Privacy Notice – Arlson Psychological Services Limited
Who we are
Arlson Psychological Services Limited provides psychological, neurodevelopmental assessment, coaching and related professional services for children, young people and adults.
Arlson Psychological Services Limited is the organisation responsible for deciding how and why personal information is used when we provide services directly to you.
Company number: 09142922
Registered office: 9–11 Tatton Street, Knutsford, Cheshire, WA16 6AB
General enquiries: info@ndperspectives.co.uk
Existing clients: Admin@ndperspectives.co.uk
For questions about how we use your personal information, or if you wish to exercise any of your data protection rights, please contact us using the details above.
If you need this Privacy Notice in a different format, including large print or a more accessible format, please contact us.
What this Privacy Notice Covers
This notice explains:
- what personal information we collect;
- where we obtain it from;
- why we use it;
- the legal basis for using it;
- who we may share it with;
- how long we keep it;
- how we protect it; and
- your rights in relation to your information.
It applies to people who enquire about or receive our services, parents and carers, children and young people, family members and informants, professional referrers, commissioners, coaching participants and people who use our website or communicate with us.
Where we provide a service on behalf of another organisation, such as an NHS body or other commissioner, the relevant contract will determine whether Arlson Psychological Services Limited is acting as a data controller, joint controller or data processor. Where another organisation is the main data controller, its own Privacy Notice will also apply.
The information we collect
The information we collect depends on the service being provided.
It may include:
- your name, address and contact details;
- date of birth and other identifying information;
- parent, carer or family contact details;
- referral information;
- appointment and booking information;
- information about your health and medical history;
- neurodevelopmental and mental health information;
- developmental history;
- information about communication, sensory needs, cognition, learning and everyday functioning;
- information about education, school or employment;
- family and social history where relevant to an assessment;
- questionnaire and rating-scale responses;
- assessment observations and test results;
- previous clinical, educational or professional reports provided to us;
- correspondence with you, your family, referrers and other professionals;
- clinical notes, multidisciplinary team records, formulations, diagnostic conclusions and reports;
- safeguarding and risk information where relevant;
- complaints or incident information;
- coaching goals, reflections and progress information;
- invoice and payment information; and
- information generated when you use our website, such as IP address, browser or device information and cookie information where applicable.
We only collect information that is relevant to the purpose for which it is being used.
Where we get your information from
We may receive information directly from you.
Depending on the service, we may also receive information from:
- a parent or carer;
- another family member or informant where appropriate;
- your school, college or other education provider;
- your GP or another health professional;
- another clinician or service;
- a professional referrer;
- an NHS organisation, commissioner or partner organisation;
- an employer or other authorised referrer in relation to a commissioned service;
- previous reports or records provided to us;
- assessment and testing systems used as part of your assessment; or
- another person or organisation where you have authorised the information to be provided or there is another lawful reason for doing so.
When we receive information about you from somebody else, we will handle it in accordance with the same confidentiality and data protection requirements as information you provide directly.
Why we use your information
We use personal information to:
- respond to enquiries and referrals;
- determine whether our services are appropriate for you;
- arrange appointments and assessments;
- provide psychological, neurodevelopmental and related assessments;
- obtain information required to understand an individual’s developmental, health, educational and functional profile;
- administer questionnaires, rating scales and assessment tools;
- conduct multidisciplinary clinical discussions;
- formulate clinical opinions and, where appropriate, diagnostic conclusions;
- prepare reports and recommendations;
- provide feedback;
- deliver coaching and related support;
- communicate with you and relevant professionals;
- manage safeguarding concerns and clinical risk;
- respond to complaints or concerns;
- maintain appropriate clinical records;
- meet professional, regulatory, contractual and legal requirements;
- administer payments, invoices and accounts;
- provide services commissioned by NHS bodies or other organisations;
- operate and protect our IT systems and website; and
- manage and improve the administration and security of our services.
Our legal basis for using your information
Data protection law requires us to have a lawful basis for using personal information.
The legal basis depends on why the information is being used.
