Privacy Policy

At Making Sense Neurodiversity, we understand that you may share personal and sometimes very sensitive information with us.

We want you to feel confident about what happens to that information, why we need it, who may see it and how we keep it safe.

This Privacy Notice explains how Making Sense Neurodiversity Ltd collects, uses, stores and shares your personal information when you enquire about or use one of our services.

Who we are

Making Sense Neurodiversity Ltd is responsible for the personal information we hold about you.

Hannah Geary, Founder/Director, oversees data protection within Making Sense Neurodiversity.

If you have any questions about how we use your information, you can contact us:

Email: hello@makingsenseneurodiversity.co.uk

What information might we collect?

The information we need will depend on the service you are using.

It may include:

• your name, date of birth and contact details

• information you provide when you enquire about our services

• information about your neurodivergence or diagnoses

• physical or mental health information

• developmental and family history

• information about your education, employment, relationships or home life

• your strengths, difficulties, needs and goals

• medication or relevant healthcare information

• questionnaire responses

• information about communication, sensory or reasonable adjustment needs

• clinical notes

• your Making Sense report or other relevant reports

• safeguarding or risk information, where relevant

• correspondence between you and Making Sense Neurodiversity

• information required for appointments, invoices and payments

We will only ask for information that we reasonably need to provide or safely manage the service you are using.

Where does your information come from?

Most of the information we hold will come directly from you.

Sometimes information may also be provided by someone else, for example:

• a family member or partner

• a professional involved in your care or support

• somebody making a referral

• another member of the Making Sense Neurodiversity team involved in your support

Where appropriate, we will make sure you understand when information from another person forms part of your record.

Why do we use your information?

We may use your information to:

• respond to your enquiry

• arrange and manage appointments

• understand you and your individual needs

• provide the service you have asked us to provide

• make appropriate reasonable adjustments

• prepare your personalised Making Sense report or other relevant documentation

• provide continuity between staff

• communicate with you

• manage risk or safeguarding concerns

• maintain appropriate records

• respond to complaints or concerns

• manage invoices and payments

• meet our professional, legal and regulatory responsibilities

• maintain the safety and quality of our services

We will not use your personal or sensitive information for an unrelated purpose simply because we hold it.

Our legal basis for using your information

Data-protection law requires us to have a lawful basis for collecting and using your personal information.

Where we use your information to provide a service that you have asked us to provide, our main lawful basis is that the processing is necessary for our contract with you, or to take steps at your request before entering into that contract.

Before registration, we provide our Privacy Notice and Payment and Cancellation Terms. Our Before We Meet form asks you to confirm that you have received and read this Privacy Notice and that you have read and agreed to the Payment and Cancellation Terms. These acknowledgements are recorded as part of our onboarding process.

In some circumstances, we may also process information because this is necessary to meet a legal obligation or because we have a legitimate interest in the safe and effective administration of our services.

Some of the information you share with us, particularly information about your physical or mental health, is classed as special category data and receives additional protection under data-protection law.

Where we process this information as part of the health or social care and support services we provide, we rely on Article 9(2)(h) of the UK GDPR and the relevant provisions of the Data Protection Act 2018. This allows health and social care information to be processed where this is necessary for providing or managing appropriate care or support and where the information is handled by, or under the responsibility of, a professional who is subject to an appropriate duty of confidentiality.

Different lawful grounds may apply where information needs to be used for purposes such as safeguarding, complying with a legal obligation or establishing, exercising or defending legal claims.

Is everything I tell you confidential?

Information you share during your work with Making Sense Neurodiversity will normally be treated as confidential.

We will not ordinarily share your personal or sensitive information with family members, employers or other professionals without an appropriate reason and, where required, your consent.

There are some circumstances in which we may need to share information without your consent. For example, this could happen if:

• we believe you or somebody else is at serious or immediate risk of harm

• we have safeguarding concerns about a child

• we have safeguarding concerns about an adult at risk

• we are legally required to disclose information

• there is another serious and lawful reason why information needs to be shared

Wherever it is safe and appropriate, we will try to discuss this with you before information is shared.

If information does need to be shared, we will aim to share only what is necessary for the purpose.

Sharing information within Making Sense Neurodiversity

If you see more than one member of the Making Sense Neurodiversity team, relevant information may be shared between the practitioners and authorised staff involved in your support.

For example, if you complete the Making Sense of You pathway with one practitioner and then continue your support with another practitioner, relevant information may be shared with them, including your Making Sense report. This helps us provide continuity and means you should not have to start again or explain your story from scratch.

Practitioners and authorised staff will only have access to information they reasonably need for their role. Everyone working with Making Sense Neurodiversity is required to protect your confidentiality and handle your information appropriately.

Will you share my information with anyone else?

We will not routinely share your information outside Making Sense Neurodiversity.

Where appropriate, information may be shared with people or organisations such as:

• your GP or another healthcare professional, where you have asked us to share it or there is another appropriate reason to do so

• another professional involved in your care or support

• safeguarding services

• emergency services

• professional regulators or other bodies where legally or professionally required

• organisations that securely process information on our behalf, such as technology, appointment-management, communication, payment or administrative service providers

We will always consider why information needs to be shared and how much information is actually necessary.

How do we keep your information safe?

Making Sense Neurodiversity uses appropriate measures to protect your information.

These include secure business systems, password protection, access controls and limiting access to people who genuinely need information to carry out their role. All Making Sense Neurodiversity practitioners and authorised staff who access Cliniko are required to use their own individual account with two-factor authentication enabled. Access permissions are assigned according to role, and accounts must not be shared.

