Data Protection & Privacy

At Questioning Behaviour, I take the privacy, confidentiality and security of personal information seriously.

I collect and use personal information only when it is necessary to provide Speech and Language Therapy services, respond to enquiries, communicate with families and professionals, maintain appropriate clinical records, and meet my professional, legal and safeguarding responsibilities.

This privacy notice explains what information I may collect, why I collect it, how it is used, who it may be shared with, and your rights in relation to your personal information.

Questioning Behaviour is responsible for deciding how and why your personal information is collected and used.

Data Controller: Breeda McManamon, Questioning Behaviour
Email:
Telephone: 07891 147292

If you have any questions about how your information is handled, please contact me using the details above.

Depending on the service provided, I may collect information including:

Where appropriate, information may also be received from schools, local authorities, social care, Youth Justice Services, other health or care professionals and other organisations involved in supporting your child or young person.

Information may be provided directly by:

I may also receive information through professional referrals and reports supplied as part of an assessment or consultation.

I only seek information that is relevant and necessary for the service being provided.

I may use personal information to:

Under UK data protection law, I must have a lawful basis for collecting and using personal information.

Depending on the circumstances, the lawful basis may include:

The appropriate lawful basis will depend on the circumstances and the reason the information is being processed.

Some information I process, such as information about a person’s health, disability or medical needs, is classed as special category data under UK data protection law.

Special category data requires additional protection and an additional legal condition for processing.

Where I process health or other special category information, I will ensure that an appropriate condition under UK data protection law applies in addition to the relevant lawful basis.

I will only collect and use information that is relevant and necessary for the purpose for which it is being processed.

I maintain appropriate clinical and administrative records relating to the services I provide.

Clinical records may include assessment of information, reports, therapy plans, clinical observations, correspondence, and relevant information received from other professionals or organisations.

Records are stored securely, and access is restricted to information that is necessary for the provision and management of the service.

I will normally discuss information sharing with the child or young person, parent or carer, as appropriate.

Information may be shared with relevant professionals or organisations where this is necessary to provide the service and where an appropriate legal basis exists.

This may include, where relevant:

Reports will only be sent to the intended recipient or recipients and will be shared using appropriate methods.

I will not routinely share personal or clinical information for purposes unrelated to the provision of services.

Confidentiality is an important part of my professional practice.

However, confidentiality does not mean that information can never be shared.

There may be circumstances where I have a professional or legal responsibility to share information without consent, for example where there is a serious concern about the safety or wellbeing of a child, young person or another vulnerable person, or where disclosure is required by law.

Wherever possible and appropriate, I will explain this and discuss information sharing before it takes place.

In an emergency, information may need to be shared without prior discussion where this is necessary to protect someone’s safety.

I may use email to communicate with parents, carers, young people and professionals about appointments, referrals, reports and the provision of services.

I may also use WhatsApp where this has been agreed as an appropriate method of communication.

Because electronic communication carries some risk of unauthorised access or accidental disclosure, I will take reasonable steps to protect information when using these communication methods.

I will avoid including unnecessary clinical or sensitive information in routine messages and will use more secure methods where the nature of the information requires additional protection.

Clinical and administrative information may be stored electronically using secure computer and cloud-based systems.

I will take appropriate technical and organisational measures to protect personal information against loss, misuse, unauthorised access, alteration or disclosure.

Access to information will be appropriately restricted and protected using measures such as passwords and access controls.

Where payment is made by bank transfer, I may retain information necessary to record and reconcile payments and maintain appropriate financial records.

I will not collect or store bank card details where payment is made by bank transfer.

I will not keep personal information for longer than is necessary for the purpose for which it was collected.

Clinical records will be retained for an appropriate period in accordance with relevant professional, legal, regulatory and insurance requirements.

Administrative and financial records will also be retained for the period required to meet applicable legal and accounting obligations.

I will periodically review the information I hold and securely delete or destroy information when it is no longer required.

A detailed retention schedule will be maintained by Questioning Behaviour.

I take appropriate technical and organisational measures to protect personal information from:

I will only provide access to personal information where there is a legitimate reason for doing so.

Where a data breach occurs, I will assess the incident and take appropriate action in accordance with UK data protection requirements.

Under UK data protection law, you may have the right to:

These rights are subject to certain legal exemptions and may not apply in every circumstance.

If you wish to exercise any of your rights, please contact me using the contact details provided above.

I will respond to a valid data protection request without undue delay and, generally, within one month as required by law.

Questioning Behaviour provides services to children and young people.

I recognise that children and young people require particular care when their personal information is collected and used.

Information will be explained in a way that is appropriate to the child’s or young person’s age, understanding, and communication needs.

Children and young people will be involved in decisions about their information and their assessment or therapy wherever appropriate.

Information shared with me is treated confidentially and handled with care.

I will normally seek appropriate consent before sharing personal or clinical information with another professional or organisation.

However, information may be shared without consent where there is a legal requirement or where this is necessary to protect a child, young person, or another person from serious harm.

I will review this privacy notice regularly and update it when my services, information-handling arrangements, or relevant legal requirements change.

I may collect information that is necessary to provide a Speech and Language Therapy service. This may include your name and contact details, information about your child or young person, relevant medical or developmental information relating to their speech, language, communication, or swallowing needs.

I only collect and use information that is relevant and necessary for these purposes.

Information shared with me is treated as confidential. I will not normally share personal or clinical information without your consent, unless there is a legal or safeguarding reason that requires me to do so.

Where information needs to be shared with another professional or organisation, I will explain why this is necessary and seek appropriate consent wherever possible.

Clinical and administrative records are retained securely for an appropriate period in accordance with applicable legal, professional, and insurance requirements. When information is no longer required, it is securely deleted or destroyed.

Under UK data protection law, you have rights concerning your personal information. Depending on the circumstances, these may include the right to:

Some rights are subject to legal or professional requirements, so they may not apply in every circumstance.

If you have any questions about how your information is handled, please contact me. You also have the right to raise a concern with the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator.

Wycliffe House

Water Lane

Cheshire

SK9 5AF

Email: icocasework@ico.org.uk

Helpline: 0303 123 1113 (Monday to Friday 9am – 5pm)

Online: Live chat available on the official ICO Website https://ico.org.uk/