Providing private services
Where you or a parent/carer asks us to provide a private assessment, consultation, coaching service or related service, we generally process personal information because it is necessary to take steps before entering into a contract or to perform our contract with you.
This is under Article 6(1)(b) of the UK GDPR.
Clinical and health information
Much of the information used during psychological and neurodevelopmental assessment is health information and is therefore classed as special category personal information.
We generally process this information because it is necessary for the provision of health care or the management of health-care services by, or under the responsibility of, appropriately qualified professionals who are subject to professional confidentiality requirements.
This is under Article 9(2)(h) of the UK GDPR and the relevant provisions of the Data Protection Act 2018.
Legal and professional obligations
We may need to process information to comply with legal, regulatory, professional, safeguarding, accounting or other obligations.
Where applicable, we rely on Article 6(1)(c) of the UK GDPR.
Legitimate interests
We may use information where this is necessary for our legitimate interests and those interests are not overridden by your rights and interests.
Examples include:
- managing routine service administration;
- responding to professional or business correspondence;
- operating and securing our website and IT systems;
- maintaining appropriate business records;
- preventing misuse of our systems; and
- establishing, exercising or defending legal rights.
Where we rely on legitimate interests, we consider whether the processing is necessary, proportionate and reasonable.
Safeguarding and serious risk
There may be circumstances where information needs to be processed or shared to protect a child or adult from serious harm, respond to a safeguarding concern, comply with a legal requirement or support the establishment or defence of legal claims.
The specific lawful basis will depend on the circumstances. This may include legal obligation, legitimate interests, health-care processing, substantial public interest or legal claims.
Commissioned and NHS services
Where we provide services under an NHS or other commissioned pathway, the relevant commissioning arrangements determine the controller and processor responsibilities and the applicable lawful basis.
Where Arlson Psychological Services Limited acts only as a processor, we process information on the instructions of the organisation responsible for the service.
Do we rely on consent?
Consent is not normally our main legal basis for maintaining clinical records or carrying out processing that is necessary to provide an assessment or health-related service.
We will nevertheless involve you in decisions about how information is obtained and shared and will seek your agreement where appropriate.
There are some activities for which consent may be the appropriate legal basis, for example certain optional communications or marketing.
Where processing is based on consent, you can withdraw your consent at any time.
Withdrawal of consent does not make any processing that took place before withdrawal unlawful.
Children and young people
We provide services to children and young people as well as adults.
Children and young people have data protection rights in their own right.
When we work with a child or young person, we consider their age, understanding, ability to make decisions about their information, parental responsibility and their best interests.
Information may be obtained from parents, carers, schools and other professionals as part of an assessment where this is appropriate.
We aim to explain to children and young people, in a way they can understand, what information we need, why we need it and who it may be shared with.
A child or young person who is able to understand and exercise their own information rights may be able to make requests about their information independently.
Requests from parents or carers for access to a child’s information will be considered in accordance with data protection law, parental responsibility, the child’s level of understanding, confidentiality and the child’s best interests.
Who we share information with
We do not sell personal information.
Information is only shared where there is a legitimate reason to do so and only the information that is necessary for that purpose is shared.
Depending on the circumstances, we may share information with:
- clinicians involved in your assessment or care;
- members of our multidisciplinary team;
- authorised administrative staff;
- parents or carers where appropriate;
- your GP or another health professional where authorised or otherwise lawful;
- schools or education professionals where authorised;
- professional referrers;
- NHS organisations, commissioners or partner organisations where we are providing a commissioned service;
- organisations providing specialist assessment tools;
- organisations that provide secure clinical, communication or IT systems on our behalf;
- accountants, banks and payment providers;
- insurers and professional or legal advisers;
- professional regulators;
- local authorities or safeguarding services;
- the police or other statutory authorities where disclosure is required or justified by law; and
- courts or other bodies where we are legally required to provide information.
Before sharing confidential clinical information we also consider our professional duties of confidentiality.
Organisations that process information for us
We use specialist systems to provide and administer our services.
These include:
WriteUpp
Used as our primary clinical and practice-management system for clinical records, appointments and related service information.