We use the following systems to support our work:

Cliniko

Cliniko is our central system for managing appointments and maintaining client clinical records. This includes relevant assessment information, questionnaires, clinical notes, reports, consent information and correspondence.

Where appropriate, we use Cliniko's secure patient forms and communication functions to collect and exchange information.

Tamar Telecommunications

We use Tamar Telecommunications to provide our business telephone service. Where call recording is not enabled, Tamar does not routinely record the audio content of standard telephone conversations. Tamar processes telephone service information such as calling and called numbers, dates and times, call durations and call status for purposes including routing, administration, security, troubleshooting and billing.

If you leave us a voicemail, Tamar stores the message within the UK and automatically deletes it after fourteen days. Access is restricted to authorised users, although Tamar personnel may access messages where necessary for support, maintenance or service-related investigations. We record relevant information from telephone calls and voicemail in Cliniko where needed for the provision of services, safeguarding or appropriate record keeping. Those records follow our applicable retention schedule rather than Tamar's fourteen-day voicemail period.

Tamar confirms that information handled within its own network is stored and processed in the UK; other independent telecommunications networks may have different arrangements. Tamar may also process certain customer information for its own operational, analytics or marketing purposes under its published privacy terms. This does not mean that our telephone conversations are routinely recorded or used for marketing.

Microsoft 365

We use Microsoft 365 for business emails, administration, online working and preparing documents. This includes services such as Outlook, Word, Teams and SharePoint or OneDrive.

Sometimes you may send us personal or sensitive information by email, or we may use Microsoft Word to prepare your report.

Where information received by email is relevant to your clinical record, we transfer it into Cliniko. Completed clinical reports are also stored within your Cliniko record.

We manage emails, attachments and temporary documents securely and do not keep unnecessary duplicate copies of your information. Where original correspondence needs to be retained for clinical, safeguarding, legal or other appropriate reasons, we keep it in accordance with our records-retention arrangements.

Practitioners and authorised staff are expected to use approved systems when accessing or storing Making Sense Neurodiversity client information and should not retain unnecessary copies of information on personal devices or personal cloud-storage accounts.

Optional client experience feedback

Following completion of support, we will send you an invitation to complete an optional, anonymous Client Experience Feedback Form through Microsoft Forms. Completion is entirely voluntary and does not affect the support you receive.

The form will be configured not to request your name or email address. Please avoid including names or other identifying details in free-text answers, as information you choose to include could identify you. Feedback is used to help us understand and improve clients’ experiences of our services.

Online appointments

At the current time, Making Sense Neurodiversity appointments are provided online.

We take reasonable steps to ensure online appointments are conducted privately and using appropriate systems. We also encourage you, where possible, to join your appointment somewhere you feel comfortable and able to speak privately.

If there is an immediate safety concern during a remote appointment, we may need to use information about your location or contact details to help arrange appropriate assistance.

International transfers

We use Microsoft 365 and Cliniko to support our services. Some personal information may be processed outside the UK. Where this occurs, appropriate safeguards are used in accordance with UK data-protection law. Tamar confirms that information processed on its own telephone network is held and processed in the UK; other telecommunications networks are outside Tamar’s direct control.

How long will we keep your information?

We will keep client and business records only for as long as there is an appropriate reason to do so.

The length of time may differ depending on the type of information.

Our usual retention periods include:

• Adult client records: Eight years after your last contact with Making Sense Neurodiversity or completion of support, whichever is later. Records may be kept for longer where there is a legal, safeguarding, regulatory, insurance or other legitimate reason.

• Children's and young people's records: Normally until the person's twenty-fifth birthday, or twenty-sixth birthday where they were seventeen when support ended.

• Enquiries that do not proceed: Normally twelve months after the last meaningful contact.

• Routine administrative correspondence: Only for as long as it is needed.

Different periods apply to other records, including complaints, incidents, financial records and information relating to staff.

When deciding how long information should be retained, we consider relevant legal requirements, professional standards, safeguarding needs, insurance requirements and the reason the information was collected.

Making Sense Neurodiversity maintains a Records Retention Schedule setting out the retention periods that apply to different types of information.

Information may need to be kept for longer where there is a legal, safeguarding, regulatory, insurance or other legitimate reason.

When information no longer needs to be retained, it will be securely deleted or destroyed unless there is a lawful reason to keep it for longer.

Your rights

Data-protection law gives you rights in relation to your personal information.

Depending on the circumstances, these may include the right to:

• ask what personal information we hold about you

• ask for a copy of your personal information

• ask us to correct information that is inaccurate

• ask us to restrict how information is used in certain circumstances

• ask for information to be deleted in certain circumstances

• object to certain uses of your information

• request transfer of information in certain circumstances

• withdraw consent where we are relying specifically on your consent

These rights do not all apply in every situation, and there may be circumstances in which we are legally required to retain or continue processing particular information.

If you would like to see your records

You can ask us for a copy of the personal information we hold about you. You do not need to use any particular wording to make this request.

Please contact:

Email: hello@makingsenseneurodiversity.co.uk

We may need to confirm your identity before releasing information.

If you are unhappy about how we have used your information

If you have any concerns about how your information has been handled, please contact:

Hannah Geary

Founder/Director

Making Sense Neurodiversity Ltd

Email: hello@makingsenseneurodiversity.co.uk

We would like the opportunity to understand your concern and try to resolve it.

You also have the right to raise a concern with the Information Commissioner's Office (ICO), the UK's independent regulator for data protection.

Information about your rights and how to contact the ICO is available on the ICO website.

Changes to this Privacy Notice

We may update this Privacy Notice if our services, systems or legal responsibilities change.

The most up-to-date version will be available through Making Sense Neurodiversity.