Data Protection and Privacy Policy

Introduction

This document sets out how Learn to Talk Limited collects, processes, stores and protects client data.

Who we are

Learn to Talk Limited is an independent speech and language therapy practice that provides:

  • speech and language therapy to children in educational settings, and in their homes; and
  • consultancy and training services to schools and other settings.

Learn to Talk Limited is registered with Companies House and is owned by Victoria Rouse, who is the sole Director. The company number is 06962047; the registered address is 105 Newgate Lane, Fareham, PO14 1BA.

Victoria Rouse is a speech and language therapist, registered with the Health and Care Professions Council (HCPC) – registration number SL13289.

Victoria Rouse is the Data Protection Officer for Learn to Talk Limited.

Learn to Talk operates a website at www.learntotalk.co.uk.

Learn to Talk is committed to protecting the privacy of information provided by clients.

Collection of personal information

You do not need to provide any personal information to use the Learn to Talk website. Cookies are stored on your computer and used for the purposes of website analytics unless you disable this in your browser. Cookies do not collect any personal information.

When you make an initial enquiry as a potential client, you may do so either by email, WhatsApp, telephone or Facebook Messenger and will be requested to supply relevant contact details such as your name, email address and a contact telephone number to enable us to respond to your enquiry. You may also provide the name of your child and the nature of your concern, which also constitutes personal information.

During an initial telephone call, you will be requested to provide further personal information about you or your child. This may include further detail about your concern and information about your child’s situation – for example about other family members or their educational setting. 

Following the initial call, the personal information collected will be added to your child’s record. 

For the duration your child is on our caseload, we will collect personal information which will be securely stored in their case notes. This may include the child’s name; date of birth; parental contact details; school / setting details; reason for referral / presenting problem; medical history; developmental history; family history; records of assessments; records of therapy; safeguarding issues; details of other professionals involved; educational progress; and records of communication with parents / carers / other professionals.

We will collect this information:

  • from parents / carers through spoken or written means;
  • with consent from parents / carers, from other professionals working with your child, such as teachers, nursery staff, childminders, other speech and language therapists or other allied professionals; and 
  • from the child through direct observation, assessment and therapy, which may include recording videos or audio for certain types of therapy.

The Learn to Talk website contains links to other sites outside of our control, which are not covered by this privacy policy.

Our use of personal information

Personal information is stored, processed and used for the sole purpose of delivering your child’s speech and language therapy. All information is stored securely and processed in confidence.

We use this information:

  • To prepare, plan and provide speech and language therapy services appropriate for your child’s needs;
  • To communicate with you via post, email, telephone, SMS and mobile messaging (for example WhatsApp) in relation to:
    • confirming and preparing for appointments;
    • general communication between appointments;
    • sending you reports and programmes for your child;
    • copying you into communications with other professionals involved with your child’s care;
    • sending you resources; and
    • sending you invoices and receipts.
  • For clinical audit to assess and improve our service; and
  • For management and administration – for example invoicing and accounting.

With parent / carer consent, information about your child’s speech and language will be shared with other professionals involved in your child’s care, when it is in your child’s best interests. Only necessary information is shared and a record of your consent is kept within your child’s case notes. 

Unless we are required to do so by law, we will not disclose any personal information collected to any person other than as set out above.

In all cases, whenever personal identifiers are not needed for tasks, if possible we remove them from the information we use. 

How we store personal information

All personal information we hold about and in relation to your child is stored to ensure that we have a complete record of our service to them. It is only retained as long as necessary and is then securely disposed of.

Case notes, appointment history, contact information, invoicing information, payment history, documents and reports are stored electronically on secure, cloud based systems.

Videos recorded for the purpose of therapy are stored on an encrypted and password protected smartphone or tablet. If there is a reason to retain them (for example, to review again with a parent or carer in the future), they will be transferred to cloud based storage and the original recording securely deleted.

All hardware used to access electronic systems is encrypted and password protected; portable storage devices such as USB sticks and portable hard drives are not used; all the cloud-based systems we use operate SSL protocols and are password protected – where available with two-step authorisation; unsecure public wi-fi hotspots are not used; and all documents that contain confidential information are individually password-protected.

Any paper-based information such as formal assessments is stored securely at the registered address of Learn to Talk. When in transit, paper-based information will be kept with the speech and language therapist or in the locked boot of their car – whichever is deemed more secure at the time. The minimum amount of information necessary is removed from Learn to Talk’s registered address.

In accordance with the Records Management Code of Practice for Health and Social Care 2016, records are held until the child or young person is 26 years old. After this time, electronic records will be securely deleted and paper files shredded.

