Privacy Notice

Sensational Minds is a specialist neurodevelopmental assessment and support organisation based in Colchester, Essex. The details below identify the organisation responsible for the personal information described in this notice.

This notice may apply to:

• Website visitors
• People making enquiries
• Prospective clients
• Clients and service users
• Parents and carers
• Children and young people
• Informants, such as a partner, relative or friend who contributes information to an assessment
• Education professionals
• Referrers
• Schools and education settings
• Corporate contacts
• Course and training enquiries
• Suppliers and professional partners

Sensational Minds works with associate practitioners as well as any directly employed staff. Information about people who work with or for the organisation is handled separately: We are confirming this with the supplier and will update this notice.

We only ask for what we need for the service you are enquiring about or using. Not every category below will apply to you.

Identity and contact information

• Name
• Address
• Telephone number
• Email address
• Date of birth
• Preferred contact method

Enquiry information

• Service of interest
• General reason for the enquiry
• Preferred appointment information
• Organisation and job role for business, school and corporate enquiries

Clinical and neurodevelopmental information

Where relevant to a service we have accepted, this may include:

• Developmental information
• Medical and mental health history
• Neurodevelopmental information
• Assessment responses
• Questionnaires
• Practitioner observations
• Reports
• Diagnostic information
• Recommendations
• Relevant educational information

Information about health, including neurodevelopmental and mental health information, is special-category information under UK data protection law. It is treated with additional care, access is limited to those who need it for your care or for managing the service, and an additional condition for processing must apply alongside a lawful basis.

Child and family information

• Information supplied by a parent or a person with parental responsibility
• Relevant developmental and educational information
• Details provided by an informant
• School or professional information
• Family information that is relevant to the service being provided

Education information

• School details
• Attendance information
• SEN Support information
• Education, Health and Care Plan information
• Teacher questionnaires
• School reports
• Provision and adjustment information

Payment and transaction information

How payments are taken, and what is stored, depends on the payment provider used: We are confirming this with the supplier and will update this notice.

Website and technical information

• IP address
• Browser and device information
• Cookie preferences
• Website activity
• Security and diagnostic information

Our cookie policy explains this in more detail.

Communications

• Emails
• Telephone notes
• Enquiry records
• Appointment communications
• Complaints and feedback

Depending on the service, information may come:

• Directly from you
• From a parent or carer
• From an informant
• From a school or education setting
• From a referring clinician or professional
• From a commissioning organisation, such as an employer or school that has arranged the service
• Through website forms
• Through questionnaires
• Through appointments and assessment sessions
• Through approved third-party systems used to deliver the service

Where information comes from someone other than you, we should only obtain it where there is an appropriate basis for doing so, for example your consent, the consent of a person with parental responsibility, or a professional referral that forms part of the agreed pathway.

UK data protection law requires a lawful basis for each use of personal information, and an additional condition for special-category information such as health information. The exact bases relied on by Sensational Minds for each activity must be confirmed and recorded before this notice is published:

We are confirming this with the supplier and will update this notice.

Where we rely on consent, you can withdraw it at any time. Withdrawing consent does not affect anything done before you withdrew it, and it may mean we cannot continue with part of a service.

Where we work with children and young people, information is usually provided by a person with parental responsibility. We explain to young people, in a way suited to their age and understanding, what will happen with their information.

Where a young person is able to understand and make their own decisions about a particular matter, their views carry weight, and we consider this in line with recognised competence principles. Detail of how consent and access are handled in practice, including access requests by parents to a young person's information, is set out in our internal procedures: We are confirming this with the supplier and will update this notice.

Information may be shared, where appropriate and with a proper basis, with:

• The practitioners involved in your assessment or support, including associate practitioners working with Sensational Minds
• Administrative team members who arrange appointments and manage records
• A school or education setting, where you have agreed to this or it forms part of the agreed pathway
• A GP or another health professional, where you have agreed to this
• A partner organisation you have asked us to refer you to, with your written consent
• An organisation that has commissioned a service, limited to what is necessary and agreed
• Suppliers who provide the systems we use to deliver the service
• Professional advisers, regulators or authorities, where there is a legal or safeguarding reason

We do not sell personal information, and we do not share it for other organisations' marketing. Where a referral to a medication provider or other partner is discussed, information is only shared with your written consent, and we do not share recordings or transcripts.

