Psychology4Learning Ltd Data Management, Protection and Privacy Policy
(this document can also be viewed as a pdf)
This Privacy Policy explains how Psychology4Learning Ltd collects, uses, stores, shares and protects personal information. It is intended for clients, parents/carers, children and young people, schools, professionals, website visitors and others who contact or work with us.
Psychology4Learning Ltd is the data controller for personal information that we collect and decide how to use. We process personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where relevant, the Privacy and Electronic Communications Regulations (PECR).
This policy sets out the basis on which personal data we collect from you, or that you provide to us, will be processed. This includes contact information used to communicate with individuals and organisations, information collected through our website, and confidential client information collected or generated as part of educational psychology work.
We aim to make this policy clear and accessible. Where information is provided for, or about, children and young people, we take account of their best interests and the need for additional protection because children may be less aware of the risks, consequences and rights associated with the use of their personal information.
Why do we need your personal information?
We use the data we collect from you for the following purposes:
o To respond to enquiries and communicate with you about services, appointments, consent, reports, invoices and related administration.
o To deliver educational psychology services to schools, educational settings, parents/carers, children and young people.
o To assess needs, plan involvement, complete observations, consultations, assessments, records and reports, and share agreed information with relevant people where appropriate.
o To manage contracts, payments, invoicing, accounts and business records.
o To meet safeguarding, professional, legal, regulatory, insurance and record-keeping obligations.
o To maintain and improve our services, website, information security and internal processes.
Collecting contact details
In order to deliver our services and respond to clients, prospective clients, schools and professional contacts, we collect and store contact information in secure business systems, including Microsoft 365 and internal records.
Contact details may be collected from website forms, emails, telephone calls, letters, consent forms, school referrals, contractual documentation, professional correspondence or publicly available sources such as school websites.
We do not sell or give your contact details to any third parties for marketing purposes.
Where we send service updates or marketing communications, we will do so only where we have a lawful basis and will provide a clear way to opt out. You can ask us not to process your personal data for marketing purposes at any time by contacting us at Info@psychology4learning.com.
What data do we collect?
Psychology4Learning Ltd provides educational psychology services to schools, educational settings and parents/carers regarding children and young people (CYP). We collect a range of information about parents/carers, schools, professionals and CYP for the purposes of educational psychology involvement and related administration. This includes:
o Names, postal addresses, telephone numbers and email addresses.
o CYP name, date of birth, school or setting, year group and relevant educational details.
o Information about learning, development, communication, social, emotional, behavioural, health, disability, safety, wellbeing and special educational needs.
o Special category data, where relevant, such as health information, disability information, ethnicity, language and other sensitive information needed to understand and support the CYP.
o Information about parents/carers, people with parental responsibility and other professionals or agencies involved.
o School attainment and progress data, attendance, exclusion information, support plans, Education, Health and Care Plans and other relevant educational records.
o Images, video, audio recordings, assessment responses, assessment scores, digital records and paper records where these are necessary to support our work.
o Payment, invoice and business administration information.
We may collect this information in some or all of the following ways:
o Parental/carer consent form
o Parent and school questionnaires
o Discussion with you and your child
o Discussion with schools staff and other professionals
o Observation of your child in their school / setting or home
o Direct work with you / your child
Information is usually collected directly from you, from the CYP, from schools or from other professionals involved. Where we need to contact another professional or agency to support an assessment or service, we will usually seek appropriate consent first unless there is a safeguarding, legal or other compelling reason to act without it.
How do we process your personal data?
Psychology4Learning Ltd complies with data protection obligations by processing personal data lawfully, fairly and transparently; collecting only the information needed for specified purposes; keeping information accurate and up to date where possible; retaining it only for as long as necessary; storing and destroying it securely; and protecting it against loss, misuse, unauthorised access or disclosure.
Where we process special category data, such as health, disability or ethnicity information, we do so only where necessary and where an additional UK GDPR condition applies. This may include explicit consent, provision of health or social care-type services, safeguarding, legal claims, or substantial public interest conditions where relevant. We document our reasons for using this information and apply additional safeguards.
Personal data is recorded in:
1. Consent Forms: Informed consent has to be provided before an Educational Psychologist (EP) will work with a CYP. The parents or legal guardians must sign a consent form (issued by Psychology4Learning Ltd) before the EP can work with the child. Scanned copies of the signed consent form are kept in the CYP electronic folder. Paper copies are shredded.
2. Master database: All CYP that are issued a consent form are recorded on the CYP master database (Excel spreadsheet) and given a unique reference number. This spreadsheet stores CYP and parent / carer information.
3. School Planning Notes: All new work is discussed between EP and School during a planning conversation (via phone or in person). A summary record may be kept of the planning meeting.
4. EP Report / Record: After working with an individual CYP, the EP will produce a report or record of involvement. This will include personal, and confidential, information related to the CYP and their family. A copy of this report is kept in the CYP electronic folder. A copy will be sent to the school (where the school has purchased the EP time) and to the parents / legal guardians.
Confidentiality statement
All work undertaken by Educational Psychologists on behalf of Psychology4Learning Ltd is confidential. Information is only shared with the specific consent of the CYP’s parent / legal guardian.
If disclosure of information is deemed necessary, EPs will aim to obtain specific informed consent from their clients, making the consequences of disclosure as clear and unbiased as possible. There are a number of circumstances where this might not be possible or may not apply: for example where the health, safety, security or welfare of the client or someone else may otherwise be put at risk; and if there are legal or safeguarding responsibilities.
Further information regarding confidentiality can be found in The British Psychological Society, Practice Guidelines, August 2017.
