Privacy Notice

Who is responsible for your information?

Bloom by Simone Speech and Language Therapy is operated by Simone Haskett-Smith, an independent, HCPC-registered Speech and Language Therapist.

For questions about this notice or the use of your information, please contact:

Email: simone@bloomspeechandlanguagetherapy.co.uk

Bloom by Simone Speech and Language Therapy is the data controller for the personal information described in this notice.

What information is collected?

Information may be collected about your child and relevant family members, including:

  • names and contact details;

  • date of birth and address;

  • developmental, medical and birth history;

  • speech, language and communication needs;

  • assessment results, clinical observations and therapy notes;

  • education and support information;

  • appointment, invoice and payment records;

  • correspondence, reports and therapy plans;

  • information submitted through the website, enquiry form or online booking system.

With appropriate permission, information may also be obtained from professionals involved in your child’s care or education, including education staff, NHS professionals, childminders and other health or social-care professionals.

Website services may also collect limited technical information, such as IP address, browser type and cookie data.

Why is this information used?

Information is used to:

  • respond to enquiries

  • arrange and manage appointments

  • assess speech, language and communication needs

  • plan and provide appropriate intervention

  • prepare clinical notes, reports and therapy plans

  • communicate with families and relevant professionals

  • send confirmations, reminders, resources and invoices

  • process payments and maintain financial records

  • meet safeguarding, legal, regulatory and professional responsibilities

  • manage and improve Bloom by Simone Speech and Language Therapy

Lawful basis

The lawful bases relied upon under Article 6 of the UK GDPR may include:

  • contract, where information is needed to provide an agreed service

  • legitimate interests, where information is reasonably required to provide and manage safe, effective services

  • legal obligation, where information must be retained or disclosed to meet a legal or regulatory requirement

Health and clinical information is special-category data. This is processed under Article 9(2)(h) of the UK GDPR for health assessment, diagnosis and the provision or management of health care by a professional subject to confidentiality obligations.

Consent will be sought separately where it is appropriate—for example, before making optional audio or video recordings.

How is information stored?

Electronic records are stored securely using password-protected devices and reputable cloud-based systems. These currently include Cliniko for clinical records and appointment management, Microsoft services for business email and documents, Squarespace for website enquiries, and Stripe for payment processing.

Access is restricted to authorised users. Appropriate passwords, security controls and two-factor authentication are used where available.

Paper records and assessment materials are stored securely when not in use.

Audio or video recordings will only be made with separate consent. The purpose of the recording and how long it will be retained will be explained at that time.

Who may receive information?

Information may be shared where necessary with:

  • parents, carers and the child or young person, where appropriate;

  • education, health or social-care professionals involved in the child’s support, ordinarily with prior agreement;

  • service providers acting on behalf of Bloom, including Cliniko, Microsoft, Squarespace and Stripe;

  • professional advisers, insurers or regulators where necessary;

  • safeguarding or legal authorities where disclosure is required or justified.

Only information necessary for the relevant purpose will be shared.

Some service providers may process information outside the UK. Where this occurs, appropriate safeguards required by data-protection law will be relied upon.

How long is information retained?

Clinical and administrative records are retained only for as long as necessary to meet clinical, legal, professional, regulatory and insurance requirements. Retention periods are reviewed regularly, and information is securely deleted or destroyed when it is no longer required.

Financial records are generally retained for the period required by HMRC.

Your rights

Depending on the circumstances, you or your child may have the right to:

  • be informed about how personal information is used;

  • request access to personal information;

  • ask for inaccurate information to be corrected;

  • request deletion or restriction of information;

  • object to certain uses of information;

  • request transfer of information;

  • withdraw consent where consent is the lawful basis.

These rights are not absolute and may be limited where records must be retained for clinical, safeguarding or legal reasons. Children have data-protection rights in their own right, although a parent or carer may usually exercise these on their behalf where appropriate. (ICO guidance)

Subject access requests

To request a copy of your or your child’s information, email:

simone@bloomspeechandlanguagetherapy.co.uk

Use the subject line “Subject Access Request”. Identity may need to be verified before information is released. Requests will normally be answered within one month.

Concerns and complaints

Please contact Bloom by Simone Speech and Language Therapy first if you have any questions or concerns about how information is used.

You also have the right to complain to the Information Commissioner’s Office:

Information Commissioner’s Office

Updates

This notice may be updated to reflect changes in services, systems or legal requirements.

Last updated: July 2026