Julie Storr (JAS Speech and Language Therapy) is registered with the Information Commissioner's Office (ICO) as a Data Controller. Julie Storr assumes the function of data controller and supervises the compliance with the General Data Protection Regulation (GDPR) within the business. This Privacy Policy explains what Personal Data JAS Speech & Language Therapy holds, why we hold and process it, who we might share it with and your rights and freedoms under the Law. Please contact us with any queries.
JAS Speech and Language Therapy provides independent speech and language therapy to children in the home, clinical setting and/or educational setting. It is managed by Julie Storr, Speech and Language Therapist, who is registered with the Health and Care Professions Council (HCPC), is a member of the Royal College of Speech & Language Therapists (RCSLT) and a member of the Association of Speech and Language Therapists in Private Practice (ASLTIP).
JAS Speech and Language Therapy operates a website at www.jas-slt.co.uk.
JAS Speech and Language Therapy is committed to protecting the privacy of information provided by clients.
OUR LAWFUL BASIS FOR PROCESSING PERSONAL INFORMATION
We process and store personal information to comply with our legal obligations.
It is a legal requirement for all Speech and Language Therapists to be registered with the Health and Care Professions Council (HCPC). The HCPC has clear standards of conduct, performance and ethics that all registrants must adhere to.
For further information the full document can be found at: Speech and language therapists | (hcpc-uk.org)
1. TYPES OF PERSONAL DATA
JAS Speech and Language Therapy holds personal data as part of conducting a professional service. The data follows under the following headings: healthcare records, educational records, clinical records, general administrative records and financial records.
1.1 Healthcare records
A healthcare record refers to all information collected, processed and held both in manual and electronic formats pertaining to the service user and their care. Speech and language problems can be complex, and a wide range of information may be collected in order to best meet the needs of the client, and to maintain a high quality service which meets best practice requirements. In order to provide a high quality service, a range of information may be collected.
Examples of data collected and held on all current and active clients include the following:
- Contact details: Name, address, phone numbers, e-mail address,
- Personal details: date of birth
- Other contacts: name and contact details of GP and any other relevant healthcare professionals involved, e.g., Specialist Advisory Teachers, Health Visitors.
- Parent/guardian details
- Description of family
- Educational placements
- Pre- and post-natal history: This can include information relating to mother’s pregnancy, and child’s birth.
- Developmental data: developmental milestones, feeding history, audiology history.
- Medical details: such as any relevant illnesses, medications, and relevant family history.
- Reports from other relevant allied health professionals such as: Audiology, Psychology, CAMHS (Child & Adolescent Mental Health Services), Occupational therapy, physiotherapy, Paediatricians, Specialist Advisory Teachers.
1.2 Educational records
Relevant Individual Educational Plans (IEPs), progress notes from educational staff and school reports may be held.
1.3 Clinical records
Specific data in relation to communication skills will be collected and held, such as assessment forms, reports, case notes, e-mails, text messages. Audio and video files may also be collected and stored.
1.4 General administrative records
JAS Speech and Language Therapy may hold information regarding attendance reports and accident report forms.
1.5 Financial records
A financial record pertains to all financial information concerning the practice, e.g. invoices, receipts, information for HMRC. JAS Speech and Language Therapy may hold data in relation to: on-line purchasing history, card payments, bank details, receipts and invoices. Information will include name of bill payer, client name, address and record of invoices and payments made.
2 WHERE WE GET OUR INFORMATION
Personal data will be provided by a child’s (under 18 years) parent(s)/guardian(s). This information will be collected as part of a case history form prior to, or on the date of first contact. Personal information may also be collected via the JAS Speech and Language Therapy website, email, telephone or SMS.
With parental consent, information may also be collected from other professionals working with your child (such as teachers, nursery staff, childminders, NHS Speech and Language Therapists, Specialist Advisory Teachers). We may also collect information about family members where this relates to your child e.g. contact details for parents and relevant medical or developmental history.
You may use the JAS Speech and Language Therapy website without providing any personal information. However, if you wish to make an enquiry via the website, you are requested to provide relevant contact details, such as your name, e-mail address and contact telephone number to enable us to respond to your enquiry. You may add comments or queries which might also contain personal information.
By providing personal information for initial contact by SMS, voicemail, phone call, e-mail or website enquiry you are consenting to personal details for yourself and your child being held temporarily by JAS Speech and Language Therapy. If your enquiry does not result in your child being seen by JAS Speech and Language Therapy then this personal information will be deleted once your enquiry has been dealt with. If your child is subsequently seen by JAS Speech and Language Therapy these details may be added to their personal record.
www.jas-slt.co.uk website contains links to other Internet sites which are outside our control and are not covered by this Privacy Policy. We are not responsible for data which you provide through any such linked websites.
3 HOW WE USE THE INFORMATION THAT WE COLLECT
We use the information we collect to provide assessment and therapy as per the relevant professional guidelines, as well as to maintain the general running of the business, such as keeping our accounts and updating you of any changes in policies or fees.
