Data Retention and Storage Policy
Sensational Minds, Colchester, Essex
Draft for internal review. This document is not yet approved for publication. It contains items marked for confirmation, it has not been reviewed by a qualified legal adviser, and it is set not to appear in search engines until Sensational Minds confirms the outstanding details.
| Policy title | Data Retention and Storage Policy |
|---|---|
| Organisation | Sensational Minds Ltd (company no. 11981130) |
| Version | 1.0 |
| Effective date | 23 September 2026 |
| Date last reviewed | 23 September 2026 |
| Next scheduled review | September 2027, or sooner if the law or our services change |
| Policy owner | Rhiann Marchant, Data Protection Lead and Designated Safeguarding Lead |
| Contact for questions | rhiann@sensationalminds.co.uk |
In plain English
This page tells you exactly where your information lives, who can see it and how long we keep it. We only keep information for as long as we genuinely need it, then we delete it securely.
1. Purpose
This policy supports our Data Protection Policy. It applies to every record we hold, digital or paper.
2. Where your information is stored
| System | What it holds | Where it is stored |
|---|---|---|
| Our website and client portal (Lovable Cloud) | Enquiries, client accounts, intake forms, pre-assessment questionnaires, assessment bookings, school questionnaire uploads, job applications, screening results and Learning Hub accounts | Item to confirm before publication: [CONFIRM BEFORE PUBLICATION: database region and transfer safeguards] |
| WriteUpp | Clinical records, assessment notes and reports | European Union (Dublin and Amsterdam) |
| Microsoft OneDrive | A copy of each completed pre-assessment form, in a private folder for each client | Microsoft 365 data centres (UK or EU for UK business accounts) |
| Mailchimp | Newsletter subscribers who have opted in | United States, under UK transfer safeguards |
| Messages to and from bookings@, hello@ and staff mailboxes, plus automatic notifications from the website | Item to confirm before publication: [CONFIRM BEFORE PUBLICATION: email provider and region] |
We do not keep paper records unless there is no alternative. Any paper is stored in a locked cabinet and scanned then shredded as soon as possible.
3. Who can see it
- Clients can only see their own forms and bookings, through their own login.
- Schools can only use the single questionnaire link they were sent. They cannot see anything else.
- Staff see what they need for their role. Only Rhiann Marchant and Kim Johnson can confirm assessment pathways and approve bookings.
- The website can add files to OneDrive but cannot read or browse it.
4. How long we keep it
| Record | How long we keep it | Why |
|---|---|---|
| Clinical records and reports for children | Until the young person's 25th birthday (or 26th if they were 17 when their care ended) | NHS and professional records guidance |
| Clinical records and reports for adults | 8 years after our work ends | NHS and professional records guidance |
| Intake and pre-assessment forms in the client portal | 12 months after the assessment is completed, then removed from the portal. The OneDrive copy forms part of the clinical record. | Needed to finish the assessment and answer questions about it |
| School questionnaires and uploads | Kept with the clinical record, as above | Part of the assessment evidence |
| Assessment booking records | 2 years after the appointment | Service administration and resolving queries |
| Enquiries that do not lead to a service | 12 months from last contact | So we can pick up where we left off |
| Online screener results | 12 months | To follow up if you asked us to |
| Corporate audit results | 2 years | To support the organisation's follow-up work |
| Newsletter subscribers | Until you unsubscribe | Consent |
| Unsuccessful job applications and CVs | 6 months after the decision | To respond to any challenge to the decision |
| Staff and associate records | 6 years after they leave | Employment and tax law |
| Invoices and financial records | 6 years after the end of the financial year | HMRC requirements |
| Complaints | 6 years after the complaint is closed | Legal claims time limits |
| Safeguarding records | Until the child's 25th birthday, or 6 years for an adult, or longer where required by a statutory body | Safeguarding guidance |
| Client portal and Learning Hub accounts | Deleted on request, or after 2 years without a sign-in | No longer needed |
| Data breach and rights request logs | 6 years | Showing we meet the law |
5. Secure deletion
- Digital records are permanently deleted from our systems. Backups are overwritten on the provider's normal cycle.
- Paper is cross-cut shredded or destroyed by a certified confidential waste service.
- Old devices are securely wiped before disposal.
- When we stop using a provider, we make sure our data is returned or deleted.
6. Keeping records for longer
We may keep a record longer if there is an ongoing complaint, legal claim, safeguarding investigation or public inquiry that needs it. Rhiann Marchant must agree any extension and we note the reason.
7. Review
We review this policy and carry out a check of stored records every year.
Questions about this policy
If anything here is unclear, please contact us and we will explain it. Please do not send detailed clinical, safeguarding or identifiable health information by general email. We will agree a secure way to share sensitive information where required.