Who we may share information with
We only share personal information where it is necessary, lawful and proportionate. This may include sharing information with parents/carers, schools or educational settings, relevant professionals, associate educational psychologists or specialist staff working on our behalf, IT and secure communication providers, online assessment providers, accounting or payment providers, insurers, professional advisers, regulators, safeguarding agencies, local authorities or courts where required. We require service providers who process personal data for us to keep it secure and to use it only for the agreed purpose.
How the law allows us to use your information
We rely on one or more lawful bases under UK GDPR depending on the circumstances. These may include:
o Consent, for example where consent is requested for educational psychology involvement or for specific sharing of information.
o Contract, where processing is necessary to provide services or manage arrangements with clients, schools or suppliers.
o Legal obligation, where we must keep records, respond to lawful requests, meet tax/accounting obligations, or comply with safeguarding or other legal duties.
o Legitimate interests, where processing is necessary for the running of our services, managing enquiries, maintaining records, improving services, protecting our business, or communicating with schools and professional contacts, provided those interests are not overridden by individual rights and freedoms.
o Vital interests or safeguarding, where it is necessary to protect someone in an emergency or to keep a child, young person or another person safe.
Your rights to access information
You have the right to request access to personal information that we hold about you. This is known as a subject access request. Please contact Psychology4Learning Ltd directly if you wish to make a request.
We will respond to data protection rights requests without undue delay and usually within one calendar month. Where a request is complex, or where we receive multiple requests, we may extend the response period by up to a further two calendar months and will explain this where applicable. We may need to verify identity or ask for clarification before responding.
Client access to records will be restricted to information about themselves, or CYP where they are the parent / legal guardian. Restrictions will apply when disclosure would place the clients or others at risk of serious harm.
How do we protect your information?
We will always ensure we hold records about you (on paper and electronically) in an appropriately secure way, and we will only make them available to those who have a right to see them.
Examples of our appropriate security include:
o Use of secure Microsoft 365 services for business email, document storage and collaboration, with appropriate account access controls.
o Use of secure storage, restricted access, password protection, encryption where appropriate, and secure back-up arrangements.
o Use of secure methods to send educational psychology reports and other confidential documents.
o Training and guidance for staff and associates on confidentiality, secure handling of information and reporting concerns promptly.
o Secure management of paper records, including keeping paper information to a minimum, storing it securely, scanning where needed and shredding it securely when no longer required.
o Associate EPs, working on behalf of Psychology4Learning Ltd, may choose to keep paper records of work they have undertaken. Associate EPs will ensure all paper records are stored securely, and are shredded when no longer needed (in accordance with this Privacy Policy).
If a personal data breach occurs, we will assess the risk promptly, take steps to contain and investigate the incident, keep an internal record, and notify the Information Commissioner’s Office within 72 hours where required. If a breach is likely to result in a high risk to individuals’ rights and freedoms, we will also inform affected individuals without undue delay.
How long do we keep your personal information?
Psychology4Learning Ltd will keep CYP records and related information in the CYP electronic folder, until the CYP turns 25 years of age. In their 25th year, Psychology4Learning Ltd will delete the CYP electronic folder, related documentation, and remove them from the CYP master database.
If an EP works with a client who is aged 18 years or over, their records will be kept for 8 years. In the 8th year following the work, Psychology4Learning Ltd will delete the clients electronic folder, related documentation, and remove them from the client master database.
What can you do with your information?
Subject to legal exemptions, you have a number of rights in relation to your personal data. You can:
o Ask to access and obtain a copy of your personal data.
o Ask us to correct inaccurate or incomplete personal data.
o Ask us to delete personal data where there is no lawful reason for us to continue holding it.
o Ask us to restrict or object to certain processing.
o Ask for personal data to be transferred to another organisation where the right to data portability applies.
o Withdraw consent where we rely on consent. Withdrawal of consent will not affect processing that has already taken place, and we may still need to retain some information where there is another lawful reason to do so, such as safeguarding, legal, professional, insurance or record-keeping requirements.
If you believe Psychology4Learning Ltd has not complied with your data protection rights, please contact us at Info@psychology4learning.com so that we can investigate and respond. If you remain dissatisfied, you can complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection. You can contact the ICO through its website at www.ico.org.uk.
Online Assessment Software
Some assessments carried out by Psychology4Learning Ltd Educational Psychologists may use Pearson Q-interactive or other approved online assessment systems. These systems may process information such as the child or young person’s name, date of birth, assessment responses and assessment scores. Access is restricted to authorised professionals and data is used only for assessment and reporting purposes. Any assessment information temporarily stored on assessment devices is deleted when it is no longer required for the work. Information held in assessment systems is retained and deleted in line with our retention periods and the provider’s terms and privacy arrangements.
Data protection and Psychology4Learning Ltd websites, reports and guidance documents
1. Cookies and website technologies: Our website may use cookies or similar technologies to support website functionality, security, user preferences and website analytics. Cookies are small files placed on your device. Some cookies are necessary for the website to work. Other cookies or analytics technologies may require consent or an easy way to object, depending on their purpose. You can manage cookies through your browser settings and any cookie controls provided on our website.
2. Third party websites: Our website, reports and guidance documents may contain references to, or links to, other websites and services. Those organisations have their own privacy policies and we are not responsible for how they handle personal data. Please check their privacy information before submitting personal data to them.
Changes to our privacy policy
We may update this Privacy Policy from time to time to reflect changes in law, guidance, services, systems or working practices. The latest version will be made available on our website.
Contact details for Psychology4Learning Ltd
The data controller is Psychology4Learning Ltd. The person responsible for data protection queries is Claire Olliffe. Questions, comments, complaints and requests regarding this Privacy Policy or the way we handle personal information should be sent to Info@psychology4learning.com.
Updated June 2026