We use secure systems to manage enquiries, records, questionnaires, document sharing and appointments. These may include a clinical record system, secure video meetings and email.

Clinical questionnaires, records and secure document sharing may involve WriteUpp, which is described in detail in section 10. We have confirmed with WriteUpp that patient data for our account is hosted on servers within the European Union, in Dublin and Amsterdam. WriteUpp publishes a list of the subprocessor organisations it uses, summarised in section 10. The current WriteUpp contract and Data Processing Agreement must still be confirmed, along with the international transfer arrangements: We are confirming this with the supplier and will update this notice.

Where appointments are held by video, this is usually on Microsoft Teams. Meetings are only recorded or transcribed with consent, for accurate record keeping. The systems we use are:

• Our website and client portal, where you complete intake forms, pre-assessment questionnaires and booking requests. Only you and authorised staff can see your forms.
• Microsoft OneDrive, where a copy of each completed pre-assessment form is saved in a private folder for each client. The website can add files there but cannot read anything.
• WriteUpp, our clinical record system (section 10).
• Microsoft Teams for video appointments.
• Mailchimp, only if you sign up to our newsletter.
• Email, including automatic notifications when forms are submitted or bookings are made.

Each supplier only acts on our instructions. Where they are stored is set out in our Data Retention and Storage Policy.

[DO NOT PUBLISH UNTIL THE REMAINING WRITEUPP ACCOUNT, INTERNATIONAL-TRANSFER SAFEGUARD, RETENTION AND END-OF-CONTRACT DETAILS HAVE BEEN VERIFIED. EU HOSTING (DUBLIN AND AMSTERDAM) HAS BEEN CONFIRMED.]

Sensational Minds uses WriteUpp for the storage and management of clinical information. WriteUpp may also be used to send, receive and store clinical questionnaires, and to share documents securely in connection with assessment or support services.

Please read this carefully. A clinical records platform that is aimed at UK services, and that describes itself as UK facing, does not necessarily mean that every item of personal information is stored exclusively in the United Kingdom. Cloud hosting and supplier arrangements can involve information being stored or processed in other countries. WriteUpp’s published privacy policy states that patient data is stored on servers within the European Union, in Dublin and Amsterdam, rather than in the United Kingdom. We have now confirmed with WriteUpp that, for our account, patient data is hosted within the European Union in Dublin and Amsterdam. WriteUpp also publishes a list of the subprocessor organisations it uses, set out below. The specific international-transfer mechanism, our account-level configuration and the end-of-contract arrangements still need to be confirmed in writing against our contract and Data Processing Agreement.

What WriteUpp’s published privacy policy states

The following points are taken from WriteUpp’s publicly available privacy policy at writeupp.com/privacy and from confirmation supplied to Sensational Minds. The hosting location has been confirmed for our account. Other points below have not yet been confirmed against our own contract and account arrangements, and they may change.

• WriteUpp is operated by Pathway Software (UK) Limited.
• For information about the clients of a practice, WriteUpp describes itself as acting as a processor on the instructions of the practice, with no direct relationship with those individuals.
• Patient data is stored on secure servers within the European Union, namely Dublin and Amsterdam, in a managed data centre with physical security controls. Sensational Minds has confirmed this hosting position for its own account.
• WriteUpp states that many of its own third-party suppliers are based outside the UK, that it will only transfer personal data to countries deemed to provide an adequate level of protection, and that it will otherwise put appropriate safeguards and transfer mechanisms in place. The specific mechanism is not named in the published policy and must be requested.
• WriteUpp states that it may perform weekly backups of patient data, that backups are retained on its backup systems for two years, that they are held in a non-readable binary form, and that for technical reasons they cannot be deleted before that two-year period expires.
• WriteUpp states that hosting, back-up and other IT suppliers may have access to personal data held by it. WriteUpp publishes a subprocessor list in its helpdesk, which is summarised below.

Two points follow from this that we want to be open about. First, the confirmed hosting position is European Union hosting (Dublin and Amsterdam) rather than United Kingdom only hosting. Second, because backups are retained for two years and cannot be deleted earlier, a deletion request will not always remove information from backups immediately. We are confirming the remaining account, transfer and end-of-contract details in writing with WriteUpp before this notice is published.