Microsoft 365
Used for organisational email, communication and approved document storage.
Heidi
An approved AI-assisted clinical documentation tool which may be used to support transcription, multidisciplinary discussion and the preparation of clinical notes.
QbCheck / Qbtech
Used where appropriate as part of ADHD assessment pathways.
We may also use approved website hosting, IT support, accounting, banking, payment and other specialist suppliers.
Where an organisation processes personal information on our behalf, appropriate contractual and confidentiality requirements apply.
Artificial intelligence and clinical documentation
Approved technology may be used to support clinicians with tasks such as transcription, note preparation or structuring information for multidisciplinary discussion.
AI-assisted documentation does not replace clinical judgement.
Any clinically relevant output is reviewed by an appropriately qualified clinician before it is relied upon or incorporated into the clinical record.
We do not use solely automated decision-making to determine whether somebody receives a diagnosis or to make other decisions that have a legal or similarly significant effect on them.
Clinical conclusions remain the responsibility of the relevant clinicians.
Where information is stored
Our records are predominantly electronic and are held within approved clinical and business systems.
Some of our service providers operate or host systems in the United Kingdom or European Economic Area.
Some technology providers may process information in other countries as part of their wider service infrastructure.
Where personal information is transferred outside the United Kingdom and the transfer is subject to UK data protection restrictions, we require an appropriate legal mechanism and safeguards to be in place. These may include UK adequacy regulations or approved contractual safeguards such as the UK International Data Transfer Agreement or UK Addendum.
Further information about relevant international transfer safeguards can be requested from us.
How long we keep information
We do not keep personal information indefinitely.
Retention periods depend on the type of record and the reason it is being held.
Enquiries
Where an enquiry does not progress to a service, information is normally retained for up to 12 months from the last substantive contact.
If the enquiry progresses to an assessment or other clinical service, relevant information becomes part of the clinical record.
Clinical and assessment records
Clinical records are retained in accordance with our records-management arrangements and relevant professional and health-care records-management guidance.
Psychology and mental-health records are generally retained for 20 years from the end of the relevant episode of care or service, or 10 years after death, where applicable.
Records relating to children and young people are retained at least until the person’s 25th birthday, or 26th birthday where the young person was 17 when the episode ended. Where another applicable clinical retention period is longer, the longer retention period may be used.
Records may sometimes need to be kept for longer because of legal proceedings, safeguarding matters, regulatory requirements, contractual requirements or another justified reason.
Financial information
Accounting and financial records are normally retained for six years after the end of the relevant financial year, unless a longer period is required.
Complaints, incidents and governance records
Standalone complaint, incident and governance records are normally retained for six years, although records forming part of a clinical record follow the relevant clinical retention period.
Different retention periods may apply to commissioned services where the commissioner has specified lawful retention requirements.
When information is no longer required, it is securely deleted or disposed of in accordance with our records-management arrangements.
How we protect your information
We use organisational and technical measures to protect personal information.
These include:
- restricting information to staff and clinicians who need it for their role;
- role-based access controls;
- multi-factor authentication;
- encrypted organisation-managed devices;
- secure cloud systems;
- professional confidentiality requirements;
- staff data protection and information-governance training;
- controlled administrator access;
- information-security and personal-data-breach procedures;
- managed IT security support; and
- Cyber Essentials security controls.
No electronic system can remove all risk, but we take proportionate steps to protect the confidentiality, integrity and availability of the information entrusted to us.
Email communication
Email is our main method of communication.
We take reasonable steps to communicate securely and to minimise unnecessary confidential information in email.
Information that forms part of the clinical record may be transferred into our clinical record system rather than being retained solely within email.
If you have particular concerns about receiving information by email, please let us know.
Website information and cookies
When you visit our website, limited technical information may be processed to operate and protect the website. This may include IP address, device or browser information and information generated by cookies.
Essential cookies may be required for the website to function.
Where non-essential cookies, analytics or similar technologies require consent, they should only be activated after the appropriate consent has been obtained.
