Data Protection.

Types of information processed

Once consent has been given for the Educational Psychologist to be involved with a child or young person, we collect, hold and use information about them.

This information may include their name, address, date of birth, assessment findings, health, medical and care details, views, and family background. Some of it may be sensitive — for example safeguarding information — and most of it is personal data, meaning information that can be used to identify someone.

As well as information about the child or young person, we may gather personal information about other people, such as family members. We only collect and use this where it is relevant to the child or young person’s circumstances and to the reason Educational Psychology involvement was requested.

How information is collected

We collect information about the child or young person directly from them, and indirectly from other sources — for example a parent/carer or other professionals involved with them.

Why information is collected and used

We collect and use information to inform the Educational Psychologist’s understanding of the child or young person’s needs, so that we can give relevant, well-informed advice to you and to other adults working with them.

We will not use personal data for unrelated purposes. We may use records where necessary for safeguarding, legal, regulatory, professional, insurance, audit or complaint-handling purposes. The Educational Psychologist becomes involved with a child only once signed consent has been received from a parent/carer or another adult with parental responsibility.

Who information is shared with

We share some or all of the information we hold with the child or young person the work is about (depending on their age and understanding) and with the organisation or person that requested Educational Psychology involvement.

We will not share information with other parties without the consent of parents/carers, except in the exceptional circumstances where the law allows or requires us to.

Those exceptional circumstances include where there is an immediate risk of substantial harm to the child or young person or to others; where there is a legal requirement to disclose (for example in relation to terrorism or money laundering); or where a court orders disclosure.

Why we share information

We share information so that the child or young person’s needs can be understood and met.

How information is stored

Information is held in paper and electronic form. Paper records are locked in a cupboard or filing cabinet. Electronic records are held on access-controlled, password-protected systems, and referral data is held on the practice’s own equipment in the UK (see Security).

We keep information only for as long as it is reasonably needed for the purposes set out in this notice, and in line with our professional record-keeping obligations. It may sometimes be necessary to keep records after a piece of work has ended — for example to provide an accurate record in the event of a query, complaint or further involvement. Our specific retention periods are set out under Storage & retention below.

Requesting access to personal data

Under data protection law, individuals have the right to ask for access to the personal information we hold about them. To make a request — or to ask for access to your child’s records — contact Dr Joe White using the contact details at the top of this notice.

You also have the right to:

• object to processing that is likely to cause, or is causing, damage or distress;
• object to processing for direct marketing (we do not use personal data for marketing);
• object to decisions made by solely automated means;
• in certain circumstances, have inaccurate personal data rectified, or have data restricted or erased;
• seek redress through the Information Commissioner’s Office or through the courts;
• raise any concern or complaint with Fieldfare Psychology in the first instance.

How these rights apply to children and young people is explained under Your rights, and how to complain.

Website, cookies and external services

This website does not use analytics or advertising cookies, and does not track visitors for marketing. We use only what is needed for the website and referral form to work.

The site currently loads its fonts from Google Fonts. This means a visitor’s browser makes a request to Google’s servers, which may receive the visitor’s IP address. We keep this under review and may move to self-hosted fonts to remove that request.

How we handle online referrals

The sections above describe our general approach. This part of the notice explains specifically how we handle the information submitted through our online referral form and the documents uploaded with it. It covers the referrer, the child or young person the referral is about, and the person giving consent (for example a parent/carer).

This service is for children and young people aged 0–25. Where we say “child” we mean the child or young person the referral is about. How data-protection rights apply to children — and who can exercise them — is explained under Your rights, and how to complain.

What the referral form collects

When a referrer (for example a SENCo or school) submits the form, we collect:

• About the referrer: name and contact details (email and/or phone).
• About the child or young person: name, date of birth, school, year group, and a short free-text reason for the referral.
• Uploaded documents: a signed consent form (required) and any optional supporting documents — for example school reports or prior assessments — that the referrer chooses to share.
• Limited technical information: to keep the form secure and prevent spam, basic anti-abuse measures such as rate limiting may briefly process limited technical data, such as an IP address.

Special-category data. The child’s details, the reason for referral and the uploaded documents are likely to reveal information about a child’s health, disability or special educational needs (SEND). This is “special-category data” under Article 9 of the UK GDPR and is given extra protection, so we identify both an Article 6 lawful basis and a separate Article 9 condition before we process it (see Lawful basis below). We deliberately collect only what we need — to identify the child or young person, contact the referrer and triage the referral — to keep the amount of special-category data we hold to a minimum.

Why we use referral information

We use the information submitted through the referral form to:

• receive, log and triage the referral, and decide whether we can accept it;
• contact the referrer about the referral;
• where the referral proceeds, carry out and record an Educational Psychology / SEND assessment;
• contact the named school as part of the assessment, where consent has been given;
• keep proper professional and business records and meet our professional, legal and safeguarding obligations;
• maintain the security and integrity of the system, including an audit log of staff access.

Lawful basis for referral data

Fieldfare Psychology seeks consent before beginning Educational Psychology involvement, and the referral process is built around a signed consent form. Consent matters to how we work. For UK GDPR purposes, we also rely on lawful bases that allow us to keep proper professional records.

We process referral and assessment information because it is necessary to provide our Educational Psychology and SEND assessment services, to manage referrals, to communicate with referrers and families, to maintain professional records, and to meet our safeguarding, legal, regulatory, insurance and complaint-handling obligations.

