Privacy Policy

Speech Matters Speech Therapy Ltd

Speech Matters Speech Therapy delivers independent speech and language therapy to
primarily adults in the home, community setting or clinic. It is owned and directed by Victoria
Allanson who is registered with the Health and Care Professions Council (HCPC), Royal
College of Speech and Language Therapists (RCSLT) and the Association of Independent
Speech and Language Therapists (ASLTIP).
Speech Matters Speech Therapy is committed to protecting the privacy and confidentiality of
all personal information provided by clients, their families and carers.

Collection of Personal Information
Information about you, your child or your family member may be collected via spoken or
written information provided by you, parents or carers. With your consent (or that of a
parent/guardian), information may also be collected from other professionals involved in their
care, such as teachers, nursery staff, medical professionals, NHS Speech and Language
Therapists and ENT Consultants. We may also collect relevant information about family
members, for example contact details and relevant medical or developmental history.
You may visit the Speech Matters Speech Therapy website without providing any personal
information. However, if you wish to make an enquiry via the website, you will be asked to
provide relevant contact details — such as your name, email address and telephone number
— to allow us to respond. If your enquiry does not result in an assessment or therapy being
provided, this personal information will be deleted once the enquiry has been resolved.
If you, your child or your family member subsequently receives services from Speech
Matters Speech Therapy, these details may be added to their personal record. The website
contains links to external websites outside our control. We are not responsible for data you
provide through those linked sites.
Use of Personal Information
Personal information collected via the Speech Matters Speech Therapy website, email,
telephone or in person is stored and used solely for the purpose of delivering therapy
services. Any sensitive personal information is held in a secure and confidential system and
processed in confidence. It will only be used for the purpose of providing appropriate therapy
services.
With your consent, information about your or your family member’s needs may be shared
with other professionals involved in their care, where it is in their best interests. A record of
your consent is kept with the relevant case notes.

Unless required to do so by law, we will not disclose personal information to any person
other than as described in this policy.
Important notice regarding our Virtual Assistant: Speech Matters Speech Therapy uses a
human virtual assistant (VA) to support administrative functions. The VA may have access to
certain personal information, including contact details and appointment information, where
this is necessary to carry out administrative tasks on our behalf. The VA acts as a data
processor and is bound by a formal Data Processing Agreement (DPA) requiring them to
handle all personal data securely, confidentially, and in compliance with UK GDPR. The VA
will not access clinical records, therapy reports or sensitive health data unless separately
consented to in writing. We do not permit the VA to use your personal data for any purpose
other than completing the administrative tasks we have assigned.

How Personal Information Is Used
We use personal information for the following purposes:
• To prepare, plan and provide therapy services appropriate for you or your family
member
• To communicate with you via post, email, telephone or SMS in relation to:
◦ Confirming and preparing for appointments
◦ General communication between appointments
◦ Sending reports and programmes (always password protected)
◦ Copying you into communications with other professionals (initials rather than full
names are used in emails)
◦ Sending resources, invoices and receipts
• For clinical audit to assess and improve our service. Results of audits are always
presented with all client identities removed
• For management and administration, for example names are included in our
password-protected accounting database
• To enable our virtual assistant to carry out administrative tasks on our behalf, such
as scheduling and correspondence, in accordance with their Data Processing
Agreement
Wherever personal identifiers are not required for these tasks, we remove them from the
information we use.
How Personal Information Is Stored
All information about you, your child or your family member is stored securely to ensure we
hold a complete record of the service provided. We use a secure, cloud-based electronic
system that is compliant with UK General Data Protection Regulations (UK GDPR). Prior to
being uploaded to this system, documents may be temporarily stored on a password-
protected cloud-based platform. Documents containing confidential information, such as
reports and programmes, are individually password protected from the outset. Any paper-
based confidential information, such as assessments, is stored securely in accordance with
Data Protection Regulations.

The minimum amount of confidential information is taken out of the therapist’s office base.
When information is taken off-site, it will be kept with the health professional or locked in the
boot of their car, whichever is deemed most secure at the time.
In accordance with legal requirements, all records are kept securely for seven years, or in
the case of a child, until they reach the age of 25. After this time, all records will be securely
destroyed.

