top of page

Privacy Policy

Last updated: 29 September 2026

 

Alison Nicholas Speech and Language Therapy is committed to protecting your privacy and handling your personal information securely, fairly and transparently.

This Privacy Policy explains what personal information I collect, why I collect it, how it is used and stored, who it may be shared with, and your rights in relation to your personal information.

 

It applies to information collected through this website, by telephone or email, during consultations and therapy sessions, and through my wider professional practice.

 

1. Who I am

 

I am Alison Nicholas MSc, RegMRCSLT, HCPC, an independent specialist Speech and Language Therapist providing assessment, therapy, clinical supervision and training.

 

For data protection purposes, I am the data controller, which means I am responsible for deciding how and why your personal information is processed.

​

My contact details are:

Alison Nicholas

23 Clive Place

Penarth

CF64 1AW

Telephone: 07760 154083

Email: anicholasslt@outlook.com

Website: www.alisonnicholasslt.co.uk

 

I am registered with the Information Commissioner's Office (ICO) as a data controller.

​

2. Data protection law

 

I process personal information in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), as amended, and other applicable legislation.

 

Health information is classed as special category personal data and receives additional protection under UK data protection law.

 

3. Personal information I may collect

 

The information I collect will depend on your relationship with me and the services being provided.

 

Enquiries and contact information

 

If you contact me by telephone, email or through the website, I may collect:

  • your name;

  • email address;

  • telephone number;

  • the name and age of the person you are enquiring about;

  • the information you include in your enquiry; and

  • any correspondence between us.

 

Please avoid sending detailed or highly sensitive medical information through the website contact form unless it is necessary.

 

Client and clinical information

​

In order to provide Speech and Language Therapy services, I may collect information including:

  • name, address, email address and telephone number;

  • date of birth;

  • parent, carer or guardian details;

  • details of family members where relevant;

  • GP details and details of other health, education or care professionals;

  • educational or childcare placements;

  • developmental and birth history;

  • feeding and hearing history;

  • medical history, diagnoses, illnesses and medication;

  • mental health information where relevant;

  • reports or information provided by other healthcare professionals;

  • communication, speech, language and stammering history;

  • assessment results;

  • therapy plans, programmes and clinical reports;

  • case notes and records of appointments;

  • relevant emails, text messages and telephone communications;

  • employment or vocational information where relevant;

  • audio or video recordings where these are clinically appropriate and you have agreed to them; and

  • other information necessary to provide appropriate assessment or therapy.

 

Information concerning health is special category data and is given additional protection under data protection law.

 

Financial and administrative information

 

I may also process information such as:

  • the name and contact details of the person responsible for payment;

  • invoices and receipts;

  • payment information; and

  • accounting and transaction records.

 

I do not normally need to retain full payment card details.

 

Website usage information

 

When you use this website, certain technical information may be collected automatically.

 

This may include:

  • IP address or approximate location;

  • device type;

  • browser type;

  • operating system;

  • pages visited;

  • time spent on the website;

  • referring website or search engine;

  • interactions with the website; and

  • cookie identifiers or similar information.

 

This information helps me maintain, secure and improve the website and understand how people find and use it.

 

4. Where I obtain personal information

 

Personal information may be collected:

  • directly from you;

  • from a parent, guardian or carer;

  • from the child, young person or adult receiving therapy;

  • during assessments, observations or therapy sessions;

  • from healthcare, education or other professionals involved in a client's care, where appropriate;

  • through correspondence, telephone calls and emails;

  • through the website contact form; and

  • automatically through website technologies such as cookies and analytics.

 

Where appropriate, I will obtain permission before requesting information from another professional.

 

5. How I use your information

 

I may use personal information to:

  • respond to enquiries;

  • assess whether my services are appropriate;

  • arrange, confirm and manage appointments;

  • provide Speech and Language Therapy assessment and treatment;

  • prepare reports, recommendations and therapy programmes;

  • monitor progress;

  • communicate with clients, parents, carers or guardians;

  • liaise with relevant professionals where appropriate;

  • send therapy resources;

  • provide clinical supervision or training;

  • maintain appropriate clinical and professional records;

  • issue invoices and receipts;

  • manage payments and accounting;

  • comply with professional, legal, regulatory and safeguarding responsibilities;

  • establish, exercise or defend legal claims;

  • protect the safety and security of my clients and practice;

  • operate and maintain this website; and

  • understand how visitors use the website and improve its content and performance.

I do not sell personal information to third parties.

 

6. My lawful bases for using personal information

 

UK data protection law requires me to have a lawful basis for processing personal information.

 

Depending on the circumstances, I may rely on one or more of the following:

 

Contract and steps before entering into a contract

I may process information where this is necessary to respond to a request for my services or to provide services that have been agreed.

