High Peak Occupational Therapy
Last updated: 28th August 2026
Effective from: 28th August 2026
Version: 2
High Peak Occupational Therapy is committed to protecting the privacy, confidentiality and security of the personal information entrusted to us.
This Privacy Policy explains how High Peak Occupational Therapy collects, uses, stores and protects personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable data protection legislation.
This policy applies to information relating to children, young people and adults who receive occupational therapy services, as well as parents, carers, referrers, professionals and other individuals who communicate with or provide information to High Peak Occupational Therapy.
1. Who we are
High Peak Occupational Therapy is the trading name of:
Legal name: Samantha Reece
Business address: Riverside, 1 Market Street, Whaley Bridge, SK23 7AA
Email: [INSERT EMAIL ADDRESS]
Telephone: 07792 152 852
Website: www.highpeakoccupatioaltheraoy.co.uk
ICO registration number: ZC101859
For the purposes of data protection legislation, High Peak Occupational Therapy is the Data Controller of the personal information described in this Privacy Policy.
This means that we are responsible for determining how and why personal information is processed.
Where we use another organisation to process information on our behalf, that organisation may act as a Data Processor.
2. What information do we collect?
The information we collect will depend on the services being provided.
This may include:
Personal information
- Name
- Date of birth
- Address
- Telephone number
- Email address
- Parent/carer details
- Emergency contact information
- Relationship to the individual
- School, college, employer or organisation details
Occupational therapy and clinical information
Where relevant to the service, this may include:
- Referral information
- Occupational therapy assessments
- Clinical observations
- Occupational performance information
- Sensory processing information
- Developmental information
- Relevant medical history
- Physical or mental health information
- Disability or neurodevelopmental information
- Information about education, employment and daily living
- Therapy goals
- Intervention plans
- Progress notes
- Reports and recommendations
- Information provided by other professionals
- Relevant information provided by parents or carers
- Safeguarding information where necessary
Some of this information constitutes special category personal data, particularly information concerning health.
We will only collect information that is relevant and necessary for the services we provide.
3. How do we collect information?
We may collect information:
- Directly from you
- From a child or young person
- From a parent or person with parental responsibility
- From a carer
- From a referring professional
- From a school or educational setting
- From another healthcare or allied health professional
- From another organisation involved in providing services
- Through referral forms
- During assessment or therapy sessions
- By telephone
- By email
- Through our website
- Through our clinical record-management system
Where information is provided by another person or organisation, we will process it only where there is an appropriate lawful basis to do so.
4. Why do we use your information?
We may use personal information to:
- Respond to enquiries and referrals
- Assess occupational needs
- Plan and deliver occupational therapy
- Provide therapeutic intervention
- Monitor progress
- Produce reports and recommendations
- Communicate with parents, carers and relevant professionals
- Make appropriate reasonable adjustments
- Coordinate care and support
- Communicate with schools, colleges, employers or other organisations where appropriate
- Manage appointments
- Process payments and invoices
- Maintain accurate clinical and administrative records
- Meet professional, legal and regulatory responsibilities
- Address safeguarding concerns
- Manage complaints
- Establish, exercise or defend legal claims
- Administer and improve our services
We will not use personal information for purposes that are incompatible with the purpose for which it was collected unless we have an appropriate lawful basis to do so.
5. Lawful bases for processing
UK GDPR requires us to have a lawful basis for processing personal information.
Depending on the circumstances, we may rely on one or more of the following:
Contract
Where processing is necessary to provide services that have been requested or agreed.
Legal obligation
Where we are required by law to process information.
Legitimate interests
Where processing is necessary for our legitimate interests or those of another organisation, provided that these interests are not overridden by the individual’s rights and interests.
Examples may include managing our practice, maintaining appropriate records, communicating with professionals involved in a person’s care and managing legal or regulatory matters.
Consent
Where appropriate, we may rely on consent.
Where processing is based on consent, consent may generally be withdrawn at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
6. Health information and special category data
Occupational therapy involves processing information that may constitute special category personal data, particularly information concerning health.
We will only process special category information where:
- an appropriate Article 6 lawful basis exists; and
- an appropriate Article 9 condition under the UK GDPR is satisfied.
This may include processing that is necessary for the provision or management of health or social care services, where permitted by applicable data protection legislation.
We take additional care when processing special category information and use appropriate technical and organisational measures to protect it.
7. Children and young people
High Peak Occupational Therapy may provide services to children and young people.
We recognise that children’s personal information requires particular care and protection.
Where appropriate, we will provide privacy information in a way that is understandable and accessible to the child or young person, taking account of their age and level of understanding.
Information may be collected from:
- The child or young person
- Parents or those with parental responsibility
- Carers
- Schools and educational settings
- Healthcare professionals
- Allied health professionals
- Other professionals involved in the child’s care or support
We will only share information with people who have a genuine need to receive it and where there is an appropriate lawful basis for doing so.
