Privacy Policy - Speaking Space Ltd

Please use the following links to download PDF copies of our privacy statement

Easy Read Privacy Notice 2021

SLT Privacy notice Sept 2021

Privacy Notice

Speaking Space Ltd is committed to protecting the privacy of information provided by clients. Under the new GDPR (General Data Protection Regulations) it is necessary to have a lawful basis for processing data. In this privacy notice we will explain to you our lawful bases, explain our purposes for processing the data and how we store and share your data.

Who we are

Speaking Space Ltd is an independent company responsible for providing speech and language therapy and a day service at our base in Romsey, and in the home and/or educational setting, as well as training for staff in speech, language, communication and social skills. It is owned and directed by Alex Kelly, speech and language therapist, who is registered with the Health and Care Professions Council (HCPC).

How we collect data

Speaking Space Ltd operates a website at www.speakingspace.co.uk. We may collect data via our website if you make an enquiry. Please see a separate privacy notice on our website with more information about this.

We may also collect data via email, telephone, face to face or via third parties. We only collect data which is necessary to provide a therapy service.

We have CCTV cameras at our base at Fleming House which records our front door and back gate over a 24 hour period.

How we store personal data:

We take the following measures to ensure personal data is stored securely:

Any paper based confidential information such as assessments are locked in the building of Speaking Space Ltd, or in the school in which we have a contract, within a locked filing cabinet.
All electronic case notes will be written directly into and kept within a system called Writeupp which is GDPR compliant. This will only be accessible to the therapy team and administrators of the system.
If therapists don’t have access to the internet they will write case notes offline on their secure one drive until they are uploaded to Writeupp. Case notes will then be deleted from their one drive. This process will be the same for other information which is relevant to the individual’s case file e.g. electronic copies of emails, reports, target forms.
Paper documents such as assessment forms and previous paper files will be uploaded to a folder on our secure Sharepoint system as soon as possible which is only accessible to the administrators of the system and our therapists. Paper files will then be securely shredded if appropriate. If assessment forms need to be kept for future assessments these will be securely locked in the building of Speaking Space Ltd, or in the school in which we have a contract, within a locked filing cabinet.
We use office 365 to store electronic data on personal one drives and on SharePoint due to the high level of security and encryption offered by this platform. Documents produced by individual therapists are stored on their personal one drive. This means the information is stored securely in the cloud and is accessed by that individual via office.com or via one drive on their personal password protected laptop.
Shared information is stored securely on SharePoint and can be accessed via individual accounts via office.com. Folders within SharePoint have restricted access so each individual can only access folders which are necessary for their role.
Two factor authentication is enabled on all office 365 accounts
No documents are stored on laptop hard drives
Videos or photos may be taken with consent. If taken on a mobile device, they will be transferred onto one drive or SharePoint at the earliest opportunity and immediately deleted from the mobile device.
The minimum amount of confidential information will be taken out of the office base. When information is taken out of the office base it will be kept in a locked portable storage container, either with the therapist or be locked in the boot of the therapist’s car (whichever is deemed to be the most secure at that time).
Archived files are either kept in locked filing cabinets at our base in Romsey, or if they have been transferred to electronic archiving they are stored currently on SharePoint in a restricted folder which is only accessible to the administrators of the system. Our aim is for all of our archived files to be stored electronically. Once stored electronically, paper files are destroyed securely (shredded).
CCTV footage is stored on a secure, encrypted system at our base in Fleming House.

In accordance with law, all records will be kept securely until a child is 25 years old or 8 years from discharge from the service (whichever is appropriate). For people with a mental health condition this will be 20 years. After this time all records relating to the individual will be destroyed securely i.e. shredding, incineration or permanently deleted electronically. CCTV footage is retained for 30 days.

How we use personal data

We use this information:

To plan and provide therapy services appropriate for the individual’s needs.
To communicate with you via post, email, telephone, mobile messages and SMS in relation to:
- Confirming appointments
- General communication between appointments
- Sending reports and programmes for you/service user (these will always be password protected)
- Copying you into communications with other professionals involved (the individual’s initials rather than full name will be used in emails)
- Sending you resources
- Sending you invoices and receipts
For clinical audit to assess and improve our service. Results of audits are always presented with all client identities removed.
For management and administration, for example surnames of clients are included in our password protected accounting database.
To obtain booking information for training purposes

Whenever personal identifiers are not needed for these tasks, if possible we remove them from the information we use.

How we share data

We may share data about the individual in relation to the service being provided i.e. communication needs, other health needs relating to the service. We may share this with other professionals involved in the person’s care e.g. other therapists, school staff, medical staff, parents, when it is in that person’s best interests. Information sent electronically will be sent in a password protected document and the password will be sent in a separate email, or securely via the direct message function within Writeupp.