 

Legitimate interests

I may process information where it is necessary for the legitimate operation of my professional practice, provided that these interests do not override your rights and freedoms.

 

This may include responding to enquiries, managing appointments, communicating with clients, administering my practice, protecting the security of my systems and improving my website and services.

 

Legal obligation

I may process information where necessary to comply with legal, tax, regulatory, professional or safeguarding responsibilities.

 

Consent

I may rely on consent where appropriate, particularly for optional activities such as certain video recordings, training materials or particular disclosures of information.

 

Where processing relies on consent, you can normally withdraw that consent at any time. Withdrawal does not affect processing that has already lawfully taken place.

 

7. Health and other special category information

 

Information about physical or mental health is classified as special category data.

Where I process health information for the purposes of assessment, treatment or the provision of Speech and Language Therapy, I rely on an appropriate lawful basis under Article 6 UK GDPR together with the health or social care condition under Article 9(2)(h) UK GDPR, as supported by the Data Protection Act 2018.

 

I am a regulated healthcare professional and am subject to professional duties of confidentiality.

 

Where another special category condition is more appropriate, for example where you have given explicit consent for a specific optional use, that condition may be relied upon instead.

 

8. Children and young people

 

A significant part of my work involves children and young people.

 

I take particular care when processing children's personal information and will only collect information that is reasonably necessary to provide services, maintain appropriate records and meet professional obligations.

 

Depending on the child's age, understanding and circumstances, information may be provided by or shared with a parent, guardian or carer. I will also take the child's or young person's own views, privacy and confidentiality into account where appropriate.

 

9. Sharing information with other professionals

 

Effective Speech and Language Therapy may involve collaboration with other professionals.

Where appropriate, and normally with your knowledge or agreement, relevant information may be shared with people such as:

  • GPs;

  • NHS Speech and Language Therapists;

  • teachers and school or nursery staff;

  • educational psychologists;

  • occupational therapists;

  • physiotherapists;

  • psychologists or mental health professionals; and

  • other professionals involved in the client's health, education or care.

 

Only information that is relevant and necessary will be shared.

Where general information is sufficient, personally identifying information will be avoided where reasonably possible.

 

There may be circumstances where I need to disclose information without consent, including where:

  • I have a legal obligation to do so;

  • disclosure is necessary to protect a child or adult from serious harm;

  • there is a safeguarding concern;

  • disclosure is necessary in connection with legal proceedings; or

  • another lawful public-interest or professional obligation applies.

 

10. Service providers and third parties

 

I may use carefully selected organisations to help operate my practice and website.

 

These may include providers of:

  • website hosting and website management;

  • email and communications;

  • IT and data storage;

  • accounting or professional services;

  • analytics and website performance services; and

  • other administrative or technical services.

 

These providers may process personal information on my behalf and are expected to protect it appropriately and only use it for authorised purposes.

 

Wix

This website is built and hosted using Wix.

 

Wix may process technical information relating to visitors to this website and may also process information submitted through Wix website features, including the contact form.

Wix and its service providers operate internationally, so website information may be processed outside the United Kingdom. Appropriate data protection safeguards are used where required.

 

Google Analytics

This website uses Google Analytics to help understand how visitors use the site.

Google Analytics may collect information such as:

  • pages viewed;

  • time spent on the website;

  • approximate geographical location;

  • device and browser information;

  • website interactions;

  • how you arrived at the website; and

  • identifiers used to distinguish visits or sessions.

 

Google Analytics uses IP addresses when processing information such as approximate location and routing. In Google Analytics 4, Google states that IP addresses are discarded before being logged or stored.

 

Analytics information is used to understand website performance and improve the website and its content. It is not intended to identify you personally.

Where consent is required for analytics cookies or similar technologies, Google Analytics will only be activated in accordance with your cookie preferences.

 

Google Search Console

I also use Google Search Console to understand how this website performs in Google Search.

 

Search Console provides information such as:

  • search terms through which the website is found;

  • impressions and clicks in Google Search;

  • website pages appearing in search results;

  • technical indexing information; and

  • general website performance data.

 

I use this information to monitor and improve the visibility and technical performance of the website.

 

11. Cookies and similar technologies

 

This website uses cookies and similar technologies.

 

Some cookies are required for the website to work correctly. Others may be used for purposes such as analytics and understanding how visitors use the website.

UK rules distinguish between technologies that are necessary for a website to function and those used for other purposes. Certain limited website analytics may also qualify for a statistical-purpose exception where the legal requirements for that exception are met.

Where consent is required, optional cookies will not be used until you have made your choice.

