Privacy Notice

Sensational Minds is a specialist neurodevelopmental assessment and support organisation based in Colchester, Essex. The details below identify the organisation responsible for the personal information described in this notice.

This notice may apply to:

• Website visitors
• People making enquiries
• Prospective clients
• Clients and service users
• Parents and carers
• Children and young people
• Informants, such as a partner, relative or friend who contributes information to an assessment
• Education professionals
• Referrers
• Schools and education settings
• Corporate contacts
• Course and training enquiries
• Suppliers and professional partners

Sensational Minds works with associate practitioners as well as any directly employed staff. Information about people who work with or for the organisation is handled separately: Item to confirm before publication: [CONFIRM BEFORE PUBLICATION: whether a separate internal workforce and practitioner privacy notice exists, and how associates and applicants can obtain it]

We only ask for what we need for the service you are enquiring about or using. Not every category below will apply to you.

Identity and contact information

• Name
• Address
• Telephone number
• Email address
• Date of birth
• Preferred contact method

Enquiry information

• Service of interest
• General reason for the enquiry
• Preferred appointment information
• Organisation and job role for business, school and corporate enquiries

Clinical and neurodevelopmental information

Where relevant to a service we have accepted, this may include:

• Developmental information
• Medical and mental health history
• Neurodevelopmental information
• Assessment responses
• Questionnaires
• Practitioner observations
• Reports
• Diagnostic information
• Recommendations
• Relevant educational information

Information about health, including neurodevelopmental and mental health information, is special-category information under UK data protection law. It is treated with additional care, access is limited to those who need it for your care or for managing the service, and an additional condition for processing must apply alongside a lawful basis.

Child and family information

• Information supplied by a parent or a person with parental responsibility
• Relevant developmental and educational information
• Details provided by an informant
• School or professional information
• Family information that is relevant to the service being provided

Education information

• School details
• Attendance information
• SEN Support information
• Education, Health and Care Plan information
• Teacher questionnaires
• School reports
• Provision and adjustment information

Payment and transaction information

How payments are taken, and what is stored, depends on the payment provider used: Item to confirm before publication: [CONFIRM BEFORE PUBLICATION: the payment provider or providers used, what payment information Sensational Minds can see, and whether any card details are stored by the organisation]

Website and technical information

• IP address
• Browser and device information
• Cookie preferences
• Website activity
• Security and diagnostic information

Our cookie policy explains this in more detail.

Communications

• Emails
• Telephone notes
• Enquiry records
• Appointment communications
• Complaints and feedback

Depending on the service, information may come:

• Directly from you
• From a parent or carer
• From an informant
• From a school or education setting
• From a referring clinician or professional
• From a commissioning organisation, such as an employer or school that has arranged the service
• Through website forms
• Through questionnaires
• Through appointments and assessment sessions
• Through approved third-party systems used to deliver the service

Where information comes from someone other than you, we should only obtain it where there is an appropriate basis for doing so, for example your consent, the consent of a person with parental responsibility, or a professional referral that forms part of the agreed pathway.

UK data protection law requires a lawful basis for each use of personal information, and an additional condition for special-category information such as health information. The exact bases relied on by Sensational Minds for each activity must be confirmed and recorded before this notice is published:

Item to confirm before publication: [CONFIRM BEFORE PUBLICATION: the lawful basis for each processing activity listed in section 5, and the Article 9 condition relied on for special-category health information, as recorded in the organisation's record of processing activities]

Where we rely on consent, you can withdraw it at any time. Withdrawing consent does not affect anything done before you withdrew it, and it may mean we cannot continue with part of a service.

Where we work with children and young people, information is usually provided by a person with parental responsibility. We explain to young people, in a way suited to their age and understanding, what will happen with their information.

Where a young person is able to understand and make their own decisions about a particular matter, their views carry weight, and we consider this in line with recognised competence principles. Detail of how consent and access are handled in practice, including access requests by parents to a young person's information, is set out in our internal procedures: Item to confirm before publication: [CONFIRM BEFORE PUBLICATION: the organisation's confirmed approach to young people's consent, competence assessment and parental access requests]

Information may be shared, where appropriate and with a proper basis, with:

• The practitioners involved in your assessment or support, including associate practitioners working with Sensational Minds
• Administrative team members who arrange appointments and manage records
• A school or education setting, where you have agreed to this or it forms part of the agreed pathway
• A GP or another health professional, where you have agreed to this
• A partner organisation you have asked us to refer you to, with your written consent
• An organisation that has commissioned a service, limited to what is necessary and agreed
• Suppliers who provide the systems we use to deliver the service
• Professional advisers, regulators or authorities, where there is a legal or safeguarding reason

We do not sell personal information, and we do not share it for other organisations' marketing. Where a referral to a medication provider or other partner is discussed, information is only shared with your written consent, and we do not share recordings or transcripts.

