Data Protection Policy

This policy applies to all personal information Sensational Minds handles, in any format: our website and client portal, our clinical records system, emails, shared files, paper notes and phone calls.

It applies to everyone who works with us, including directors, employees, associate clinicians, assessors, coaches, contractors and volunteers.

• The UK General Data Protection Regulation (UK GDPR).
• The Data Protection Act 2018.
• The Privacy and Electronic Communications Regulations 2003 (PECR), for emails, marketing and cookies.
• The Data (Use and Access) Act 2025, as it comes into force.
• Guidance from the Information Commissioner's Office (ICO) and relevant professional bodies.

Sensational Minds is the data controller for the information in this policy. Our ICO registration number is ZA546008.

• Data Protection Lead: Rhiann Marchant (rhiann@sensationalminds.co.uk). Responsible for this policy, advice to staff, rights requests, breach handling and liaising with the ICO.
• Pathway and booking approvals: only Rhiann Marchant and Kim Johnson can confirm a client's assessment pathway or approve assessment bookings. The system enforces this.
• All staff and associates: follow this policy, only access information they need for their role, and report any concern or suspected breach straight away.

We make sure personal information is:

• Used lawfully, fairly and transparently.
• Collected for clear, specific purposes and not reused for something unrelated.
• Limited to what we actually need. For example, the GAD-7 and PHQ-9 mood questionnaires are only sent when mental health has been raised in a client's pre-assessment forms.
• Accurate and kept up to date.
• Kept no longer than needed, as set out in our Data Retention and Storage Policy.
• Kept secure against loss, misuse and unauthorised access.

We are also accountable: we keep records that show how we meet these principles.

Most of our work involves children. A parent or carer with parental responsibility normally acts for a child under 13. From around 13, and always from 16, we take account of a young person's own views about their information, in line with Gillick competence. We write child-facing materials in language they can understand.

• Client and staff areas of the website need a personal login. Access is controlled at database level so each client can only see their own forms and bookings.
• Staff access depends on their role. Nobody gets more access than they need.
• All information travels over encrypted connections (HTTPS) and is encrypted when stored by our providers.
• Pages holding personal information, and one-off links such as school questionnaires, are hidden from search engines. We do not use Google Analytics or any advertising tracking.
• Completed forms are copied to a private OneDrive folder for each client. The website can only add files there. It cannot browse or read anything else.
• Files uploaded by schools are stored in a private area that only staff can open.
• Staff use strong, unique passwords and two-step verification wherever it is available, and lock devices when away from them.
• Clinical information is never shared over unencrypted messaging apps or personal email accounts.

We use carefully chosen providers to run our services. Each one only acts on our instructions, under a written agreement. The full list of providers, and where they store information, is in our Data Retention and Storage Policy.

We only share a client's information with schools, GPs or other professionals with the client's (or parent's) agreement, unless the law requires it or someone is at risk of harm.

Our clinical records are held in the European Union, which the UK recognises as giving adequate protection. Where a provider stores information outside the UK or EU (for example our email newsletter provider, which is based in the United States), we make sure an approved safeguard is in place, such as the UK Extension to the EU-US Data Privacy Framework or the ICO's International Data Transfer Addendum.

Anyone can ask to see, correct, delete, restrict or move their information, or object to how we use it. Requests can be made in any form, spoken or written, to any member of staff. Staff must pass them to Rhiann Marchant the same day.

• We confirm the person's identity, and for a child, that the requester has parental responsibility.
• We reply within one month. For complex requests we can extend this by up to two further months and will say why.
• Requests are free unless they are clearly unfounded or excessive.
• We may hold back information that would cause serious harm or identify someone else, as the law allows.

A breach is anything that leads to personal information being lost, destroyed, changed, shared or seen when it should not be. For example, an email sent to the wrong person.

• Report it to Rhiann Marchant immediately, even if you are not sure.
• We act at once to contain it, for example recalling an email or removing access.
• We assess the risk. If it is likely to put people at risk, we tell the ICO within 72 hours of finding out.
• If the risk to people is high, we tell them directly without delay and explain what they can do.
• Every breach, reported or not, is recorded in our breach log with what we learned.

When we plan a new service, system or use of information, we think about privacy from the start. Where it could pose a high risk, for example new technology handling children's health information, we complete a Data Protection Impact Assessment before we begin.

• Everyone completes data protection training when they join, and refreshes it every year.
• Everyone signs a confidentiality agreement.
• Deliberately misusing personal information may lead to disciplinary action and may be a criminal offence.

We review this policy every year, or sooner if the law or our services change. Questions go to Rhiann Marchant at rhiann@sensationalminds.co.uk. If you are unhappy with how we handle your information, you can complain to the ICO at ico.org.uk or on 0303 123 1113.