Privacy Policy

This privacy policy tells you what to expect us to do with your personal information when you contact us or use our service.

WHO WE ARE

Ready Steady Talk SLT Ltd is a company registered in England and Wales (Company No. 17116509). We deliver independent speech, language and communication assessment and therapy to children in the home and/or educational setting.

The company is owned and managed by Kimberley Saunders, Specialist Speech and Language Therapist, who is registered with the Health and Care Professions Council (HCPC) and is a member of the Royal College of Speech and Language Therapists (RCSLT) and the Association of Speech and Language Therapists in Independent Practice (ASLTIP).

We operate a website at www.readysteadytalk.co.uk and are committed to protecting the privacy of information provided by our clients and prospective clients.

HOW WE COLLECT PERSONAL INFORMATION

Most information is provided directly by you, because:

• you have made an enquiry about our services;
• you have made a referral for speech and language assessment or therapy; or
• your child is receiving, or has received, our services.

Some information may come from other sources, such as therapy sessions (observations and clinical assessments) and reports or letters from other professionals (e.g. schools, GPs, paediatricians, NHS therapists). Information about your child may be collected in spoken or written form from parents/legal guardians and through clinical sessions, and — with consent — from other professionals involved in your child's care.

If an enquiry does not result in your child being seen, the personal data is deleted one month after the enquiry is resolved. If services proceed, the information is added to the clinical record.

CATEGORIES OF PERSONAL DATA WE OBTAIN

• Child's personal information
• Parent/guardian contact details
• Child's health and developmental information
• Family health/developmental history
• Professional contact details

HOW WE USE PERSONAL INFORMATION

We use personal information to deliver our services and monitor their quality, specifically to: assess and plan appropriate therapy; communicate about appointments and care; share reports and programmes; liaise with other professionals (with consent); and send invoices and relevant resources. Sensitive information is stored securely and processed confidentially.

HOW WE STORE PERSONAL INFORMATION

We store clinical records in a secure, GDPR-compliant clinical records system (Cliniko).

Where paper documents need to be digitised, this is done using secure, GDPR-compliant scanning tools. Depending on the setting, a scan may be saved to the therapist's own encrypted, password-protected device, or sent by the scanning app to the therapist's secure email address. In either case, the scan is then uploaded to the child's clinical record and deleted from the device, email and scanning app. Any copies held by the scanning-app provider are governed by our data-processing agreement with them.

Where a child attends a school that contracts our services, scanning may instead be carried out using the school's own systems. In that case, a scanned record may be sent to a member of school staff (usually, though not always, the SENCo) before being forwarded to the therapist and uploaded to the child's clinical record. While the information is held in the school's systems, the school acts as a separate data controller, and we ask that such records are handled on a need-to-know basis and shared only with the therapist.

Paper records are securely stored, scanned, and then confidentially destroyed. Devices and email accounts used to access personal information are encrypted and/or password-protected.

RECORDINGS

Any video or audio recording of a child is normally made using the parent or guardian's own device, rather than ours. Where a recording is needed for clinical purposes, individual consent is obtained on a case-by-case basis. Where any recording is held by us, it is stored securely and deleted within 24 hours of clinical use.

KEEPING INFORMATION SECURE IN TRANSIT

Sensitive or identifiable information is not sent by ordinary, unencrypted email. Where we need to send reports or records electronically, we use secure or encrypted email, or password-protected attachments with the password shared separately, and we include only the minimum information necessary.

SHARING INFORMATION WITHIN EDUCATIONAL SETTINGS

Where your child is seen in school, we may scan or share documents (such as reports, targets, consent forms or records) with relevant staff, such as the SENCo or class teacher, so that support is consistent. We share only what is needed, on a need-to-know basis, and use secure or password-protected methods wherever possible. Once information is shared with the school, the school is a separate data controller, responsible for how it stores, uses and forwards that information under its own privacy policy and retention rules. We ask schools to limit onward sharing to those who need the information to support your child.

WORKING WITH ASSOCIATE THERAPISTS AND SUPPORT

From time to time, reports and documents may be shared with associate speech and language therapists, clinical supervisors or administrative support who work with us under a written contract requiring them to protect your information. This may include sharing a draft report for formatting, proofreading, peer review or a second opinion. Where such documents are sent electronically, we use encryption or password protection and share the password separately. They may only use the information to carry out work on our behalf and must securely delete or return it afterwards.

WHO ELSE WE MAY SHARE INFORMATION WITH

We may also share information with approved data processors (under contract), other professionals involved in your child's care (with consent), and clinical supervisors (for professional requirements). We will never share your data for marketing purposes. Information may be disclosed without consent where required by law or by our safeguarding duties.

INTERNATIONAL TRANSFERS

Some of the systems we use may store data on servers outside the UK. Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place — such as a UK adequacy decision or standard contractual clauses / an international data transfer agreement — so your information receives an equivalent level of protection.

RETENTION OF PERSONAL DATA

• Clinical records: until the child's 25th birthday (26 if discharged at 17)
• Referral information not resulting in a service: 1 month
• Financial records: 5 years after the relevant tax return

Because we are professionally and legally required to keep clinical records for a set period, we may not be able to delete a clinical record on request until the end of the retention period.

DATA BREACHES

We have procedures to detect, report and investigate personal data breaches. Where a breach is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner's Office within 72 hours, and will inform you without undue delay where the breach is likely to result in a high risk to you.

THE LAWFUL BASES FOR PROCESSING

We process personal data under the following lawful bases: legitimate interests (assessing referrals, delivering services and monitoring quality); contract (where processing is necessary to provide agreed services); consent (where you have given clear permission); and legal obligation (financial and regulatory requirements). As a healthcare provider, we process special category (health) data for the provision of health care under UK GDPR Article 9(2)(h) and the associated condition in Schedule 1 of the Data Protection Act 2018, and rely on the safeguarding condition where we make disclosures to protect a child.

YOUR DATA PROTECTION RIGHTS

Under data protection law you have the right of access, to rectification, to erasure (where applicable), to restrict processing, to object, to data portability, and to withdraw consent. As children get older, a child who is considered competent to do so may exercise these rights themselves. You are not required to pay a charge to exercise your rights, and we have one calendar month to respond. Please contact us (details below) to make a request.

DATA CONTROLLER DETAILS

Ready Steady Talk SLT Ltd is the Data Controller for the personal information we process, and is registered with the ICO (registration number ZB313688). For any data protection query, contact Kimberley Saunders at kimberley@readysteadytalk.co.uk.

HOW TO ACCESS YOUR CHILD'S RECORDS

You can request access to your child's records in writing. We will respond within one calendar month of receiving all the information we need to process your request.

COMPLAINTS

Parents, carers and professionals are encouraged to raise concerns as early as possible. Please contact us first at kimberley@readysteadytalk.co.uk so we can try to resolve things informally. If a concern cannot be resolved, you may contact ASLTIP or the HCPC; for concerns about data handling, you may contact the Information Commissioner's Office.

COOKIES

Our website is hosted by Lovable. We use necessary cookies to support core functionality, and analytics/performance cookies to understand website usage only where you have given consent via our cookie banner. You can change your cookie preferences at any time.