Data Protection and Privacy Policy

Introduction

Iman Merali, Director of SPEECHIZM, is a qualified and independent Speech and Language Therapist. Iman Merali is registered with the Health and Care Professions Council (HCPC), the Royal College of Speech and Language Therapists (RCSLT), and the Association of Speech and Language Therapists in Independent Practice (ASLTIP). In addition, Iman Merali is a Registered Data Controller with the Information Commissioner's Office (ICO), the Data Protection Supervisory Authority for England and Wales (SPEECHIZM Registration number: ZB621001).

SPEECHIZM is committed to protecting the privacy of the information provided by its clients, and will only use information collected lawfully in accordance with:

• The Data Protection Act (2018)
• The General Data Protection Regulation (GDPR, 2018)
• The guidelines set out by the Information Commissioner's Office (ICO)
• The professional guidelines and requirements as set out by the Royal College of Speech and Language Therapists (RCSLT), the Health and Care Professions Council (HCPC) and the Association of Speech and Language Therapists in Independent Practice (ASLTIP).

Collection of personal information

Client information

SPEECHIZM collects personal information during the intake and assessment process, which may include names, contact details, medical history, and relevant background information.

Session records

Information related to therapy sessions, progress notes, and treatment plans will be recorded to track the student's progress and ensure effective therapy.

By providing personal information for initial contact by text, voicemail, phone call, email or the website contact form, the client is consenting to personal details for themselves, and their child, being held temporarily by SPEECHIZM. If the client's enquiry does not result in any further contact, then this personal information will be deleted.

How information is used*

Treatment purposes

Personal information is primarily used for the purpose of providing speech therapy services, tailoring sessions to individual needs, and tracking progress.

Communication

SPEECHIZM may use client contact information to communicate with the client regarding appointments, updates, or any other relevant information.

*Information may also be used for the purpose of clinical audit (to assess and improve the SPEECHIZM service). Results of audits will always be presented with all client identities removed.

Any sensitive personal details are stored in a secure and confidential system and processed in confidence by Iman Merali, and shall only be used for the purposes of delivering appropriate speech and language therapy services to the child/student.

A record of your consent is kept within your child's case notes. Unless SPEECHIZM is required to do so by law, we will not disclose any personal information collected to any person other than as set out above.

We do not employ agents to process personal data, for example specialist mailing companies to send out communications. We do not give or sell client details to any third parties.

How information is stored

Confidentiality

The client's personal information is treated with the utmost confidentiality. SPEECHIZM adheres to professional standards and legal requirements regarding the protection of client information.

Security measures

SPEECHIZM has implemented reasonable security measures to protect against unauthorised access, disclosure, alteration, or destruction of the client's personal information.

All information about you, your child and their speech and language therapy is stored securely in our systems to ensure that we have a complete record of our service to them. SPEECHIZM uses Outlook 365, a secure electronic cloud-based system which is compliant with General Data Protection Regulations.

Documents which contain confidential information such as reports and programmes are also individually password protected from the outset. Any paper-based confidential information such as assessments is stored securely in accordance with Data Protection Regulations.

Client phone numbers are not stored on a mobile phone; however, text messages sent to SPEECHIZM may remain on the telephone. SPEECHIZM will only refer to your child by initial or first name in text. The mobile phone is encrypted with thumbprint recognition and passcode.

Video/audio recordings may be taken of clients with parental consent. These are temporarily stored on an encrypted and password-protected tablet. These may then be viewed by the therapist in order to make notes in a client record within 24 hours of the child's appointment. The video is then deleted.

The minimum amount of confidential information will be taken out of the Speech and Language Therapist's office base. When your child's information is taken out of the office base it will be kept with the Speech and Language Therapist or will be locked in the boot of the Speech and Language Therapist's car (whichever is deemed to be the most secure at that time).

How long information is stored

In accordance with professional guidelines, all records will be kept securely until your child is 25 years old. After this time all records relating to your child will be destroyed.

Sharing of information

Third parties

We do not disclose your personal information to third parties without your explicit consent, except where required by law.

With your consent, information about your child's speech and language needs will be shared with other professionals involved in your child's care, when it is in your child's best interests.

Our lawful basis for processing personal information

SPEECHIZM's lawful basis for processing and storing personal information is one of 'legitimate interest' (under Article 6 of GDPR). We cannot adequately deliver a service to your child without processing their personal information. As it is both a necessity for our service delivery and of benefit to your child, we have a legitimate interest to process and store their data. Data relating to an individual's health is classified as 'Special Category Data' under Article 9 of the GDPR. The regulations specify that health professionals who are "legally bound to professional secrecy" may have a lawful basis for processing this data. Speech and Language Therapists are legally bound to keep client information confidential, and it is under this condition that we process and store personal information.

Our responsibilities

SPEECHIZM is committed to maintaining the security and confidentiality of your child's records. We actively implement security measures to ensure their information is safe, and audit these regularly. We are constantly working to ensure compliance with current data protection regulation.

Your rights

Data Protection legislation gives you, the parent/carer and client, various rights (GDPR, 2018). These rights are as follows:

• The right to be informed
• The right to access
• The right to rectification
• The right to erasure
• The right to restrict processing
• The right to data portability
• The right to object
• The right not to be subject to automated decision-making including profiling

How to access your child's records

According to the Information Commissioner's Office (ICO) and their code of practice for subject access requests, you have the right to a copy of the information we hold about your care, in addition to the right to ask for it to be amended if you feel it is incorrect.

A copy of your records is provided free of charge, within 30 days of receipt of all necessary information. Please make your request in writing via email to iman@speechizm.co.uk, including the following information: your name, your correspondence address, your contact number and email address, and the details of the information requested.

Complaints

If you are not satisfied with the processing of your personal data as set out within this Privacy Policy, please contact us directly using the contact details below. Additionally, you have the right to issue a complaint directly with the ICO:

Data breach

SPEECHIZM makes all reasonable endeavours to ensure that there are no personal data breaches.

In the unlikely event that someone unauthorised accesses the data SPEECHIZM holds, you will be informed of the breach and the steps taken to address it. Any breach will be reported to the Information Commissioner's Office in accordance with the law.

Changes to the privacy policy

This Privacy Policy may be updated periodically. The latest version will be shared with clients with the date of the last update.

Withdrawal of consent

You may withdraw your consent for the collection and processing of your personal information at any time.

By engaging with SPEECHIZM's speech and language therapy services, the client acknowledges that they have read and understood this Privacy Policy. If the client has any questions, concerns, or requests regarding their privacy or this Privacy Policy, please contact SPEECHIZM using the following contact details: