to tax services. No identifiable personal information is shared with them - it is removed and codes used.
4.4. For processing by third parties/external processing
There are currently no third parties engaged in processing data
- How and when we obtain consent
Prior to initial assessment or consultation, a copy of the Privacy and Data Retention Policy will be provided to clients. It is also available from the website at www.cslc.uk or on request from Joy Wills at joycslc@gmail.com.
A consent form will need to be signed by the client prior to commencing the service.
Should a client wish to withdraw their consent for data to be processed, they can do so by contacting Cumbria Speech and Language Consultancy.
- How we protect your data
In accordance with the General Data Protection Regulation (GDPR), we will endeavour to protect your personal data in a number of ways:
6.1. By limiting the data that we collect in the first instance
All data collected by us will be collected solely for the purposes set out at 1) above and will be collected for specified, explicit and legitimate purposes. Furthermore, all data collected by us will be adequate, relevant and limited to what is necessary in relation to the purposes for which it is collected which include, the assessment, diagnosis and treatment of speech, language and communication disorders.
6.2. By transmitting the data in certain specified circumstances only
Data will only be shared and transmitted, be it on paper or electronically, only as is required, and as set out in section 3.
6.3. By keeping only the data that is required
6.4. By disposing of/destroying the data once the individual has ceased receiving treatment
Section 3 outlines retention periods for different kinds of data. We will put in place appropriate technical and organisational measures to ensure a level of security appropriate to the risk. These include measures such as safe and secure storage facilities for paper/electronic records. Data will be disposed of following the retention period.
6.5. By retaining the data for only as long as is required
In this case, until a child reaches the age of 25 years or 7 years after therapy has ceased for an adult, whichever time is longer, except for circumstances in which retention of data is required in circumstances set out above or in certain specific circumstances as set out at Article 23(1) of the GDPR.
6.6. By destroying the data securely and confidentially after the period of retention has elapsed.
6.7. By ensuring that any personal data collected and retained is both accurate and up-to-date.
- Protecting your Rights to Data
7.1. Children
For children under the age of 18, data access requests are made by their parents/guardians. When a child turns 18, then they may make a request for their personal data. However, this is subject to adherence with the Children First Act.
- Security
Cumbria Speech and Language Consultancy, as with most providers of healthcare services is aware of the need for privacy. As such, we aim to practice privacy by design as a default approach, and only obtain and retain the information needed to provide you with the best possible service.
All persons working in, and with Cumbria Speech and Language Consultancy in a professional capacity are briefed on the proper management, storage and safekeeping of data.
All data used by Cumbria Speech and Language Consultancy, including personal data may be retained in any of the following formats:
- Electronic Data
- Physical Files
The type of format for storing the data is decided based on the format the data exists in.
Where applicable, Cumbria Speech and Language Consultancy may convert physical files to electronic records to allow us to provide a better service to clients.
8.1. Data Security
Cumbria Speech and Language Consultancy understands that the personal data used in order to provide a service belongs to the individuals involved. The following outlines the steps which Cumbria Speech and Language Consultancy use to ensure that the data is kept safe.
8.1.1. Electronic Data
All electronic data, such as reports, assessment results, client contact information, is contained on a password protected laptop and when necessary to share reports, assessment results and any other personal data these are sent via email as an encrypted file.
Client phone numbers may be stored on a mobile telephone and text messages sent to Cumbria Speech and Language Consultancy may remain on the telephone. Cumbria Speech and Language Consultancy will only refer to your child by initial or first name in text. The mobile phone is passcode protected.
Videos, voice recordings and photos may be taken of clients with parental consent. Where possible these will be taken and stored on devices owned by parents/guardians. If this is not possible, a password protected device owned by Cumbria Speech and Language Consultancy will be used. The videos may then be stored and viewed by the therapist in order to make notes in a client record or be used as part of therapy. The video will then be deleted when it is no longer required.
Electronic data is protected on a password protected laptop and also stored securely on a cloud-based system.
8.1.2. Physical Files
All information about you, your child and their speech and language therapy is stored securely in our systems to ensure that we have a complete record of our service to you. All confidential information, including written case notes (summarising direct and indirect contact, such as content of therapy sessions, telephone calls etc), informal and formal assessments, copies of letters, reports and e-mails are stored securely, in accordance with Data Protection Regulations, in individual client files at 10 Whiteclosegate, Carlisle, Cumbria, CA3 0JD, in a lockable filing cabinet. Only Joy Wills has access to these records.
The minimum amount of confidential information will be taken out of the Speech and Language Therapist’s office base.
In addition to physical files, case notes may be stored electronically. Prior to being uploaded to the system, documents are temporarily stored on a cloud-based system which is only accessible via a password held by myself.
8.2. Security Policy
8.2.1. Cumbria Speech and Language Consultancy understands that requirements for electronic and
physical storage may change with time and the state of the art. As such, Joy Wills, the Data Controller in Cumbria Speech and Language Consultancy reviews the electronic and physical storage options available to Cumbria Speech and Language Consultancy on a yearly basis.
8.2.2. Cumbria Speech and Language Consultancy are aware of the requirements for good data
hygiene. This includes, but is not limited to:
▪ Awareness of client conversations in insecure locations.
▪ Enabling auto-lock on devices when leaving them unattended, even within Cumbria
Speech and Language Consultancy locations.
▪ Use of non-identifiable note taking options (Initials, not names).
▪ The awareness of Cumbria Speech and Language Consultancy procedure should a
possible data breach occur, either through malicious (theft) or accident (loss) of devices
or physical files.
- Your Rights
Data protection legislation gives parents/guardians various rights. The most important of these are as follows:
- You have the right to be informed about the personal data we hold and why we hold it.
- You have the right to access a copy of your/your child’s data that we hold by contacting us
directly.
- You have the right to ask for your record to be amended if you believe that it is wrong.
- You have the right to have your data erased in certain circumstances.
- You have the right to transfer your data to someone else if you tell us to do so and it is safe
and legal to do so.
- You have the right to tell us not to actively process or update your data in certain
circumstances.
- How to access your child’s data
You can access the information we hold about you by writing to us at the address given below. Please apply in writing rather than by email, so that we receive an original signature to compare against the records we hold.
A copy of your child’s records is provided free of charge. Numerous requests may incur an administration charge at the discretion of Cumbria Speech and Language Consultancy.
We will provide access to your child’s records within 30 days of receipt of all necessary information.
Please make your request in writing to: Cumbria Speech and Language Consultancy 10 Whiteclosegate
Carlisle Cumbria CA3 0JD
If you have any further questions about how we use your information, please contact:
joycslc@gmail.com
Further information about data protection legislation and your rights is available from the Information Commissioner's Office or by calling 0303 123 1113, 9am to 5pm, Monday to Friday.
Date of document: September 2018
Date of update: August 2024
