GDPR Privacy Notice

We provide individuals with all the following privacy information

The name and contact details of our organisation:

The name of our organisation is Ace Children’s Occupational Therapy Limited
Registered Address: 4 The Courtyard, Clare Park Farm, Crondall, Hampshire, GU10 5DT
Postal Address: 4 The Courtyard, Clare Park Farm, Crondall, Hampshire, GU10 5DT
Telephone Number: 01252 691133
Registered in England and Wales No: 8384511

The contact details of our data protection officer:
Our Data Protection Officer is Fay Parker, who may be contacted at fay.parker@acecot.biz

The purposes of the processing:
The data we hold is used to process information about the children who receive our occupational therapy services

The lawful basis for the processing:
Parents or guardians consent for us to use data about their children either through this Consent form or electronically via our WriteUpp Care Management System. Ace Children’s Occupational Therapy will only process children’s data where specific informed consent has been obtained. We have a legitimate interest in collecting, processing and retaining all data provided. This is managed according to: HealthCare Professions Council (HCPC) standards, the Royal College of Occupational Therapists (RCoT) Professional standards, and the principles of the Caldicott Guidelines, 2013. We have a legitimate interest in collecting, processing and retaining the personal data of parents and guardians themselves who provide their own personal data to us for the purposes of registering their child

The categories of personal data obtained:
All data obtained about the children we deliver services to is either provided by: parents or guardians, County Councils or NHS, third parties where the parents or guardians have consented for the exchange of data for the benefit of treating their children

The recipients or categories of recipients of the personal data:
The recipients of personal data are the parents or guardians of the children we treat, county councils, NHS and any other parties we are authorised to share this data with

The details of transfers of the personal data to any third countries or
international organisations:
Children’s data would never be exchanged with any third countries or international organisations without the explicit consent of the parent or guardian

The retention periods for the personal data:
Paper-based and electronic data is held until the child’s 25th birthday, as specified by (HCPC)

The rights available to individuals in respect of the processing:
Parents or guardians have a right to access data held about their child. This is provided electronically in one or more ‘zip’ files

The right to withdraw consent:
The “right to be forgotten” policy does not apply to children’s data under HCPC legislation even where they cease to be a client. Data must be retained until the child’s 25th birthday (csp.org.uk)

The right to lodge a complaint with a supervisory authority:
Parents or Guardians are entitled to lodge a complaint with the Information Commissioner’s Office (ico.org.uk) if they perceive data about their children has not been managed according to GDPR

The source of the personal data (if the personal data is not obtained from the individual it relates to):
All data obtained about the children we deliver services to is either provided by: parents or guardians, County Councils or NHS, third parties where the parents or guardians have consented for the exchange of data for the benefit of treating their children

The details of the existence of automated decision-making, including profiling:
Data held about the children we deliver services to is never used and will never be used to support any form of decision making or direct marketing which would contravene both GDPR, the professional accreditation held by our staff and the high ethical standards by which we conduct our organisation

Technical and Organisational Security Measures: We adhere to the standards recommended by: HCPC, RCoT and the ICO

• Paper documents are stored in locked metal filing cabinets – documents must be retained even after scanning
• Our email, care management system and document repository are all managed via subscription-based, industry-standard, password-protected secure cloud-based providers
• Our ICO registration has been maintained ever since Ace Children’s OT was formed
• No unencrypted child data is held locally on OTs’ laptops or personal devices