Where parental or carer involvement is appropriate, we will normally communicate with the person who has parental responsibility or another person legally authorised to act on the child’s behalf.
As children develop their capacity to understand privacy and confidentiality, we will take their views and wishes into account wherever appropriate.
8. Retention of children’s and young people’s records
Clinical records relating to children and young people will normally be retained until the individual reaches their 25th birthday.
Where the relevant circumstances apply to a person who was 17 years old when treatment ended, records will normally be retained until their 26th birthday.
This approach reflects recognised health and social care records-management guidance. NHS England guidance indicates that children’s records are generally retained until age 25.
Records may be retained for longer where there is a specific legal, professional, safeguarding, clinical or other legitimate reason to do so.
Records will be reviewed and securely destroyed when they are no longer required.
Retention periods will be reviewed periodically to ensure that they remain appropriate and consistent with current legislation and professional guidance.
9. Sharing information
We will only share personal information where there is a lawful and appropriate reason to do so.
Depending on the circumstances, information may be shared with:
- Parents or carers
- Schools and educational settings
- GPs
- NHS services
- Healthcare professionals
- Allied health professionals
- Social care professionals
- Employers
- Referrers
- Organisations commissioning our services
- Professional or regulatory bodies
- Legal or statutory authorities where required
We aim to share only the information that is necessary and relevant.
There may be circumstances where information needs to be shared without consent, including:
- Where there is a safeguarding concern
- Where someone is at risk of serious harm
- Where we are legally required to disclose information
- Where disclosure is necessary to comply with a court order
- Where disclosure is necessary to protect our legal rights
Where appropriate, we will discuss information sharing with the individual or their parent/carer beforehand.
10. Confidentiality
We understand the importance of confidentiality in occupational therapy.
Information will be treated as confidential and accessed only by people who have a legitimate need to access it.
Where other professionals are involved in a person’s care or support, we may communicate with them where there is an appropriate lawful basis and where this is necessary to provide safe and effective services.
We will take reasonable steps to ensure that confidential information is not disclosed to people who do not have a legitimate need to receive it.
11. WriteUpp
High Peak Occupational Therapy uses WriteUpp, provided by Pathway Software (UK) Limited, as its clinical and practice-management system.
WriteUpp may be used for:
- Client records
- Clinical notes
- Assessments
- Reports and documents
- Appointment management
- Client communications
- Forms and consent
- Invoicing and payment administration
- Other practice-management functions
For patient/client information entered into WriteUpp by High Peak Occupational Therapy, High Peak Occupational Therapy is the Data Controller and WriteUpp acts as our Data Processor.
WriteUpp currently states that its UK/European customer data is hosted within the EU, using Microsoft’s facility in Dublin. It also states that data is encrypted in transit and at rest, and that its information-security systems are ISO 27001 certified.
WriteUpp provides tools supporting GDPR-related processes, including consent and access requests.
Further information is available in the WriteUpp privacy information.
12. IONOS
High Peak Occupational Therapy uses IONOS for professional email and may use IONOS for domain and website services.
IONOS may therefore process personal information on our behalf in providing these services.
Where IONOS acts as a Data Processor, appropriate data-processing arrangements apply. IONOS provides a Data Processing Agreement for services involving the processing of personal data on its systems.
We will use professional email responsibly and take reasonable steps to minimise the amount of confidential information transmitted by email.
13. Email and electronic communication
We may communicate with you by:
- Telephone
- Text message
- WriteUpp messaging or portal functionality
- Other agreed electronic communication methods
Electronic communication may contain personal or confidential information.
We will take reasonable steps to protect information when communicating electronically.
Where appropriate, we may use WriteUpp’s secure communication or client portal functionality rather than sending sensitive information by ordinary email.
We ask that you notify us if your contact details change.
14. Security of your information
We take appropriate technical and organisational measures to protect personal information against:
- Unauthorised access
- Loss
- Theft
- Accidental disclosure
- Unauthorised alteration
- Destruction
- Unauthorised processing
These measures may include:
- Password-protected systems
- Two-factor authentication where available
- Secure cloud-based systems
- Access controls
- Device security
- Software and security updates
- Secure disposal of information
- Limiting access to information on a need-to-know basis
No electronic system can be guaranteed to be completely secure. However, we take appropriate steps to reduce the risks associated with processing personal information.
15. Data minimisation
We aim to collect and retain only the information that is necessary, relevant and proportionate for the purposes for which it is being processed.
We will regularly review the information we hold and securely delete or destroy information when it is no longer required.
16. How long do we keep your information?
We retain personal information only for as long as necessary, taking account of our legal, professional, regulatory, contractual and clinical responsibilities.
