How we collect, use and protect your personal information

​

Sussex Speech Studio Ltd is committed to protecting your privacy and respecting your personal information. This policy explains how we collect, use and store your data when you use our services or visit our website.

​

1. Who we are (data controller)

Sussex Speech Studio Ltd provides independent speech and language therapy services to children and families. Services are delivered by Margaret Shaw, BSc (Hons) Speech Sciences, CertMRCSLT, HCPC Reg. SL09968.

Data controller: Margaret Shaw (Director) — registered with the ICO, registration number ZB551542.
Contact: margaret@sussexspeechstudio.com · 07472 367193

​

2. The information we collect

We may collect:

• Contact details (name, address, phone number, email)

• Child information (name, date of birth, relevant health, developmental and educational information)

• Referral/background details and reports from other professionals (with consent)

• Session records (assessment data, notes, therapy plans, outcome measures, progress summaries)

• Administrative information (appointments, invoices, payments)

• Website and forms data (basic analytics and cookies; enquiries sent via our contact form)

​

3. How we collect information

• Directly from you (enquiries, forms, email/phone, during sessions)

• From other professionals (with your consent)

• Automatically when you use our website (via cookies/analytics)

• Through online forms and secure email (messages sent via the contact page go directly to our secure Google Workspace email and are not stored on the website server)

​

4. Why we use your information (purposes)

We use personal information to:

• provide speech and language therapy (assessment, planning, intervention and review)

• keep accurate clinical records in line with professional and legal requirements

• communicate with you about progress and appointments

• write reports and, with consent, share recommendations with relevant professionals

• manage billing and accounting

• maintain and improve our website and service

We only collect information that is relevant to providing safe and effective therapy.

​

5. Lawful bases for processing

Under the UK GDPR we rely on one or more of the following:

• Contract (to provide requested assessment and therapy)

• Legitimate interests (to manage the practice and ensure safe, effective care)

• Legal obligation (e.g. safeguarding, tax and accounting requirements)

• Consent (for sharing information with schools/other professionals or for specific additional purposes). You can withdraw consent at any time.

• Vital interests (rarely, where necessary to protect someone’s life)

​

6. How we store and protect information

• Electronic records are stored securely within WriteUpp (GDPR-compliant clinical software).

• We use Google Workspace and Adobe Acrobat Pro for Teams for secure communication and document handling. Files are moved into WriteUpp and removed from email once safely uploaded.

• Paper records (if any) are stored securely with restricted access.

• Devices are password-protected and encrypted where possible; access is limited to authorised personnel.

• We review storage and disposal regularly in line with professional guidance.

• Backups are kept within encrypted, password-protected systems that meet UK GDPR and recognised industry standards.

​

7. Sharing information

We share personal information only when necessary and with your knowledge/consent, for example with:

• schools, SENDCos, NHS colleagues and other professionals involved in care

• GPs or other services if agreed or where required for safeguarding

• trusted service providers who process data on our behalf to run the practice

Our current processors include:

• WriteUpp (clinical records and scheduling)

• Google Workspace (email and file storage)

• Adobe Acrobat Pro for Teams (secure documents)

• Wix (website hosting/analytics)

• Accounting software (invoicing and bookkeeping)

All providers we use have GDPR-compliant Data Processing Agreements (DPAs). We never sell personal information or share it for marketing purposes. Sensitive information may be shared using encrypted documents or secure portals.

​

8. International transfers

Some service providers may store or access data outside the UK. Where this happens, we use appropriate safeguards (such as ICO-approved standard contractual clauses) to protect your information.

​

9. How long we keep information

Clinical records are retained for seven years after discharge, or until age 25 for children (whichever is longer), in line with professional and legal requirements. Administrative records (e.g. invoices) are kept as required for tax and accounting.

​

10. Your rights

You have the right to:

• request access to your information and a copy of it

• ask us to correct inaccurate information

• request deletion (in some circumstances)

• restrict or object to processing

• request data portability (for information you provided)

To exercise your rights, contact us using the details above. You can also complain to the Information Commissioner’s Office (ICO) at ico.org.uk or 0303 123 1113 if you are unhappy with how we use your data.

​

11. Children and young people

We work with children and young people. We seek consent from parents/carers and, where appropriate, the child/young person’s own views and consent.

​

12. Cookies

Our website uses cookies for essential functionality and anonymous analytics. You can control cookies via your browser and through our on-site cookies banner. For more information, please see our Cookies policy.

​

13. External links

Our website may contain links to external websites operated by other organisations (such as professional bodies or safeguarding organisations). We have no control over the content or privacy practices of these websites and are not responsible for their privacy policies. We encourage you to read the privacy notices of any external sites you visit.

​

14. Changes to this policy

We may update this policy from time to time. Any changes will be posted here with a new “last updated” date.​

Contact: margaret@sussexspeechstudio.com · 07472 367193

​

Last updated: December 2025