We use secure systems to manage enquiries, records, questionnaires, document sharing and appointments. These may include a clinical record system, secure video meetings and email.

Clinical questionnaires, records and secure document sharing may involve WriteUpp, which is described in detail in section 10. We have confirmed with WriteUpp that patient data for our account is hosted on servers within the European Union, in Dublin and Amsterdam. WriteUpp publishes a list of the subprocessor organisations it uses, summarised in section 10. The current WriteUpp contract and Data Processing Agreement must still be confirmed, along with the international transfer arrangements: Item to confirm before publication: [CONFIRM BEFORE PUBLICATION: WriteUpp's current contract and Data Processing Agreement in place, and the international transfer arrangements]

Where appointments are held by video, this is usually on Microsoft Teams. Where a meeting is transcribed, this is done in line with our internal policies, only for accurate record keeping, and only where it is appropriate for that appointment. The full list of suppliers acting on our behalf must be confirmed: Item to confirm before publication: [CONFIRM BEFORE PUBLICATION: the full list of processors and suppliers with access to personal data, their purpose, and confirmation that written data processing terms are in place for each]

[DO NOT PUBLISH UNTIL THE REMAINING WRITEUPP ACCOUNT, INTERNATIONAL-TRANSFER SAFEGUARD, RETENTION AND END-OF-CONTRACT DETAILS HAVE BEEN VERIFIED. EU HOSTING (DUBLIN AND AMSTERDAM) HAS BEEN CONFIRMED.]

Sensational Minds uses WriteUpp for the storage and management of clinical information. WriteUpp may also be used to send, receive and store clinical questionnaires, and to share documents securely in connection with assessment or support services.

Please read this carefully. A clinical records platform that is aimed at UK services, and that describes itself as UK facing, does not necessarily mean that every item of personal information is stored exclusively in the United Kingdom. Cloud hosting and supplier arrangements can involve information being stored or processed in other countries. WriteUpp’s published privacy policy states that patient data is stored on servers within the European Union, in Dublin and Amsterdam, rather than in the United Kingdom. We have now confirmed with WriteUpp that, for our account, patient data is hosted within the European Union in Dublin and Amsterdam. WriteUpp also publishes a list of the subprocessor organisations it uses, set out below. The specific international-transfer mechanism, our account-level configuration and the end-of-contract arrangements still need to be confirmed in writing against our contract and Data Processing Agreement.

What WriteUpp’s published privacy policy states

The following points are taken from WriteUpp’s publicly available privacy policy at writeupp.com/privacy and from confirmation supplied to Sensational Minds. The hosting location has been confirmed for our account. Other points below have not yet been confirmed against our own contract and account arrangements, and they may change.

• WriteUpp is operated by Pathway Software (UK) Limited.
• For information about the clients of a practice, WriteUpp describes itself as acting as a processor on the instructions of the practice, with no direct relationship with those individuals.
• Patient data is stored on secure servers within the European Union, namely Dublin and Amsterdam, in a managed data centre with physical security controls. Sensational Minds has confirmed this hosting position for its own account.
• WriteUpp states that many of its own third-party suppliers are based outside the UK, that it will only transfer personal data to countries deemed to provide an adequate level of protection, and that it will otherwise put appropriate safeguards and transfer mechanisms in place. The specific mechanism is not named in the published policy and must be requested.
• WriteUpp states that it may perform weekly backups of patient data, that backups are retained on its backup systems for two years, that they are held in a non-readable binary form, and that for technical reasons they cannot be deleted before that two-year period expires.
• WriteUpp states that hosting, back-up and other IT suppliers may have access to personal data held by it. WriteUpp publishes a subprocessor list in its helpdesk, which is summarised below.

Two points follow from this that we want to be open about. First, the confirmed hosting position is European Union hosting (Dublin and Amsterdam) rather than United Kingdom only hosting. Second, because backups are retained for two years and cannot be deleted earlier, a deletion request will not always remove information from backups immediately. We are confirming the remaining account, transfer and end-of-contract details in writing with WriteUpp before this notice is published.

