​

When you use Rehab4kidz you trust me with your information. This privacy policy is meant to help you understand what data I collect, why I collect it, and what I do with it. I have tried to make it as simple as possible but if you have any questions please contact me.

 

Rebecca O’Mahoney assumes the function of data controller and gives assurance regarding the compliance with General Data Protection Regulation (GDPR) within the business.

 

1.       Information I collect

2.       Where I get my information

3.       How I use the information I collect

4.       Information I share

5.       How and when consent is obtained

6.       How I protect your data

7.       Protecting your rights to your data

8.       Security of your personal data

​

1         Information I collect

 

Rehab4kidz holds personal data as part of conducting a professional service. The data falls under the following headings: healthcare records, educational records, clinical records, general administrative records, and financial records.

 

1.1       Healthcare records

 

A healthcare record refers to all information collected, processed and held both in hard copy and electronic formats pertaining to the service user and their care.  Speech and language difficulties can be complex.  A wide range of information may be collected in order to best meet the needs of the client to maintain a high quality service, which meets best practice requirements. In order to provide a high quality service, a range of information may be collected.

​

Examples of data collected and held on all current and active clients include the following:

• Contact details: name, address, phone numbers, e-mail address,

• Personal details: date of birth,

• Other contacts: name and contact details of GP and any other relevant healthcare professionals involved.

• Parent/guardian details

• Description of family

• Educational placements.

• Pre- and post-natal history: This can include information relating to mother’s pregnancy, and child’s birth.

• Developmental data: developmental milestones, feeding history, audiology history.

• Medical details: such as any relevant illnesses, medications, and relevant family history. Reports from other relevant allied health professionals such as: Audiology, Psychology, CAMHS (Child & Adolescent Mental Health Services), Occupational therapy, Physiotherapy, Ophthalmology.

 

1.2       Educational records

 

Relevant Individual Educational Plans (IEPs), progress notes from educational staff and school reports may be held.

 

1.3       Clinical records

 

Specific data in relation to communication skills may be collected and held, such as assessment forms, reports, case notes, e-mails, text messages and transcripts of phone. Audio and video files may also be collected and stored.

 

1.4       General administrative records

 

Rehab4kidz may hold information regarding attendance reports and accident report forms.

 

1.5       Financial records

 

A financial record pertains to all financial information concerning the practice, e.g. invoices, receipts, information for Inland Revenue. Rehab4kidz may hold data in relation to: on-line purchasing history, card payments, bank details, receipts and invoices. Information will include name of bill payer, client name, address and record of invoices and payments made.

 

2         Where I get my information

 

Personal data will be provided by the client, or in the case of a child (under 16 years), their parent(s)/guardian(s). This information will be collected as part of a case history form prior to, or on the date of first contact.

 

Information may also be provided directly from relevant third parties such as schools, medical professionals and allied health professionals, with prior consent from the parent(s)/guardian(s).

 

3         How I use the information that I collect

 

I use the information I collect to provide assessment and therapy as per the relevant professional guidelines, as well as to maintain the general running of the business, such as running my electronic booking system, keeping my accounts and updating you of any changes in policies or fees.

​

Information may also be used for research purposes, with the written consent of the client or parent/guardian.

​

3.1       Data retention periods

​

The retention periods are the suggested time periods for which the records should be held based on the organisation’s needs, legal and/or fiscal precedence or historical purposes. Following the retention deadline, all data will be destroyed under confidential means.

​

3.2       Client Records

​

3.2.1         Clinical Records

Rehab4kidz keeps both physical and electronic records of clinical data in order to provide a service.

​

The preferred format for clinical data is electronic.

• Clinical data is deleted/confidentially destroyed after 2 years from last invoiced session. (Usually post discharge).

• Clinical data used for research purposes, (this will only be kept with express consent for this purpose) may be kept for longer than 2 years.

• Video records/ voice recordings relating to client care/videoconferencing records may be recorded with consent, analysed and then   destroyed. If written consent is provided to use recordings for training purposes, the client will have the option to withdraw consent at any time.

 

3.2.2         Financial Records

Rehab4kidz keeps electronic records of financial data from those who use its services.

Section 886 of the Direct Tax Acts states that the Revenue Commissioners require records to be retained for a minimum period of six years after the completion of the transactions, acts or operations to which they relate. These requirements apply to manual and electronic records equally

• Financial Data is kept for 6 years to adhere to Revenue guidelines.

• Financial Data (including non-payment of bills) can be given to Revenue at Revenue’s request.

​

3.2.3         Contact Data

Contact Data is kept for 6 years to allow processing of Financial Data if required.  (This may be retained for longer for safety, legal request, or child protection reasons.)

​

3.3       Exceptions

If under investigation or if litigation is likely, files must be held in original form indefinitely, otherwise files are held for the minimum periods set out above.

​

4         Information I share

I do not share personal information with companies, organisations and individuals outside Rehab4kidz unless one of the following circumstances apply:

​

4.1       With your consent:

I will only share your Personal Identifying Information (PII) to third parties when I have express written permission by letter or email to do so. I require opt-in consent for the sharing of any sensitive information.

Third parties may include: hospitals, GPs, other allied health professionals, educational facilities.

 

4.2       For legal reasons:

I will share personal information with companies or organisations outside of Rehab4kidz if disclosure of the information is reasonably necessary to:

• Meet any applicable law, regulation, legal process or enforceable governmental request.

• Meet the requirements of the Children First Act 2015.

• To protect against harm to the rights, property or safely of Rehab4kidz, my service users or the public as required or permitted by law.

 

4.3       To meet financial requirements:

Rehab4kidz also is required to share Financial data with the named accountant in order to comply with local tax laws. When the accountant is employed Rehab4kidz will obtain a copy of the accountant’s own data protection policy. 