Third-Party Data Processors
We use the following third-party processors who may handle personal data on our behalf:
• A human virtual assistant (VA), engaged under a formal Data Processing Agreement,
who supports administrative functions only
• A cloud-based practice management and record-keeping system, which is UK
GDPR-compliant
• A password-protected cloud storage platform used for the temporary storage of
documents
All third-party processors are required to process personal data only on our documented
instructions, to maintain appropriate security measures, and to comply with UK GDPR. We
do not sell, rent or share client data with any other third party.
Meeting Professional Obligations
It is a legal requirement for all Speech and Language Therapists and health professionals to
be registered with the Health and Care Professions Council (HCPC). The HCPC sets clear
standards of conduct, performance and ethics that all registrants must adhere to.
These standards affect the way we process and share information. In particular:
Standard 2 — Communicate appropriately and effectively
“You must share relevant information, where appropriate, with colleagues involved in the
care, treatment or other services provided to a service user.”
Standard 10 — Keep records of your work
“You must keep full, clear and accurate records for everyone you care for, treat or provide
other services to. You must complete all records promptly and as soon as possible after
providing care, treatment or other services. You must keep records secure by protecting
them from loss, damage or inappropriate access.”
Further information is available at: http://www.hcpc-
uk.org/assets/documents/10004EDFStandardsofconduct.performanceandethics.pdf
UK Data Protection Law and UK GDPR

Data protection law sets out wide-ranging rules, backed by legal sanctions, for the
processing of information about identifiable living individuals. It also gives individuals certain
rights in relation to personal data held about them.
Victoria Allanson is registered with the Information Commissioner’s Office (ICO) as a Data
Controller.

Lawful Basis for Processing Personal Information
Our lawful basis for processing and storing personal information is ‘legitimate interests’
(under Article 6 of UK GDPR). We cannot adequately deliver a service without processing
your personal information. As this is both a necessity for service delivery and of benefit to
the client, we have a legitimate interest to process and store that data.
Data relating to an individual’s health is classified as ‘Special Category Data’ under Article 9
of the UK GDPR. Health professionals who are legally bound to professional secrecy may
have a lawful basis for processing such data. As health professionals legally required to
maintain client confidentiality, we process and store personal health information on this
basis.
Data Breach Procedure
In the unlikely event of a data breach involving your personal information, we will assess the
risk to individuals promptly. Where a breach is likely to result in a risk to your rights and
freedoms, we are legally required to report it to the Information Commissioner’s Office (ICO)
within 72 hours of becoming aware of it. If the breach is likely to result in a high risk to you,
we will also notify you directly without undue delay, and advise you of the steps you may
take to protect yourself.
Our Responsibilities
We are committed to maintaining the security and confidentiality of your records. We actively
implement security measures to ensure information is protected and audit these regularly.
We will not release your personal details to any third party without first seeking your consent,
unless we are permitted or required to do so by law. We are continually working to ensure
compliance with current data protection legislation.
Your Rights
UK data protection legislation gives you, as a client, parent or carer, a number of important
rights:
• The right to access a copy of the information we hold about you or your family
member
• The right to have inaccurate information corrected

• The right to request erasure of your personal data (‘the right to be forgotten’), subject
to our legal obligations to retain records
• The right to restrict processing of your data in certain circumstances
• The right to object to processing based on legitimate interests
• The right to data portability (to receive your data in a structured, commonly used
format)
• The right to lodge a complaint with the Information Commissioner’s Office (ICO)
Please note that some of these rights are qualified. For example, we may be required by law
or professional regulation to retain records for a specified period, which may limit your right
to erasure.

How to Access Your Records
You can request access to the information we hold about you by contacting us at:
• victoria.allanson.slt@gmail.com
• sophiariozzislt@hotmail.com
We may ask you to provide identification before releasing records, to verify your identity. A
copy of your records is provided free of charge. We will respond to your request within 30
days of receipt of all necessary information.
For further information about data protection and your rights, please visit www.ico.org.uk or
contact the ICO on 0303 123 1113 (Monday to Friday, 9am to 5pm).
Providing Consent
By signing the Terms and Conditions document, you are confirming that:
• You understand that Speech Matters Speech Therapy will store and process your
personal information as described in this policy
• You consent to information being shared with other relevant professionals as
deemed appropriate and in the best interests of the client
• You agree to Speech Matters Speech Therapy using email as a form of
communication with you and other professionals as described above
• You acknowledge that a human virtual assistant, acting as a data processor under a
formal Data Processing Agreement, may have access to administrative personal data
(such as contact details and appointment information) in order to support the running
of the service

Speech Matters Speech Therapy | Victoria Allanson | HCPC Registered | RCSLT Member | ASLTIP Member