 

You can manage your preferences through the website's cookie controls. You can also restrict or delete cookies through your browser settings.

Further details about the cookies in use should be provided through the website's cookie banner or cookie settings.

 

12. How I store and protect personal information

 

I take reasonable technical and organisational measures to protect personal information against loss, misuse, unauthorised access, alteration or disclosure.

 

Information may be held in both paper and electronic form.

 

Paper clinical records are stored securely in locked storage.

 

Electronic reports, programmes, clinical correspondence and case notes are password protected and stored using appropriately secured systems or encrypted storage.

 

I aim to take only the minimum necessary confidential information away from secure storage. Where confidential information must be transported, I take reasonable measures to keep it secure.

 

No method of electronic transmission or storage can be guaranteed to be completely secure, but I take appropriate steps proportionate to the sensitivity of the information I hold.

 

13. Audio and video recordings

 

In some cases, assessment or therapy may involve making audio or video recordings.

 

Recordings used for clinical assessment or analysis will only be made where appropriate and with your agreement. Where recordings are temporarily made on a device, they will be protected and deleted once the necessary clinical analysis has been completed, unless there is a valid reason for retaining them.

 

I may separately ask for permission to retain or use recordings for professional training or educational purposes.

 

This is optional. Any such use will be discussed with you separately and an appropriate record of consent will be maintained.

 

14. How long I keep personal information

 

I only retain personal information for as long as reasonably necessary for the purpose for which it was collected and to meet professional, legal, insurance and regulatory obligations.

 

As a general guide:

Clinical records: normally retained for seven years following discharge. For children and young people, records may be retained until at least their 25th birthday where this results in a longer retention period.

 

Financial and accounting records: normally retained for up to seven years where required for accounting, tax or legal purposes.

 

Enquiries that do not lead to therapy: normally retained only for as long as reasonably necessary to deal with the enquiry and any appropriate follow-up.

Website analytics: retained in accordance with the retention settings applied to the relevant analytics service.

 

Temporary clinical recordings: deleted once they have been reviewed and are no longer required, unless separate permission has been obtained to retain them for another purpose.

 

When information is no longer required, paper records will be securely destroyed and electronic records securely deleted or anonymised where appropriate.

 

15. International transfers

 

Some technology providers used in connection with this website or practice, including Wix and Google, operate internationally.

 

This means personal information may sometimes be processed in countries outside the United Kingdom.

 

Where personal information is transferred internationally, I take reasonable steps to ensure that an appropriate legal mechanism and safeguards are in place, where required by UK data protection law. These may include transfers to countries covered by UK adequacy regulations or the use of approved contractual safeguards.

 

16. Your data protection rights

 

Depending on the circumstances, you may have rights including:

  • the right to be informed about how your information is used;

  • the right of access to personal information held about you;

  • the right to rectification of inaccurate or incomplete information;

  • the right to erasure in certain circumstances;

  • the right to restrict processing in certain circumstances;

  • the right to data portability in certain circumstances;

  • the right to object to certain types of processing; and

  • rights relating to certain forms of automated decision-making and profiling.

 

Not all rights apply in every situation. For example, professional and legal record-keeping requirements may mean that I cannot delete clinical information simply because a request is made.

 

If you wish to exercise your rights, please contact me using the details at the beginning of this policy.

 

I will normally respond to a valid data protection request within the period required by law.

 

17. Automated decision-making

 

I do not use personal information to make solely automated decisions that produce legal or similarly significant effects concerning clients.

 

18. Data breaches

 

I take appropriate steps to prevent personal information from being accidentally or unlawfully lost, accessed, altered or disclosed.

 

If a personal data breach occurs, I will assess the risk involved and take appropriate action.

Where required by law, I will notify the Information Commissioner's Office and, where necessary, affected individuals.

 

19. Complaints

 

If you have concerns about how I use your personal information, please contact me first so that I can investigate and respond.

 

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data protection regulator.

 

Information about making a complaint is available at www.ico.org.uk.

 

ICO telephone: 0303 123 1113

 

20. Links to other websites

 

This website may contain links to external websites.

 

I am not responsible for the privacy practices, security or content of third-party websites.

 

You should review the privacy information provided by those organisations when visiting their websites.

 

21. Changes to this Privacy Policy

 

I may update this Privacy Policy from time to time to reflect changes to my services, technology, professional practices or legal requirements.

 

The latest version will be published on this website and the date at the top of this page will be updated accordingly.

 

22. Contact

 

If you have any questions about this Privacy Policy or how your personal information is handled, please contact:

 

Alison Nicholas

23 Clive Place

Penarth

CF64 1AW

Telephone: 07760 154083

Email: anicholasslt@outlook.com

bottom of page