CHILDREN’S SENSORY THERAPY LTD

GENERAL PRIVACY NOTICE (2025)

Including services delivered as part of CST’s therapy assessment and treatment provision

 

1. What is Personal Data?

“Personal data” refers to any information about a living individual that enables them to be identified. This includes names, addresses, photographs, videos, and contact details. It may also include indirect identifiers, such as ID numbers or data combinations that could identify someone.

The processing of personal data is governed by the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and associated laws including the Human Rights Act.

2. Who Are We?

This privacy notice is issued by Children’s Sensory Therapy Ltd, which acts as the Data Controller for all personal data collected and processed through our therapy assessment and treatment services.
We may work alongside other organisations who also act as Data Controllers, including:

  • Local authorities
  • Mainstream and specialist schools (e.g. SENCOs)
  • NHS bodies and allied health professionals
  • Community organisations and charities
  • Contractors and commissioned service providers
  • Credit reference agencies (for funding or invoicing purposes)

Where data is shared for joint purposes, CST and other parties may act as joint Data Controllers and are collectively responsible for ensuring data protection.

3. What Data Do We Collect and Why?

We collect and process the following data to support effective therapy planning and delivery:

Personal data

  • Name, contact details, date of birth, and identifiers
  • Referrer and educational setting (if applicable)
  • Developmental and medical history
  • Functional, sensory, emotional, and behavioural information
  • Family background, where relevant
  • Financial/payment details (if applicable)

Special category (sensitive) data

  • Health and developmental diagnoses (e.g. Autism, ADHD)
  • Risk or safeguarding concerns
  • Ethnicity, religion, or cultural background
  • Multi-agency involvement or social care input

4. How Do We Use Your Data?

We collect and use personal data only where it is necessary to:

  • Deliver therapy assessments and intervention tailored to the individual’s needs
  • Fulfil legal, ethical, and safeguarding obligations
  • Liaise with your child’s educational or health team where appropriate
  • Maintain accurate records and contribute to continuous service improvement
  • Communicate with you about sessions, progress, and outcomes
  • Prepare professional reports or referrals, with your consent

Sensitive data is only processed where permitted under UK law, such as:

  • With your explicit consent
  • To safeguard health and wellbeing
  • For the purpose of clinical diagnosis or care
  • To comply with legal duties

We may also use anonymised data for service planning, research, or evaluation.

5. Legal Basis for Processing

We rely on one or more of the following legal bases to process your data:

  • Consent – when you’ve clearly agreed
  • Contract – to deliver agreed therapeutic services
  • Legal obligation – where we must meet statutory responsibilities
  • Vital interests – to protect life or serious wellbeing risks
  • Public interest – in safeguarding or care planning contexts

6. Sharing Personal Data

We only share data when necessary and appropriate, such as with:

  • Local authorities (e.g. referrals, EHCPs, safeguarding)
  • Schools or SENCOs (for planning and progress updates)
  • NHS professionals or multi-agency teams
  • Administrative or IT service providers working on our behalf
  • Legal bodies or inspectors, if required

All partners are contractually obliged to protect your data.

7. Data Security and Retention

Your personal data is stored securely and retained only for as long as needed. Retention periods are guided by:

  • Legal and regulatory requirements
  • Best practice (e.g. 8 years for therapy records)
  • The need to respond to or defend against future claims

After these timeframes, data is securely destroyed or anonymised.

8. Your Rights

You have the right to:

  1. Request access to your personal data
  2. Ask for corrections to inaccurate or incomplete data
  3. Request deletion of your data (where legally possible)
  4. Object to or limit how your data is used
  5. Request data transfer to another provider
  6. Withdraw your consent at any time
  7. Make a complaint to the Information Commissioner’s Office (ICO)

To exercise these rights, we may ask for proof of identity.

9. Data Transfers Outside the UK

We will only transfer your data outside the UK or EEA if adequate protections are in place, such as secure platforms or data-sharing agreements. Some of our digital tools (e.g. email, video platforms) may be accessible abroad.

10. Further Use of Your Data

If we plan to use your data in a way not covered by this notice, we will provide a separate privacy notice and request your consent where appropriate.

11. Updates to This Notice

We regularly review this Privacy Notice to ensure it remains accurate and up to date.
Last updated: May 2025

 

12. Contact Us

If you have any questions or wish to exercise your rights, please contact:
Data Controller
Children’s Sensory Therapy Ltd
📧 office@childrenssensorytherapy.co.uk