Examples of how we use this information:
- To prepare, plan and provide speech and language therapy services appropriate for your child’s needs.
- To communicate with you via post, email, telephone, mobile messages and SMS in relation to:
- confirming and preparing for appointments
- general communication in between appointments
- sending you reports and programmes for your child (which will be password protected if sent via e mail)
- copying you in to communications with other professionals involved with your child (your child’s initials or first name, rather than full name will be used in emails)
- sending you resources
- sending you invoices
- For clinical audit to assess and improve our service. Results of audits are always presented with all client identities removed.
- For management and administration, for example, surnames are used on invoices.
Whenever personal identifiers are not needed for these tasks, if possible we remove them from the information we use.
Information may also be used for research purposes, with the written consent of the client or parent/guardian.
3.1 Data retention periods
Following the retention deadline, all data will be destroyed under confidential means.
3.2 Client Records
3.2.1 Clinical Records (including contact data)
JAS Speech & Language Therapy keeps both physical and electronic records of clinical data in order to provide a service.
- Clinical data is deleted/confidentially destroyed once a child reaches the age of 25 years or 7 years after therapy has ceased for adults, whichever is the longer time.
- Video and audio recordings relating to client care may be recorded with consent, analysed and then stored as part of the child’s electronic record until they reach 25 years of age (or destroyed if no longer needed). If written consent is provided to use recordings for training purposes, the client will have the option to withdraw consent at any time.
3.2.2 Financial Records
JAS Speech & Language Therapy keeps paper and electronic records of financial data from those who use our services.
- Financial Data is kept for 6 years to adhere to HMRC guidelines. These requirements apply to manual and electronic records equally.
- Financial Data (including non-payment of bills) can be provided at HMRC’s request.
3.3 Exceptions
If under investigation or if litigation is likely, files must be held in original form indefinitely, otherwise files are held for the minimum periods set out above.
4 INFORMATION WE SHARE
We do not share personal information with companies, organisations and individuals outside JAS Speech & Language Therapy unless one of the following circumstances apply:
4.1 With your consent:
We will only share your Personal Identifying Information (PII) to third parties when we have written permission. We require opt-in consent for the sharing of any sensitive information.
Third parties may include: hospitals, GPs, Specialist Advisory Teachers, Educational Psychologists, other allied health professionals, educational facilities.
4.2 For legal reasons:
We will share personal information with companies or organisations outside of JAS Speech & Language Therapy if disclosure of the information is reasonably necessary to:
- Meet any applicable law, regulation, legal process or enforceable governmental request.
- Please note that if information is disclosed which relates to a child protection issue it is the duty of care of the professional to disclose this information to the appropriate authority in accordance with the Safeguarding Children Act 2004.
- To protect against harm to the rights, property or safety of JAS Speech & Language therapy, our service users or the public as required or permitted by law.
4.3 To meet financial requirements:
JAS Speech & Language Therapy also is required to share financial data with Marrs Accountancy in order to comply with local tax laws. JAS Speech & Language Therapy is aware of Marrs Accountancy’s own Data protection policy.
5 HOW AND WHEN WE OBTAIN CONSENT
Prior to initial assessment or consultation, clients will be directed to JAS SLT’s privacy policy and Terms and Conditions via the website. A consent form will need to be signed by parents/guardians prior to commencing the service or at the start of the initial consultation.
Should a client wish to withdraw their consent for data to be processed, they can do so by contacting JAS Speech & Language Therapy at any time.
6 HOW WE PROTECT YOUR DATA
In accordance with the General Data Protection Regulation (GDPR), we will endeavour to protect your personal data in a number of ways:
6.1 By limiting the data that we collect in the first instance
All data collected by us will be collected solely for the purposes set out at 1 above and will be collected for specified, explicit and legitimate purposes. Furthermore, all data collected by us will be adequate, relevant and limited to what is necessary in relation to the purposes for which it is collected which include the assessment, diagnosis and treatment of speech, language and communication disorders.
6.2 By transmitting the data in certain specified circumstances only
Data will only be share and transmitted, be it on paper or electronically only as is required, and as set out in section 3.
6.3 By keeping only the data that is required
when it is required and by limiting its accessibility to any other third parties.
6.4 By disposing of/destroying the data once the individual has ceased receiving treatment
Section 3 outlines retention periods for different kinds of data. We will put in place appropriate technical measures to ensure a level of security appropriate to the risk. These will include measures such as safe and secure storage facilities for paper/electronic records.
6.5 By retaining the data for only as long as is required
which in this case is until a child reaches 25 years or 7 years after therapy has ceased for adults, whichever time is longer, except for circumstances in which retention of data is required in certain specific circumstances as set out at Article 23(1) of the GDPR.
6.6 By destroying the data securely and confidentially after the period of retention has elapsed.
This could include the use of confidential shredding facilities or, if requested by the individual, the return of personal records to the individual.
6.7 By ensuring that any personal data collected and retained is both accurate and up-to-date.
7 PROTECTING YOUR RIGHTS TO DATA
Data access requests can be made by a child’s (under 18) parents/guardians.