Clinical records will generally be retained in accordance with the retention periods described above for children and young people and with the applicable professional and records-management requirements for adults.
Certain information may need to be retained for longer where:
- There is an ongoing legal matter
- There is a safeguarding reason
- We are required to do so by law
- It is necessary for professional or regulatory purposes
- There is another documented and legitimate reason
When information is no longer required, it will be securely deleted or destroyed.
17. Your data protection rights
Depending on the circumstances, you may have the following rights under UK data protection legislation:
Right of access
You can request a copy of the personal information we hold about you.
Right to rectification
You can ask us to correct inaccurate or incomplete information.
Right to erasure
In certain circumstances, you can ask us to delete your personal information.
This right is not absolute. For example, we may be required to retain clinical records for legal, professional, regulatory or safeguarding reasons.
Right to restrict processing
In certain circumstances, you can ask us to restrict how we process your information.
Right to object
In certain circumstances, you can object to our processing of your personal information.
Right to data portability
In certain circumstances, you may have the right to receive personal information in a structured, commonly used and machine-readable format.
Rights relating to automated decision-making
You have rights relating to certain forms of automated decision-making and profiling.
High Peak Occupational Therapy does not currently make decisions about clients using solely automated decision-making that produce legal or similarly significant effects.
18. Subject Access Requests
You have the right to request access to the personal information we hold about you.
This is known as a Subject Access Request (SAR).
Requests should be sent to:
Email: sam@highpeakoccupationaltherapy.co.uk
Address: Riverside, 1 Market Street, Whaley Bridge, SK23 7AA
We may need to verify your identity before providing information.
We will normally respond to a valid request within one month, although the applicable legislation allows an extension in certain circumstances.
19. Requests concerning children
Where a request relates to a child’s information, we will consider:
- The child’s age
- Their level of understanding
- Whether they have sufficient understanding to exercise the relevant right themselves
- Who is making the request
- Whether the person making the request has parental responsibility
- The child’s wishes and confidentiality rights
- Any relevant safeguarding considerations
A parent or person with parental responsibility does not automatically have an unrestricted right to access all information held about a child.
Each request will be considered individually and in accordance with applicable law.
20. Complaints
If you have concerns about how we have handled your personal information, please contact us in the first instance.
Data Protection contact: Samantha Reece
Email: sam@highpeakoccupatioaltherapy.co.uk
Telephone: 07792152852
We will investigate your concern and aim to resolve it promptly.
If you remain dissatisfied, you have the right to complain to the Information Commissioner’s Office (ICO).
ICO website: www.ico.org.uk
21. Personal data breaches
If we become aware of a personal data breach, we will assess the breach and take appropriate action in accordance with UK GDPR and our data protection procedures.
Where required, we will notify the Information Commissioner’s Office within the applicable timeframe.
Where a breach is likely to result in a high risk to an individual’s rights and freedoms, we will notify the affected individual where required.
22. Third-party organisations and processors
The principal external service providers used by High Peak Occupational Therapy are currently:
| Provider | Purpose |
|---|---|
| WriteUpp / Pathway Software (UK) Limited | Clinical records, appointments, client management, forms, communications and practice administration |
| IONOS | Professional email and, where applicable, domain and website services |
We will review our service providers periodically and ensure that appropriate data-processing arrangements are in place where required.
23. International data transfers
Some service providers may process information outside the United Kingdom.
Where personal information is transferred outside the UK, we will ensure that the transfer is carried out in accordance with applicable UK data protection legislation and that appropriate safeguards are in place where required.
24. Website and cookies
Our website may use cookies and similar technologies.
Cookies may be used to:
- Make the website function correctly
- Understand how visitors use the website
- Improve website performance
- Provide relevant functionality
Further information about cookies used on our website can be found in our Cookie Policy.
Cookie Policy: [INSERT LINK]
Where consent is required for non-essential cookies, we will seek consent in accordance with applicable legislation.
25. Marketing
We may occasionally communicate information about High Peak Occupational Therapy’s services, events, training or other relevant activities.
Where required, we will obtain appropriate consent or rely on another lawful basis permitted by applicable data protection and electronic communications legislation.
You can opt out of marketing communications at any time.
Service-related communications, such as appointment information, reports or clinical correspondence, are not marketing communications.
26. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect:
- Changes in legislation
- Changes in professional guidance
- Changes to our services
- Changes to the systems and technology we use
- Changes to how personal information is processed
The most recent version will be published on our website.
Date of latest review: 28/08/2026
Next review date: 28/08/2027
27. Contact us
If you have any questions about this Privacy Policy or how High Peak Occupational Therapy processes personal information, please contact:
High Peak Occupational Therapy
Email: sam@highpeakoccupationaltherapy.co.uk