Privacy Policy

UK Data Protection Law and UK General Data Protection Regulation (UK GDPR) 

Data Protection Law lays down wide-ranging rules, backed up by criminal sanctions, for the processing of information about identifiable, living individuals. It also gives individuals certain rights in relation to personal data held about them by others. 

Lycali Ltd is fully compliant with UK General Data Protection Regulation (UK GDPR) legislation. We are also registered with the Information Commissioner’s Office (ICO), Registration Reference: ZB606249. 

Lycali Ltd is the Data Controller responsible for your personal data. 

 

Why We Collect and Use Your Data 

Lycali Ltd needs to collect and use personal data about you as part of the therapy and assessment processes. Personal data can be considered as any information that can be used to identify you. 

You are lawfully entitled to know why and how we use your data. This includes understanding any risks and implications of sharing your data, as well as the security measures we have in place to ensure these risks are reduced and your privacy is protected. 

This will allow you to make an informed decision about whether you would like to share your personal data with us. 

 

Lawful Basis for Processing Personal Information 

Lycali’s legal basis for processing your personal data is: 

  • Contractual obligation – processing is necessary to provide the assessment or therapy service you have requested  

  • Legitimate interests – to ensure safe, effective, and appropriate delivery of services  

As we process special category data (including health information), we also rely on: 

  • Article 9(2)(h) UK GDPR – processing necessary for the provision of health or social care  

Where consent is required (for example, sharing information with third parties or recording videos), this will be obtained explicitly and can be withdrawn at any time. 

 

Children and Consent 

For children and young people: 

  • Consent will be obtained from an individual with parental responsibility  

  • Where appropriate, and in line with Gillick competence, a young person may provide informed consent themselves if they demonstrate sufficient understanding  

 

What Personal Information Do We Hold? 

We may collect and store: 

  • Your contact details  

  • Notes of correspondence with you (e.g. telephone, email, remote or in person)  

  • Clinical information required for assessments  

  • Payment details  

  • Information about how you use our website  

 

How Do We Get the Information and Why Do We Have It? 

Most information we store comes directly from you or your parent/carer. 

We may also obtain information from third parties such as schools or other professionals, where appropriate. 

We collect this information in order to complete the assessment or therapy service you have requested. 

The information collected may include both verbal and written information. 

 

Sharing Data with Others 

We will share personal information about you within Lycali Ltd (between associates such as Independent Psychologists, Occupational Therapists, Speech and Language Therapists, and other allied health professionals) to ensure a high-quality and comprehensive service. 

We may share personal information with other professionals, such as your GP, with your permission. 

The only exception to this is where there are concerns about your safety or the safety of others. In such cases, information may be shared without consent in line with safeguarding responsibilities. 

Our clinical supervisors, administrators, and accountant may also access limited information on a strict need-to-know basis. 

 

How Personal Information is Stored 

All information about you or your child is stored securely in accordance with data protection regulations. 

Lycali uses a secure electronic system called WriteUpp, which is compliant with UK GDPR. 

  • Documents are stored securely and encrypted within this system  

  • Temporary storage may occur on password-protected devices prior to upload  

  • Access to personal data is restricted on a role-based basis  

  • All staff and associates are bound by confidentiality agreements  

Videos may be taken with consent: 

  • These are stored securely on encrypted, password-protected devices  

  • Videos are deleted when no longer required for clinical purposes  

When information is taken outside of the clinic (e.g. school visits): 

  • It is kept secure and under the clinician’s supervision or locked safely  

Paper records are stored in locked filing cabinets. 

Confidential digital information is stored using secure cloud-based systems. 

Letters sent via post are clearly marked Confidential. 

All staff are required to complete data protection training. 

We have procedures in place to respond to any suspected data breaches and will notify you and relevant regulators where legally required. 

 

How Long We Keep Your Data 

We will only store your personal information for as long as necessary. 

Registration forms and identifiable information will be retained for: 

  • 8 years after the last date of service delivery, or  

  • Until a child reaches the age of 25 (whichever is sooner)  

After this period, data will be securely disposed of. 

In exceptional circumstances, records may be retained for longer where there is a lawful basis to do so, such as: 

  • Safeguarding concerns  

  • Legal claims  

  • Regulatory requirements  

This is in line with guidance from NHS Records Management Code of Practice (2021), BPS, and HCPC. 

 

Your Rights 

Under data protection legislation, you have the following rights: 

  • The right to access a copy of your data  

  • The right to request correction of inaccurate data  

  • The right to request erasure of your data (where applicable)  

  • The right to restrict processing  

  • The right to object to processing  

  • The right to data portability  

  • The right to withdraw consent at any time (where consent is relied upon)  

 

How to Access Your Records (Subject Access Request) 

You can request access to your data: 

  • In writing or by email  

We may request identification to verify your identity before releasing information. 

A copy of your records will be provided free of charge within one month of receiving all necessary information. 

Please send requests to: Subject Access Requests Stephanie Connolly Lycali Ltd Kent Innovation Centre Broadstairs CT10 2QQ 

Email: info@lycali.co.uk 

 

Data Protection Complaints 

We are committed to protecting your personal data. 

If you are not satisfied with how we handle your data, you have the right to complain to the Information Commissioner's Office (ICO): Website: www.ico.org.uk Telephone: 0303 123 1113 

 

Further Information 

If you have any questions about how we use your information, please contact: info@lycali.co.uk 

 

Written by: Stephanie Connolly (Speech and Language Therapist) Date originally written: October 2023 Reviewed: 16th April 2026