WriteUpp’s published subprocessor list

WriteUpp publishes a list of the subprocessor organisations it uses in its helpdesk article “Who are your sub-processors?”, dated 17 September 2025. For the service it provides to practices, where WriteUpp acts as processor, the published list is:

• Microsoft Azure, hosting.
• Twilio, messaging.
• Postmark, messaging.
• Stripe, payment processing, where enabled by the practice.
• Healthcode, health insurance invoice processing, where enabled.
• Raygun, error tracking and logging.
• Physitrack, exercise routine software integration, where enabled by the practice.
• Google, Gmail integration via OAuth, where enabled by the practice.
• Xero, accounting software integration, where enabled by the practice.
• Convertio, PDF generation.

Some of these suppliers apply only where the practice switches the feature on. Which of these integrations are enabled on the Sensational Minds account must be confirmed against our own account configuration: We are confirming this with the supplier and will update this notice.

Our role and WriteUpp’s role

• Sensational Minds decides why and how client information is used, and is responsible for it.
• WriteUpp provides the clinical record system and acts on our instructions when handling that information.
• WriteUpp may in turn rely on separate cloud-infrastructure suppliers or other subprocessors, which have their own role in storing or processing information on WriteUpp's behalf.
• The safeguards that apply to any processing outside the UK sit alongside these roles and must be recorded in writing.

What must be verified before this section is published

WriteUpp’s published privacy policy answers some of the questions below, but a website policy is not enough on its own. Each published statement must be checked against all of the following sources before it is treated as confirmed:

• The current WriteUpp contract
• WriteUpp's current Data Processing Agreement
• WriteUpp's current privacy information
• WriteUpp's current subprocessor list
• WriteUpp's current cloud-storage documentation
• Sensational Minds' own WriteUpp account configuration
• Any recent notice supplied directly by WriteUpp

How you can ask for further information about safeguards

You can ask us what information about you is held in our clinical record system, which countries may be involved, and what safeguards apply. We will give you a straightforward answer based on the documents we hold, and we will tell you plainly where a detail has not yet been confirmed. Please contact us using the details in section 1, and please do not include detailed clinical or identifiable health information in a general email.

Our clinical records are held in the European Union (Dublin and Amsterdam), which the UK recognises as providing adequate protection; see section 10. Our newsletter provider, Mailchimp, stores subscriber details in the United States. That transfer is protected by the UK Extension to the EU-US Data Privacy Framework or the ICO’s International Data Transfer Addendum. The location of our website database is: We are confirming this with the supplier and will update this notice.

Client areas of our website need a personal login, and each client can only see their own forms and bookings. Staff access depends on their role. Information is encrypted in transit and at rest by our providers. Pages holding personal information are hidden from search engines, and we do not use Google Analytics or advertising trackers.

No organisation can promise that information will never be at risk, so we do not make that claim. If a breach happens, we contain it, record it, and report it to the ICO within 72 hours where required. Full details are in our Data Protection Policy.

We keep information for as long as we need it for the purpose it was collected, and for as long as professional and legal obligations require. In summary: children’s clinical records until the young person’s 25th birthday, adult clinical records for 8 years, enquiries that do not lead to a service for 12 months, unsuccessful job applications for 6 months and financial records for 6 years. We do not use website analytics.

The full schedule is in our Data Retention and Storage Policy.

Under UK data protection law you have rights over your personal information. These include:

• The right to be informed about how your information is used, which is the purpose of this notice
• The right of access to a copy of your information
• The right to have inaccurate information corrected
• The right to ask for information to be erased in certain circumstances
• The right to ask us to restrict how we use your information in certain circumstances
• The right to data portability in certain circumstances
• The right to object to certain uses of your information
• Rights relating to automated decision making and profiling

Some rights are qualified, which means they do not apply in every situation. For example, we may need to keep clinical records even if you ask us to delete them, because professional and legal obligations require it. If that happens, we will explain why.

To exercise a right, please contact us. We will respond within the time limits set by law. There is normally no charge.

If you are unhappy with how we have handled your information, please tell us first so we can put it right. Our complaints policy explains what happens next.

You also have the right to complain to the Information Commissioner's Office, the UK regulator for data protection, at the ICO complaints service (opens in a new tab).

We review this notice so that it stays accurate. When we make a significant change, we update the version number and the dates shown at the top of this page. Where a change affects how we use information about you, we will tell you directly where it is reasonable to do so.