WriteUpp’s published subprocessor list

WriteUpp publishes a list of the subprocessor organisations it uses in its helpdesk article “Who are your sub-processors?”, dated 17 September 2025. For the service it provides to practices, where WriteUpp acts as processor, the published list is:

• Microsoft Azure, hosting.
• Twilio, messaging.
• Postmark, messaging.
• Stripe, payment processing, where enabled by the practice.
• Healthcode, health insurance invoice processing, where enabled.
• Raygun, error tracking and logging.
• Physitrack, exercise routine software integration, where enabled by the practice.
• Google, Gmail integration via OAuth, where enabled by the practice.
• Xero, accounting software integration, where enabled by the practice.
• Convertio, PDF generation.

Some of these suppliers apply only where the practice switches the feature on. Which of these integrations are enabled on the Sensational Minds account must be confirmed against our own account configuration: Item to confirm before publication: [CONFIRM BEFORE PUBLICATION: which WriteUpp integrations are enabled on our account, for example Stripe, Physitrack, Google Gmail and Xero]

Our role and WriteUpp’s role

• Sensational Minds decides why and how client information is used, and is responsible for it.
• WriteUpp provides the clinical record system and acts on our instructions when handling that information.
• WriteUpp may in turn rely on separate cloud-infrastructure suppliers or other subprocessors, which have their own role in storing or processing information on WriteUpp's behalf.
• The safeguards that apply to any processing outside the UK sit alongside these roles and must be recorded in writing.

What must be verified before this section is published

WriteUpp’s published privacy policy answers some of the questions below, but a website policy is not enough on its own. Each published statement must be checked against all of the following sources before it is treated as confirmed:

• The current WriteUpp contract
• WriteUpp's current Data Processing Agreement
• WriteUpp's current privacy information
• WriteUpp's current subprocessor list
• WriteUpp's current cloud-storage documentation
• Sensational Minds' own WriteUpp account configuration
• Any recent notice supplied directly by WriteUpp

How you can ask for further information about safeguards

You can ask us what information about you is held in our clinical record system, which countries may be involved, and what safeguards apply. We will give you a straightforward answer based on the documents we hold, and we will tell you plainly where a detail has not yet been confirmed. Please contact us using the details in section 1, and please do not include detailed clinical or identifiable health information in a general email.

Some suppliers may store or process information outside the United Kingdom. A platform aimed at UK services is not automatically a UK-only platform, and our clinical record system is covered separately in section 10. Where information is processed outside the UK, appropriate safeguards recognised by UK data protection law must be in place. We are not able to describe our arrangements until they have been verified:

Item to confirm before publication: [CONFIRM BEFORE PUBLICATION: which suppliers store or process personal data outside the UK, the countries involved, and the transfer safeguards relied on, for example UK adequacy regulations or the International Data Transfer Agreement]

We take the security of personal information seriously and use organisational and technical measures that are intended to reduce risk. These include limiting access to those who need it, using access-controlled systems, and asking people not to send sensitive clinical information by general email.

No organisation can promise that information will never be at risk, so we do not make that claim. What we can say is that we review how we work, respond to concerns, and record and investigate any incident involving personal information. Our confirmed security measures and incident procedure are: Item to confirm before publication: [CONFIRM BEFORE PUBLICATION: the organisation's confirmed technical and organisational security measures, training arrangements and personal data breach procedure, including reporting timescales]

We keep information for as long as we need it for the purpose it was collected, and for as long as professional and legal obligations require. Enquiry information that does not lead to a service is kept for a shorter period than clinical records.

The specific retention periods that apply must be confirmed and published here, rather than estimated: Item to confirm before publication: [CONFIRM BEFORE PUBLICATION: the retention period for each record type, including enquiries, clinical records for adults, clinical records for children, financial records, recruitment records and website analytics, together with the source of each period]

Under UK data protection law you have rights over your personal information. These include:

• The right to be informed about how your information is used, which is the purpose of this notice
• The right of access to a copy of your information
• The right to have inaccurate information corrected
• The right to ask for information to be erased in certain circumstances
• The right to ask us to restrict how we use your information in certain circumstances
• The right to data portability in certain circumstances
• The right to object to certain uses of your information
• Rights relating to automated decision making and profiling

Some rights are qualified, which means they do not apply in every situation. For example, we may need to keep clinical records even if you ask us to delete them, because professional and legal obligations require it. If that happens, we will explain why.

To exercise a right, please contact us. We will respond within the time limits set by law. There is normally no charge.

If you are unhappy with how we have handled your information, please tell us first so we can put it right. Our complaints policy explains what happens next.

You also have the right to complain to the Information Commissioner's Office, the UK regulator for data protection, at the ICO complaints service (opens in a new tab).

We review this notice so that it stays accurate. When we make a significant change, we update the version number and the dates shown at the top of this page. Where a change affects how we use information about you, we will tell you directly where it is reasonable to do so.