Information submitted through an online enquiry or contact mechanism is used to respond to the enquiry and may be transferred into our clinical or practice-management systems if you proceed with a service.
Marketing communications
We may occasionally provide information about our services, events or relevant updates.
Electronic marketing is undertaken in accordance with data protection law and the Privacy and Electronic Communications Regulations.
Where consent is required, we will obtain it. Where the law permits an existing-client or similar ‘soft opt-in’ arrangement, we may rely on this where appropriate.
You can unsubscribe from marketing communications at any time.
We will not sell your contact information to other organisations for marketing.
Your data protection rights
Depending on the circumstances and the legal basis we rely upon, you may have the right to:
- ask us for a copy of the personal information we hold about you;
- ask us to correct inaccurate information;
- ask us to complete information that is incomplete;
- ask us to erase information in certain circumstances;
- ask us to restrict how information is used in certain circumstances;
- receive certain information in a portable format;
- object to certain uses of your information;
- withdraw consent where consent is the basis for processing; and
- raise concerns about how your information is being used.
These rights are not absolute.
For example, we may be required to retain clinical information even where somebody asks for it to be deleted because of professional, legal, safeguarding or records-management requirements.
If a request relates to clinical records, we will consider both data protection law and our professional confidentiality obligations.
Your right to object
You have the right to object to processing that we carry out on the basis of legitimate interests.
If you object, we will consider your reasons and whether there are compelling legitimate grounds for the processing to continue.
You also have the right to object to direct marketing at any time. If you ask us to stop using your information for direct marketing, we will do so.
National Data Opt-out
The National Data Opt-out allows people to choose whether their confidential patient information can be used for purposes beyond their individual care, principally for research and planning.
Arlson Psychological Services Limited complies with the National Data Opt-out policy where it applies to services that are publicly funded or commissioned.
We currently use confidential patient information primarily for the assessment, care and support of the individual concerned and for the administration of those services. We do not currently undertake uses or disclosures of confidential patient information for research or planning that require National Data Opt-outs to be applied.
Any proposed future use or disclosure of confidential patient information for purposes beyond individual care will be assessed against the National Data Opt-out policy before the information is used or disclosed. Where the policy applies, National Data Opt-outs will be respected and the appropriate NHS process will be used before the information is disclosed.
Further information about the National Data Opt-out and how to make or change a choice is available from the NHS.
Accessing your information
You can ask for access to the personal information we hold about you. This is commonly known as a subject access request.
Please contact:
We may need to ask for information to confirm your identity before releasing confidential information.
We will normally respond within one month in accordance with data protection law. More time may be permitted in certain circumstances, for example where a request is particularly complex.
There is normally no charge for exercising your data protection rights.
If you think information is incorrect
Please contact us if you believe information we hold about you is inaccurate.
Factual inaccuracies can be corrected.
Clinical records may also contain professional observations, opinions, assessment findings or diagnostic conclusions. Where you disagree with a professional opinion rather than a factual error, we may retain the original clinical record but can consider recording your concerns or additional information alongside it where appropriate.
Complaints about how we use your information
If you have a concern about how your personal information has been used, please contact us first so that we have the opportunity to investigate.
You can contact us at:
You also have the right to complain to the Information Commissioner’s Office (ICO), which is the UK’s independent regulator for data protection.
Contact information and information about making a complaint are available on the Information Commissioner’s Office website.
Changes to this Privacy Notice
We review this Privacy Notice periodically and when there is a significant change to:
- the services we provide;
- the information we collect;
- how information is used or shared;
- our technology or suppliers; or
- data protection law or regulatory guidance.
The date at the top of this page shows when the notice was last updated.
Where a significant change affects how we use information we already hold, we will take appropriate steps to bring that change to the attention of the people affected.
Contact us
For general enquiries, data protection questions or to exercise your information rights:
Arlson Psychological Services Limited
9–11 Tatton Street
Knutsford
Cheshire
WA16 6AB
Email: info@ndperspectives.co.uk
Existing clients can also contact:
admin@ndperspectives.co.uk