8 SECURITY
JAS Speech & Language Therapy, as with most providers of healthcare services, is aware of the need for privacy. As such, we aim to practise privacy by design as a default approach, and only obtain and retain the information needed to provide you with the best possible service.
All data used by JAS Speech & Language Therapy, including personal data may be retained in any of the following formats:
1. Electronic Data
2. Physical Files
The type of format for storing the data is decided based on the format the data exists in.
Where applicable, JAS Speech & Language Therapy may convert physical files to electronic records to allow us to provide a better service to clients.
8.1 Data Security
JAS Speech & Language Therapy understands that the personal data used in order to provide a service belongs to the individuals involved. The following outlines the steps which JAS Speech & Language Therapy uses to ensure that the data is kept safe.
All information about you, your child and their speech and language therapy is stored securely in our systems to ensure that we have a complete record of our service to them.
WriteUpp, a secure online practice management software, is used to manage client records, scheduling, and communication. WriteUpp is a trusted platform designed to ensure the confidentiality and security of your personal information. When you engage with our services, your personal and health information will be stored and processed within WriteUpp to facilitate the provision of speech and language therapy services. WriteUpp operates in compliance with data protection laws and adheres to strict security protocols to safeguard your information. Prior to being uploaded to the system, documents are temporarily stored on a cloud based system which is only accessible via a password held by myself.
If you have any questions or concerns about the use of WriteUpp or how your information is managed within the platform, please feel free to contact us.
Any physical records are also stored securely, in accordance with Data Protection Regulations.
The minimum amount of confidential information will be taken out of the Speech and Language Therapist’s office base.
Client phone numbers may be stored on a mobile telephone and text messages sent to JAS Speech and Language Therapy may remain on the telephone. JAS Speech and Language Therapy will only refer to your child by initial or first name in text. The mobile phone is passcode protected.
Videos and audio recordings may be taken with parental consent. Recordings will be made and stored on a password protected tablet or phone, owned by Julie Storr, and can also be made by you and sent via WhatsApp. Recordings will either be deleted once they are no longer required (e.g., if only needed for transcription purposes) or transferred onto the child’s electronic record.
Electronic data is contained in the following system, provided by Sensible IT Solutions:
SITS Cloud – used for e-mail hosting and back-up
- This system is physically located in the United Kingdom.
- This system provider is aware of their requirements for GDPR compliance.
- The system has an Internal administrator / Database owner.
- This system has a Live Update for security enabled.
- All persons working in Sensible IT Solutions have read/write/delete access to records.
- All persons require a Log on and Password in order to access the records.
- A copy of the files are not made on the users’ computers when in use.
- The data controller in Sensible IT Solutions can remove or delete users.
- The data controller in Sensible IT Solutions can change users’ passwords.
- Sensible IT Solutions performs the backup of data on an incremental basis. All data is encrypted and securely stored in an in-house data centre.
A contract exists between SITS Cloud and JAS Speech & Language Therapy and access is limited to what is agreed in said contract.
8.2 Security Policy
8.2.1 JAS Speech & Language Therapy understands that requirements for electronic and physical storage may change with time and the state of the art. As such, Julie Storr reviews the electronic and physical storage options available annually.
8.2.2 JAS Speech & Language Therapy is aware of and refreshes the requirements for good data hygiene regularly. This includes, but is not limited to:
- Awareness of client conversations in unsecure locations.
- Enabling auto-lock on devices when leaving them unattended, even within JAS Speech & Language Therapy locations.
- Use of non-identifiable note taking options. (initials, not names).
- A procedure should a possible data breach occur, either through malicious (theft) or accident (loss) of devices or physical files.
9 YOUR RIGHTS
Data protection legislation gives parents/guardians various rights. The most important of these are as follows:
- You have the right to be informed about the personal data we hold and why we hold it.
- You have the right to access a copy of your/your child’s data that we hold by contacting us directly.
- You have the right to ask for your record to be amended if you believe that it is wrong.
- You have the right to have your data erased in certain circumstances.
- You have the right to transfer your data to someone else if you tell us to do so and it is safe and legal to do so.
- You have the right to tell us not to actively process or update your data in certain circumstances.
10 HOW TO ACCESS YOUR CHILD’S DATA
You can access the information we hold about you by writing to us at the address given below. Please apply in writing rather than by email, so that we receive an original signature to compare against the records we hold.
A copy of your child’s records is provided free of charge.
We will provide access to your child’s records within 30 days of receipt of all necessary information.
Please make your request in writing to:
JAS Speech and Language Therapy
Cobblestone Barn
Laversdale
Carlisle
Cumbria
CA6 4PJ
If you have any further questions about how we use your information, please contact:
Further information about data protection legislation and your rights is available from the Information Commissioner's Office or by calling 0303 123 1113, 9am to 5pm, Monday to Friday.
We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. and we will notify you of any material changes via email or through other appropriate channels.