Lawful basis for processing information

Personal data concerning health is considered ‘special category data’ under the General Data Protection Regulations. For this type of data, we are required to identify two lawful bases for processing personal information. 

Learn to Talk’s first lawful basis for processing and storing personal information is one of ‘legal obligation’. We are required to identify the obligation in question, either by reference to the specific legal provision or else by pointing to an appropriate source of advice or guidance that sets it out clearly. For example a government website or industry guidance that explains generally applicable legal obligations. 

Whilst there is no legal requirement that therapists must keep records of interventions, it is a legal requirement for all speech and language therapists to be registered with the Health and Care Professions Council (HCPC). Speech and language therapists are therefore bound by the rules and standards of that body and are subject to audit to maintain their registration. The HCPC has clear standards of conduct, performance and ethics that all registrants must adhere to. These standards affect the way in which we process and share information. Specifically:

Standard 2: Communicate appropriately and effectively
You must share relevant information, where appropriate, with colleagues involved in the care, treatment or other services provided to a service user.

Standard 10: Keep records of your work
You must keep full, clear and accurate records for everyone you care for, treat or provide other services to. You must complete all records promptly and as soon as possible after providing care, treatment or other services. You must keep records secure by protecting them from loss, damage or inappropriate access.

Full details can be found:
https://www.hcpc-uk.org/assets/documents/10004EDFStandardsofconduct,performanceandethics.pdf

Learn to Talk’s second lawful basis for processing and storing personal information is one of ‘legitimate interest’. We cannot adequately deliver a service to your child without processing their personal information. As it is both a necessity for our service delivery, and of benefit to your child, we have a legitimate interest to store and process their data.

Assurance we have procedures for managing a data breach

A data breach occurs when the security of confidential and restricted information is compromised and is accessed / viewed by persons other than those officially recognised to manage the information. 

We are a committed to maintaining the security and confidentiality of all information we hold about and in relation to your child. 

We actively review our security procedures and measures to prevent data breaches from occurring in the first place. For example, when selecting and configuring electronic systems, we place high importance on their reliability, availability and information security.

In the event a breach does occur, we have procedures in place to manage it:

  1. Take immediate steps to:
    1. remove or secure affected data
    2. secure unaffected data which has the potential to be affected
    3. prevent the breach escalating
  2. Assess the affected data and the impact of the breach
  3. Determine and make appropriate notifications, which may include:
    1. Parents / affected person
    2. Senior leadership team in schools / educational settings
    3. Information Commissioner’s Office
    4. HCPC
    5. OFSTED
    6. Police
    7. Other professionals who may be involved
  4. Review the causes of the incident and identify lessons
  5. Review and update procedures in light of lessons identified.

Rights available to individuals in respect of processing of personal information

Rights apply to therapists who work with us, to client schooled and educational settings, potential customers and to the children and parents with whom we work.

The right to be informed

Under the General Data Protection Regulations, individuals have the right to know that their data is being processed (what data; why; how it is stored; with whom it is shared; how long it is kept; and how it is eventually deleted).

This information is covered within our Data Protection and Privacy Policy (this document).

The right of access

Parents / carers or the child may ask to view personal information held. The process for this is:

A request is made in writing or by email to the Director. This should include full name and address of the person making the request for disclosure; his / her relationship to the individual whose records have been requested; the full name, address and date of birth of the individual to whom the records pertain.

Within 30 days of receipt of the information above, we will provide access to the records. There is no charge for this.

The right to rectification

Individuals are entitled to have personal data rectified if it is inaccurate or incomplete, however this does not extend to medical opinions, where the data recorded accurately represents a professional opinion (diagnosis) at a given point in time. If any non-medical information held is believed to be inaccurate or incomplete, we will discuss this with the appropriate parties and rectify the records.

The right to be forgotten

Individuals are entitled to have personal information to be erased, however this does not apply in all circumstances. Where data forms part of a health record, there is no absolute right to be forgotten. 

Individuals may ask for their data to be erased when there is no compelling reason for its continued processing. If you are a parent / carer / child seeking information to be erased, please contact the Learn to Talk Director to discuss the specifics. We will cooperate to the extent we are able.

The right to restrict processing

Individuals are entitled to restrict the processing of their personal information in certain circumstances. This means an individual can limit the way an organisation uses their data. If you are a parent / carer / child seeking to restrict processing, please contact the Learn to Talk Director to discuss the specifics. We will cooperate to the extent we are able.

The right to withdraw consent

Parents / carers can withdraw consent for Learn to Talk processing information relating to a child at any point. Due to our legal basis, this will trigger the discharge process for the child.