 

4.4       For processing by third parties/external processing

No third parties are currently engaged for processing data:

 

5.      How and when I obtain consent

Prior to initial assessment or consultation, a link to the data protection policy on the website will be provided to clients along with a client personal details and consent form.  A consent form will need to be signed by the client prior to commencing the service. Copies of the signed client personal details and consent form will be given to both parties.

Should a client wish to withdraw their consent for data to be processed, they can do so by contacting Rehab4kidz.

 

6         How I protect your data

In accordance with the General Data Protection Regulation (GDPR), I will endeavour to protect your personal data in a number of ways:

 

6.1       By limiting the data that I collect in the first instance

All data collected by me will be collected solely for the purposes set out at 1 above and will be collected for specified, explicit and legitimate purposes.  The data will not be processed any further in a manner that is incompatible with those purposes save in the special circumstances referred to in section 5.1. Furthermore, all data collected by me will be adequate, relevant and limited to what is necessary in relation to the purposes for which it is collected which include, inter alia, the assessment, diagnosis and treatment of speech, language and communication disorders.

 

6.2       By transmitting the data in certain specified circumstances only

Data will only be shared and transmitted, be it on paper, electronically or by post, only as is required, and as set out in section 3.

 

6.3       By keeping only the data that is required, when it is required and by limiting its accessibility to any other third parties.

 

6.4       By disposing of/destroying the data once the individual has ceased receiving treatment

Within 3 years of the completion of treatment apart from the special categories of personal data as set out at 1.1 above.  Where data is required to be held by me for longer than the period of 3 years, I will put in place appropriate technical and organisational measures to ensure a level of security appropriate to the risk. These may include measures such as the encryption of electronic devices, pseudonymisation of personal data, and/or safe and secure storage facilities for paper/electronic records.

 

6.5       By retaining the data for only as long as is required

Which in this case is 3 years except for circumstances in which retention of data is required as set out at part 1.1 above or in certain specific circumstances as set out at Article 23(1) of the GDPR.

 

6.6       By destroying the data securely and confidentially after the period of retention has elapsed. 

This could include the use of confidential shredding facilities or, if requested by the individual, the return of personal records to the individual.

 

6.7       By ensuring that any personal data collected and retained is both accurate and up-to-date.

 

7         Protecting your rights to your data

 

7.1       Adult clients

Adults have the right to request data held on them as per article 15 of GDPR. A request must be made in writing. Further information regarding accessing your personal data are available in the document ‘Rights of Individuals under the General Data Protection Regulation’, downloadable from: www.gdprandyou.ie

 

7.2       Children

For children under the age of 16, data access requests are made by their guardians. When a child turns 16, then they may make a request for their personal data. However, this is subject to adherence with the Children First Act.

 

8         Security

Rehab4kidz, as with most providers of healthcare services is aware of the need for privacy. As such, I aim to practice privacy by design as a default approach, and only obtain and retain the information needed to provide you with the best possible service.

 

I work within Rehab4kidz  in a professional capacity and am briefed on the proper management, storage and safekeeping of data.

 

All data used by Rehab4kidz , including personal data may be retained in any of the following formats:

1.       Electronic Data

2.       Physical Files

 

The type of format for storing the data is decided based on the format the data exists in.
 

Where applicable, Rehab4kidz may convert physical files to electronic records to allow me to provide a better service to clients.

 

8.1       Data Security

Rehab4kidz understands that the personal data used in order to provide a service belongs to the individuals involved. The following outlines the steps which Rehab4kidz use to ensure that the data is kept safe.

 

8.1.1         Electronic Data

 

All electronic data is contained in the following systems:

e.g. Email system, shared folders, etc.

 

E mail; Gmail

• This system is physically located in USA.

• This system provider is aware of their requirements for GDPR compliance.

• The system has internal Rehab4kidz administrator

• This system has a Live Update for security enabled.

• I require a log in name and password in order to access the records.

• A copy of the files are not made on the users’ computer when in use.

 

 Windows laptop computer with Microsoft Office and external hard drive:

• This system is physically located in UK.

• This system provider is aware of their requirements for GDPR compliance.

• The system has an internal Rehab4kidz administrator

• This system has a Live Update (McAfee, Real Time virus and Spyware protection) for security enabled.

• I, alone working in Rehab4kidz have full access to records.

• I require a Log in name and password in order to access the records.

• A copy of the files are made on the users’ computer when in use but password protected

• I, as data controller in Rehab4kidz can change passwords.

 

8.1.2         Physical Files

• All physical data is located at Rebecca O’Mahoney’s home address.

• Only I, Rebecca O'Mahoney working in Rehab4kidz have access to these records.

• These records are kept secured with a lock and key.

 

8.2       Security Policy

8.2.1  Rehab4kidz understands that requirements for electronic and physical storage may change with time and the state of the art. As such, the data controller in Rehab4kidz reviews the electronic and physical storage options available to in Rehab4kidz every 12 months.

 

8.2.2         All physical devices used by myself working in Rehab4kidz which may contain any identifiable information are not enabled with loss theft tracking and remote wipe abilities.

 

8.2.3         I, as sole employee and data controller in Rehab4kidz am aware and briefed on and refresh the requirements for good data hygiene every 3 years. This briefing compliance is monitored by the Rehab4kidz  data controller and includes, but is not limited to:

• Awareness of client conversations in unsecure locations

• Enabling auto-lock on devices when leaving them unattended, even within in Rehab4kidz  locations.

• Use of non-identifiable note taking options. (initials, not names).

• The awareness of in Rehab4kidz  procedure should a possible data breach occur, either through malicious (theft) or accident (loss) of devices or physical files.

 

Rebecca O'Mahoney

Date of document: 25th September 2018 reviewed June 2021

Review Date: June 2022

​