Unless we are required to do so by law, we will not disclose any personal information collected to any person other than as set out above.

We do not employ agents to process personal data, for example specialist mailing companies to send out communications.

We do not give or sell client details to any third parties.

The type of data we collect includes:

Information about the service user (this could be a child or vulnerable adult) via spoken or written information from parents/carers, for example, their name, address, date of birth, where they attend school and medical/health information necessary to begin intervention.
Information may also be collected from other professionals working with the service user (such as teachers, NHS speech and language therapist, occupational therapist, care managers etc.).
We may also collect information about family members where this relates to the service user e.g. contact details for parents and relevant medical or developmental history.
We may ask for your name, address, email address, telephone number and invoicing details for training bookings

Lawful bases for processing

The new GDPR (General Data Protection Regulations) require data processors to have a lawful basis for processing that data. If sensitive personal data is being processed, further conditions must be met before you start processing this data.

Legitimate interest

We will be processing data in relation to the services we provide (as outlined above) i.e. speech therapy/occupational therapy under this lawful basis. This means we must complete a Legitimate Interest Assessment which performs 3 tests. These are outlined below and the reasons why we have decided to process this type of data under this lawful basis:

a. Purpose test: are you pursuing a legitimate interest?

Yes, our legitimate interest is that we are providing a health/social care service to individuals and processing data is a necessary part of providing this service.

b. Necessity test: is the processing necessary for that purpose?

Yes, in order to safeguard the children and vulnerable adults we work with, and in order to provide a complete and efficient service we must process this data. With regards to our therapy service, HCPC (Health and Care Professions Council) Standards of Conduct, Performance and Ethics point 2.6 says we must share relevant information with colleagues involved in client care, and point 10.1 obliges us to keep full, clear and accurate records for everyone we care for, treat, or provide other services to.

c. Balancing test: do the individual’s interests override the legitimate interest?

A person entering into a service with us would reasonably expect their data to be processed in this way. Due to the sensitive nature of the data we collect there are measures in place to reduce the likelihood that the data collection will have any impact on the individual.

Special category data: Condition for processing

In order to process special category data we need to meet separate conditions, namely:

That processing is necessary for the purposes of preventive or occupational medicine, the provision of health or social care or treatment or the management of health or social care systems.

Your rights

Data protection legislation gives you various rights with regards to your data as follows:

The right to be informed
The right of access
The right to rectification
The right to object
Rights in relation to automated decision making and profiling

Consent

We will be processing some of our data under the lawful basis of consent, namely:

The use of data for marketing purposes
The use of audio/video recording of the individual and how this will be used

Please see a separate consent form attached to this privacy notice for more information about this.

Your rights

Your rights in relation to this specific data are as follows:

The right to be informed
The right of access
The right to rectification
The right to erasure
The right to restrict processing
The right to data portability
The right to object
Rights in relation to automated decision making and profiling

How to access an individual’s records

You can access the information we hold about you by writing to us at the address given below. Please apply in writing rather than by email, so that we receive an original signature to compare against the records we hold.

A copy of an individual’s records is provided free of charge.

We will provide access to the individual’s records within 30 days of receipt of all necessary information.

Please make your request in writing to:

Subject Access Requests

Speaking Space Ltd

Fleming House

Alma Road

Romsey

SO51 8ED

If you have any further questions about how we use your information, please contact naomi@speakingspace.co.uk.

Further information about data protection legislation and your rights is available from the Information Commissioner’s Office or by calling 0303 123 1113, 9am to 5pm, Monday to Friday. Speaking Space Ltd is registered with the Information Commissioner’s Office (ICO) as a Data Controller. You can view this ICO registration at: https://ico.org.uk/about-the-ico/what-we-do/register-of-data-controllers/

We regularly review, and where necessary, update our privacy information. We will communicate these changes to you when they occur.

Consent form

Photo / video / audio recording

Sometimes as part of our therapy we may wish to take photos or make video/digital recordings of some of the sessions between clients and therapists. We may use videos or photos to support therapy approaches, to reflect on therapy and/or to make notes in the client record. The videos may be used to train others such as teachers, teaching assistants and other professionals in strategies and activities to support speech, language and communication needs.

Videos or photos are temporarily stored on an individual’s one drive. If taken on a mobile device, they will be transferred onto one drive or SharePoint on a password protected laptop at the earliest opportunity and immediately deleted from the mobile device.

Marketing

Sometimes we would like to contact you to let you know about upcoming events at Speaking Space Ltd such as CPD days, parent forums, social skills training, Makaton, communication or autism training.