This notice explains how Keystone Communication Therapy collects, uses, stores, and protects personal information in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

Keystone Communication Therapy is an independent Speech and Language Therapy practice operated by Erryn Freeth as a sole trader, based in Lichfield, Staffordshire.

We are registered with the Information Commissioner's Office (ICO) as a Data Controller.

ICO registration number

ZC197664

Contact

erryn@keystonecommunicationtherapy.co.uk

Website

keystonecommunicationtherapy.co.uk

2. What information we collect

In order to provide Speech and Language Therapy assessments and therapy services, we may collect and hold the following personal information

•      Personal details — Name, date of birth, address, telephone number, and email address of the child and their parent or guardian.

•      Medical and health information — Details of any diagnoses, previous assessments, medications, and developmental history.

•      Educational information — School placement, EHCP documentation, and reports from other professionals.

•      Assessment data — Results of standardised and informal assessments, clinical observations, and written reports.

•      Third party professional details — Names and contact details of educational psychologists, teachers, solicitors, and other professionals involved in a child's care.

3. Why we collect this information

We collect and process personal information for the following purposes:

•      To carry out Speech and Language Therapy assessments and produce written reports

•      To communicate with families, carers, and other professionals involved in a child's care

•      To fulfil our legal and professional obligations as an HCPC registered therapist

•      To process invoices and payments for services provided

Lawful basis: The lawful basis for processing health and special category data is Article 9(2)(h) of UK GDPR — processing necessary for the provision of health or social care treatment by a health professional.

4. How we store your information

All personal and clinical information is stored securely in line with UK GDPR requirements.

•      Digital records are stored on encrypted, password-protected systems

•      Paper records, where used, are kept in a secure location and disposed of confidentially when no longer required

•      Reports and clinical documents are shared with authorised parties by encrypted email or secure file transfer only

•      We do not store personal or client-identifiable information on any third-party AI tools or systems that cannot guarantee appropriate privacy and data security controls

5. How long we keep your information

We retain personal information only for as long as necessary and in line with our professional and legal obligations.

Record type

Retention period

Clinical records — children - Until the child's 25th birthday, or 8 years from last contact — whichever is longer (HCPC standards)

Financial records and invoices - Minimum 6 years (HMRC requirements)

Consent forms - Retained with clinical records for the same period

6. Who we share your information with

We will only share personal information where it is necessary and with your consent, or where we are legally required to do so. This may include: 

•      Other professionals involved in a child's care — such as educational psychologists, teachers, or solicitors — where you have given consent for us to do so

•      Local Authorities or tribunal panels, where a report has been commissioned for use in EHCP or tribunal proceedings

•      Regulatory bodies such as the HCPC, where we have a professional obligation to disclose

 We do not sell or share personal information with third parties for marketing purposes.

Safeguarding: In some circumstances we may be required to share information without consent — for example where there is a safeguarding concern relating to a child's welfare or a legal obligation to disclose. In such cases we will act in line with our safeguarding policy and relevant local protocols.

7. Your rights

Under UK GDPR you have the following rights in relation to your personal information:

 •      Right of access — To request a copy of the personal information we hold about you

•      Right to rectification — To request correction of any inaccurate or incomplete information

•      Right to erasure — To request deletion of your information, subject to our legal and professional obligations to retain records

•      Right to restrict processing — To restrict or object to our processing of your information in certain circumstances

•      Right to data portability — To receive your information in a portable format in certain circumstances

•      Right to withdraw consent — To withdraw consent where processing is based on consent

To exercise any of these rights please contact us at erryn@keystonecommunicationtherapy.co.uk. We will respond within one month of receiving your request.

8. Complaints

If you have concerns about how we handle your personal information you have the right to make a complaint to the Information Commissioner's Office:

•      Website: ico.org.uk

•      Telephone: 0303 123 1113

•      Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We would always welcome the opportunity to address any concerns directly before you contact the ICO — please get in touch with us first if you have any questions.

 9. Changes to this notice

We may update this privacy notice from time to time to reflect changes in our practice or in data protection law. The most current version will always be available on our website at keystonecommunicationtherapy.co.uk. The date at the top of this notice shows when it was last updated. Where changes are significant, we will notify existing clients directly. 

Questions about this notice?

Erryn Freeth, Keystone Communication Therapy

erryn@keystonecommunicationtherapy.co.uk

keystonecommunicationtherapy.co.uk