Introduction

Therapy and Assessment Wellness Group Ltd, Trading as The Children’s Wellness Centre (“we”, “us”, “the Centre”) is committed to protecting your privacy, safeguarding personal information, and being fully transparent about how we collect, use, store, share, and retain personal data relating to you and your child in accordance with UK GDPR, the Data Protection Act 2018, the ICO Data Sharing Code of Practice, and relevant safeguarding legislation.

This policy explains what personal data we collect, how and why we use it, our lawful bases, how information is shared, retention periods, your rights, and how to contact us.

Who We Are

Therapy and Assessment Wellness Group Ltd, trading as The Children’s Wellness Centre and The Adults’ Wellness Centre, is the organisation responsible for the administration and coordination of services provided through the Centre.
Registered address/business address: 4–6 Dudley Road, Tunbridge Wells, Kent, TN1 1LF.
We are registered with the Information Commissioner’s Office (ICO) under registration number ZA260752. The Centre works with independently ICO-registered Clinical Practitioners.

What Personal Data We Collect

We may collect:

• Personal identification data
• Special category data (health, developmental, behavioural information)
• Technical data (IP addresses, logs)
• Financial and transaction data
• Information from schools, nurseries, GPs, CAMHS, or other professionals with consent

How We Collect Personal Data

We collect data through forms, emails, phone calls, service bookings, submitted reports, information from other professionals (with consent), and website usage.

Lawful Bases for Processing (Article 6 UK GDPR)

We process personal data under:

• Performance of a contract
• Legal obligation
• Legitimate interests
• Vital interests
• Consent (used only for marketing, photos, optional external sharing)

Lawful Bases for Special Category Data (Article 9 UK GDPR)

Used for therapy, assessment, safeguarding, and explicit consent where required:

• Article 9(2)(h) – health or social care provision
• Article 9(2)(g) – substantial public interest (safeguarding)
• Article 9(2)(a) – explicit consent

How We Use Personal Data

We use data to deliver services, plan sessions, manage bookings, administer payments, communicate with you, improve services, ensure safety, and perform anonymised supervision.

Internal Information Sharing

Information may be accessed by authorised members of the Centre’s management and administrative teams and by the Clinical Practitioner allocated to you or your child, where necessary for the administration or delivery of services. Clinical Practitioners are responsible for creating and maintaining appropriate clinical records relating to the services they provide. Clinical and administrative information may be stored within the Centre’s secure practice management system, with access provided according to role and legitimate need.

External Information Sharing

We share data externally:

• With your consent (schools, GPs, CAMHS, tutors, funders)
• Without consent only where lawful (safeguarding, court orders, legal obligations, risk to life)

Third Party Virtual Assistant Services

We may use carefully selected third-party virtual assistant or administrative support companies to assist with the day-to-day operation of our service, including administrative tasks, appointment coordination, responding to enquiries, record management and other business support activities. Where necessary for them to carry out these duties, authorised personnel may have limited access to personal information relating to clients, parents, carers or prospective clients. Access is provided only where required for the performance of their role and is subject to appropriate confidentiality, data protection and information security requirements. Where a third-party provider processes personal data on our behalf, we take appropriate steps to ensure that suitable contractual and data protection arrangements are in place. Where personal data may be accessed, processed or stored outside the UK, we will ensure that appropriate safeguards are in place in accordance with applicable UK data protection legislation. Third-party providers are not permitted to use your personal information for their own purposes unless they have an independent lawful basis for doing so.

Practice Management and Clinical Records System

We use WriteUpp, a secure practice management system, to support the administration and delivery of our services. WriteUpp may be used to store and process personal and special category data, including contact details, appointment information, forms, correspondence, clinical records and other information relevant to your or your child’s care. Access is restricted to authorised members of the Centre and Clinical Practitioners where required for their role. WriteUpp acts as a third-party data processor where it processes personal data on our behalf, and appropriate contractual and data protection arrangements are maintained in accordance with UK data protection legislation.

Data Controller and Joint Controller Relationships

The Children’s Wellness Centre acts as a Data Controller for personal information collected and processed in connection with the administration and delivery of our services, including enquiries, referrals, bookings, payments and service administration.

Where you or your child is allocated to an independent Clinical Practitioner, the Centre and the Practitioner may act as Joint Data Controllers in relation to personal and clinical information processed for the provision of assessment, therapy or other clinical services. The Centre is responsible for the administration and coordination of the service and provides the systems through which relevant client information is made available to the Practitioner. The Practitioner is responsible for exercising their independent professional and clinical judgement in the delivery of their service, including assessment or therapy, clinical decision-making, clinical documentation, reports and recommendations.

The Centre and its Clinical Practitioners have arrangements in place setting out their respective responsibilities for the protection and appropriate handling of personal data. You may contact the Centre in the first instance regarding the exercise of your data protection rights, although you retain the right to exercise your rights in respect of either Joint Data Controller where applicable.

Clinical Supervision

Practitioners share anonymised information in supervision.

Data from Schools or Other Providers

With consent, we may request information from educational or medical providers. It is securely stored and accessible to you upon request.

Retention Periods

We retain data until the child reaches age 25. Practitioners may retain clinical records per their regulatory requirements. Enquiry data is kept for up to 12 months. Financial records are kept for 7 years.

Security of Your Data

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. These measures include the use of secure practice-management and cloud-based systems, appropriate access controls, password protection, secure methods of communication where appropriate, physical security measures and confidentiality agreements.

International Transfers

Some services may store data outside the UK/EEA. Transfers use approved safeguards such as Standard Contractual Clauses.

Your Rights

You have rights to be informed, access data, rectification, erasure, restrict processing, object, portability, withdraw consent, and complain to the ICO.

Exercising Your Rights

Contact: office@childrenswellnesscentre.co.uk

Requests for clinical notes may also be directed to your Practitioner.

Data Breaches

Where a breach risks your rights, we will notify the ICO and affected individuals in line with legal requirements.

Cookies and Website Usage

See our Terms & Conditions for our Cookies Policy.

Photos, Videos, Testimonials, Marketing

Used only with explicit consent, which may be withdrawn at any time.

Complaints

You may complain to the ICO: https://ico.org.uk/concerns