Ordinary personal data

For ordinary personal data, we rely on one or more of the following, depending on the situation:

• Article 6(1)(b) — contract: where the work is commissioned by or for the family or client, processing is necessary to take steps at their request and to provide the service.
• Article 6(1)(f) — legitimate interests: where it is necessary to run the practice responsibly and to create and keep accurate professional records.
• Article 6(1)(c) — legal obligation: where a specific legal requirement applies to what we do with the information.

Special-category data

Health, disability, SEND, safeguarding and assessment information may be special-category data. Where appropriate we rely on Article 9(2)(h) (provision of health or social care and professional services), with the safeguards required under the Data Protection Act 2018. For specific activities or sharing, we may also seek explicit consent under Article 9(2)(a) — but consent is not the only basis on which we keep professional records.

You do not have to make a referral, and there is no statutory requirement to do so. However, the fields on the form and the signed consent form are necessary to make and process a referral; without them we cannot accept or act on it.

Withdrawing consent

You can withdraw consent to Educational Psychology involvement at any time. Withdrawing consent may mean we stop further work. It does not automatically require us to delete professional records already created, where there is an overriding legal, professional, safeguarding, insurance or complaint-handling reason to keep them. Withdrawing consent does not affect anything done lawfully beforehand.

Who we share referral data with, and our processors

• The practice’s clinicians. The referral and its documents are accessed only by our small clinical team, through a private, access-controlled portal.
• The child or young person’s school. Where you consent, we may contact the named school as part of the assessment.
• No routine sharing otherwise. We do not sell personal data or share it for marketing.
• Safeguarding and legal disclosures. We may disclose information where the law requires or permits, or where it is necessary to protect a child or another person from harm (for example to a local authority’s children’s social care / MASH or the police). The referral form is not for emergencies or urgent safeguarding concerns.
• Local-authority-commissioned referrals. Where a referral is commissioned by a local authority, the local authority may also be a recipient and may set its own terms for how the information is handled.

Processors (organisations that process data on our behalf)

• Referral data is stored on our own equipment. Referral information and uploaded documents are stored on the practice’s own equipment in the UK (an on-premises server and a local encrypted backup). For the referral data itself there is no third-party cloud processor.
• Email notifications — Brevo. Internal notification emails are sent via Brevo, if Brevo is the chosen provider. These emails prompt a clinician to log in to the portal. They must not contain child names, referral reasons, uploaded documents, school names or any other referral content. Brevo therefore processes staff email addresses and notification metadata only — never your information or the child’s.

Storage & retention

Where it is stored. Referral data and documents are held on-premises in the UK on the practice’s own server, with backups on a local encrypted drive kept on the same premises. Referral and child data does not leave the UK.

International transfers. None for referral or child data. The only information leaving the practice’s own equipment is the staff email addresses used for the internal notifications described above (see processors).

How long we keep it. We keep information only as long as necessary, in line with our professional record-keeping obligations:

• Referrals that do not proceed (declined, withdrawn, duplicate or ineligible): deleted 6 months after the decision, unless we need to keep them for complaint, safeguarding, audit or legal reasons.
• Referrals that proceed to EP involvement: retained in line with professional record-keeping requirements, normally until the young person’s 25th birthday (or their 26th birthday if they were 17 at our last contact), or 7 years after our last contact, whichever is later.
• Consent forms and uploaded documents: retained as part of the referral / assessment record they belong to.
• Audit logs: retained for 12 months.
• Backups: deleted data ages out of our backups after 30 days.
• Commissioned referrals: where a local authority or other commissioner imposes a different contractual retention period, the relevant contract may apply.

How we keep referral data secure

We use technical and organisational measures designed to protect referral data, including:

• an on-premises server in the UK, rather than a public cloud;
• encryption at rest and in transit (HTTPS / TLS);
• an access-controlled clinician portal that is private and not exposed to the public internet;
• multi-factor authentication for clinician logins;
• a default-deny design, so the public form can submit a referral but cannot read referral data back;
• documents downloaded only through short-lived, signed links after a clinician has signed in;
• audit logging of staff access, downloads and deletions;
• encrypted local backups.

No system can be guaranteed to be completely risk-free, but we use technical and organisational measures designed to protect personal data and keep these under review.

Automated decision-making. We do not make decisions about you or the child or young person by solely automated means that produce legal or similarly significant effects. All decisions about a referral are made by our clinicians.

Your rights, and how to complain

Depending on the lawful basis we rely on, you have the right to be informed about how we use personal data, to access the data we hold, to ask us to rectify or erase it, to restrict or object to our processing, to data portability (where it applies), and to withdraw consent at any time where we rely on consent. Withdrawing consent does not affect processing already carried out lawfully beforehand. These mirror the rights set out under Requesting access to personal data above.

Children and young people

Children and young people have data-protection rights in relation to their own personal data. In practice:

• a person with parental responsibility may usually exercise these rights on behalf of a younger child;
• a child or young person with sufficient understanding may exercise their own rights;
• we will consider the child or young person’s age, understanding, wishes and best interests when responding to a rights request.

If you withdraw consent or ask us to erase data, we may still need to keep certain information where we have an overriding legal, professional, safeguarding, insurance or complaint-handling reason to do so (for example a professional record we are required to retain).

To exercise any right, contact Dr Joe White using the contact details at the top of this notice. We will respond within one month.

Complaints. If you have a concern about how we handle personal data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF — helpline 0303 123 1113, ico.org.uk/make-a-complaint.