Privacy Policy

UK Data Protection Law and UK GDPR

Data protection law sets out rules for how organisations process information about identifiable, living individuals. It also gives individuals rights in relation to personal data held about them.

Lycali Ltd is committed to protecting your personal information and complying with UK General Data Protection Regulation legislation.

Lycali Ltd is the data controller. Our ICO registration number is shown above, and our contact details are provided at the end of this page.

Why We Collect and Use Your Data

Lycali Ltd needs to collect and use personal data as part of the assessment, therapy, coaching and support services we provide.

Personal data means any information that can identify you or your child.

You are entitled to know why and how we use your data, what the possible risks are, and what security measures we have in place to protect your privacy.

Lawful Basis for Processing Personal Information

For our assessment, therapy and support services, Lycali’s lawful basis for processing personal data includes:

• Contractual obligation: processing is necessary to provide the assessment, therapy or support service requested.
• Legitimate interests: processing supports the safe, effective and appropriate delivery of services.

As Lycali processes special category data, including health information, we also rely on:

Where consent is required, such as sharing information with third parties or recording videos, this will be obtained explicitly and can be withdrawn at any time.

The lawful bases for recruitment activities are explained separately in the Recruitment Privacy Notice below.

Children and Consent

For children and young people, consent will usually be obtained from an individual with parental responsibility.

Where appropriate, and in line with Gillick competence, a young person may provide informed consent themselves if they demonstrate sufficient understanding.

What Personal Information We May Hold

We may collect and store:

• Contact details.
• Notes of correspondence with you by telephone, email, remote appointment or in person.
• Clinical information required for assessments, therapy or support.
• Payment information.
• Information about how you use our website.
• Information provided by schools, settings, healthcare professionals or other relevant professionals, where appropriate.
• Information provided during telephone calls, AI-assisted enquiries, website forms and virtual receptionist interactions.

How We Obtain Information

Most information we store comes directly from you, your parent, carer or the person with parental responsibility.

We may also obtain information from third parties, such as schools, nurseries, colleges, GPs, healthcare professionals or other professionals, where appropriate and relevant to the service being provided.

Information may be collected verbally, in writing, through forms, questionnaires, reports, email correspondence or during appointments.

Use of Artificial Intelligence (AI) Tools

Lycali may use approved artificial intelligence (AI) tools to support administrative and operational functions, including managing enquiries, answering common questions, signposting individuals to relevant services, assisting with appointment administration and supporting referral processes.

Lycali currently uses Jodie AI as a virtual receptionist and enquiry management tool. Information provided during telephone calls, online enquiries, website forms and other communications may be processed through this system to help us respond to enquiries and direct individuals to the most appropriate service.

Jodie AI does not provide clinical advice, diagnoses, treatment recommendations, risk assessments or safeguarding decisions. All clinical decisions remain the responsibility of appropriately qualified professionals.

Information processed through AI-supported systems may be reviewed by authorised members of the Lycali team for service delivery, safeguarding, quality assurance, governance and operational purposes.

Lycali ensures that any AI systems used operate within appropriate confidentiality, security and data protection requirements in accordance with UK GDPR and applicable legislation.

Sharing Data with Others

We may share relevant personal information within Lycali Ltd, including with associates such as psychologists, occupational therapists, speech and language therapists, administrators and other professionals involved in your care or service pathway.

This helps us provide a safe, comprehensive and high-quality service.

We may share information with other professionals, such as your GP, school or other services, with your permission.

Clinical supervisors, administrators and accountants may access limited information on a strict need-to-know basis.

How Personal Information Is Stored

All information about you or your child is stored securely in line with data protection requirements.

• Lycali uses WriteUpp, a secure electronic clinical system.
• Documents are stored securely and encrypted where appropriate.
• Temporary storage may occur on password-protected devices before secure upload.
• Access to personal data is restricted on a role-based basis.
• Staff and associates are bound by confidentiality agreements.
• Paper records, where used, are stored securely.
• Confidential digital information is stored using secure cloud-based systems.
• Letters sent by post are marked confidential.
• Information may be stored within approved third-party systems used to support communication, administration, enquiry management and service delivery, including AI-assisted systems where appropriate.

Videos may be taken with consent. These are stored securely on encrypted, password-protected devices and deleted when no longer required for clinical purposes.

When information is taken outside the clinic, for example during school visits, it is kept secure and under the clinician’s supervision or locked safely.

All staff are required to complete data protection training. We also have procedures in place to respond to suspected data breaches and will notify individuals and regulators where legally required.

How Long We Keep Your Data

We only store personal information for as long as necessary.

After this period, information will be securely disposed of.

In exceptional circumstances, records may be retained for longer where there is a lawful basis to do so, such as safeguarding concerns, legal claims or regulatory requirements.

Recruitment information is subject to the separate retention arrangements set out in the Recruitment Privacy Notice below.

Your Rights

Under data protection legislation, you have the following rights, subject to applicable legal conditions and exemptions:

• The right to access a copy of your data.
• The right to request correction of inaccurate data.
• The right to request erasure of your data, where applicable.
• The right to restrict processing.
• The right to object to processing.
• The right to data portability, where applicable.
• The right to withdraw consent at any time, where consent is relied upon.

These rights also apply to recruitment information. Please use the contact details at the end of this page to exercise your rights.

How to Access Your Records

You can request access to your records by making a Subject Access Request.

Requests can be made in writing or by email. We may ask for identification to verify your identity before releasing information.

A copy of your records will usually be provided free of charge within one month of receiving all necessary information.

Please address requests to Stephanie Connolly using the contact details at the end of this page.

Data Protection Complaints

We are committed to protecting your personal data. If you are not satisfied with how we handle your data, please contact us so that we can try to resolve your concern.

You also have the right to complain to the Information Commissioner’s Office, the UK’s independent data protection regulator. This applies to both service-related and recruitment information.