Privacy Notice
Magic Words Therapy Limited
Last updated: 16th July 2026
Version: 2
Magic Words Therapy Limited takes your privacy seriously. This Privacy Notice explains how we collect, use, store, share and protect personal information about clients, families, professionals, website visitors, training attendees, room hire users and other people who contact or work with us.
This notice applies to:
children, young people and adults who use our speech and language therapy services
parents, carers and family members
professionals who refer to us or work with us
people who attend our training courses
people who contact us through our website, email, telephone, social media or enquiry forms
people who subscribe to our mailing list
professionals who use or enquire about our clinic room hire services
schools, local authorities, solicitors, insurers, case managers and other organisations we work with
We aim to be clear, open and respectful about how we use personal information.
1. Who we are
Magic Words Therapy Limited is the data controller for the personal information we process. This means we are responsible for deciding how and why personal information is used.
Company name: Magic Words Therapy Limited
Company number: 08725676
Address: 1 Bassett Court, Newport Pagnell, Buckinghamshire, MK16 0JN
Website: www.magicwordstherapy.co.uk
Email: enquiries@magicwordstherapy.co.uk
Telephone: 01908 614479
Our Data Protection Lead is:
Eleanor Harris
Email: eleanor@magicwordstherapy.co.uk
Address: 1 Bassett Court, Newport Pagnell, Buckinghamshire, MK16 0JN
You can contact Eleanor if you have any questions about how we use your personal information.
2. The personal information we collect
We may collect and use different types of personal information depending on your relationship with us.
For clients and families, this may include:
name
preferred name
legal name, where required for accurate record keeping
date of birth
address
telephone number
email address
parent or carer details
details of people with parental responsibility
emergency contact details
school, nursery, college or workplace information
GP and healthcare professional details
local authority details, where relevant
solicitor, insurer, case manager or representative details, where relevant
referral information
case history information
developmental history
medical and health information
speech, language and communication information
education information
neurodevelopmental information
assessment results
clinical observations
therapy notes
treatment plans
reports and recommendations
attendance information
correspondence with you and with relevant professionals
safeguarding information, where relevant
complaints, concerns or feedback
payment, invoicing and account information
For professionals, training attendees and room hire users, this may include:
name
role and professional title
organisation name
email address
telephone number
billing details
booking information
training attendance records
correspondence with us
marketing preferences
room hire enquiries and bookings
For website visitors and mailing list subscribers, this may include:
name and email address, if provided
contact form information
mailing list preferences
technical website information such as IP address, browser type, device information and cookie information, depending on your cookie settings and the technology used on our website
3. Special category information
Some of the information we process is classed as special category data under UK GDPR. This includes information about health, disability, neurodevelopmental profile, communication needs, medical history, emotional wellbeing, therapy needs and safeguarding information.
We process this information because it is necessary to provide safe, effective and appropriate speech and language therapy services.
When we process special category data, we must identify both:
a lawful basis under Article 6 UK GDPR; and
a special category condition under Article 9 UK GDPR.
For most clinical work, our Article 9 condition is that processing is necessary for the provision of health or care services, assessment, treatment, therapy, professional record keeping and connected clinical purposes. Special category data requires additional protection and organisations must document the lawful basis and Article 9 condition before processing it. [ico.org.uk], [ico.org.uk]
4. Where we collect information from
We may collect personal information directly from:
clients
parents and carers
people with parental responsibility
adult clients
professionals making referrals
our registration forms
case history forms
assessment sessions
therapy sessions
telephone calls
emails
website forms
enquiry forms
training or room hire booking forms
We may also receive information from third parties, including:
schools, nurseries, colleges and other education settings
Special Educational Needs Coordinators, known as SENCos
GPs
NHS consultants
paediatricians
occupational therapists
psychologists
educational psychologists
counsellors or mental health professionals, where relevant
local authorities
solicitors
SEND Tribunal documentation
insurers
case managers
other professionals involved in assessment, therapy, education, health or care
Where we receive information from another source, we will handle it in line with this Privacy Notice.
5. Why we use personal information
We use personal information to:
respond to enquiries
decide whether we can offer an appropriate service
arrange appointments
provide speech and language therapy assessments
provide therapy, advice, intervention and review
prepare assessment and review reports
communicate with clients, parents, carers and professionals
liaise with schools, GPs, NHS consultants and other relevant professionals
support Education, Health and Care needs assessment and EHCP-related work
support SEND Tribunal-related assessment and reporting where relevant
respond to solicitor instructions where relevant
support expert witness work where undertaken by appropriately trained therapists
manage safeguarding concerns
keep accurate clinical records
manage payments, invoices and accounts
manage room hire bookings
manage training course bookings and attendance
send newsletters and marketing communications where permitted
manage complaints, concerns or feedback
comply with professional, regulatory, safeguarding, insurance, accounting and legal obligations
improve our services
maintain website security and understand website use
6. Our lawful bases for using personal information
We must have a lawful reason for using personal information. The lawful basis depends on the purpose for which we are using the information. Privacy information should identify the purposes of processing, lawful basis, retention periods and who personal data is shared with. [ico.org.uk], [gdpr-info.eu]
Clinical services
We use personal information for clinical assessment, therapy, reports and record keeping.
Our lawful bases may include:
contract, where information is needed to provide services requested by you
legitimate interests, where we need to run our therapy service, manage clinical records, respond to enquiries or communicate with relevant people
legal obligation, where we must comply with safeguarding, accounting, regulatory or legal requirements
Where health or clinical information is used, our special category condition is usually that processing is necessary for the provision of health or care services.
Safeguarding
We may use and share personal information where necessary to protect a child, young person or adult from harm.
Our lawful bases may include:
legal obligation
vital interests
legitimate interests
Our special category condition may include substantial public interest, safeguarding, vital interests, health or care services, or legal claims, depending on the situation.
Invoicing, payments and accounting
We use personal information to issue invoices, process payments, manage accounts and keep financial records.
Our lawful bases may include:
contract
legal obligation
legitimate interests
Marketing and newsletters
We use personal information to send information about relevant services, training, clubs, events, room hire and professional opportunities.
Our lawful basis may be:
consent, where someone has opted in
legitimate interests or the soft opt-in rules, where legally permitted
You can unsubscribe from marketing emails at any time.
Room hire and professional services
We use personal information to manage enquiries, bookings, billing, communications and professional relationships connected with room hire.
Our lawful bases may include:
contract
legitimate interests
legal obligation, where relevant
HR, staff and recruitment
We use personal information about staff, applicants and contractors for recruitment, employment, payroll, HR administration, health and safety, safeguarding, supervision and legal compliance.
Our lawful bases may include:
contract
legal obligation
legitimate interests
employment law obligations
Special category data may be processed where necessary for employment, occupational health, safeguarding or legal reasons.
7. Consent
In some situations, we may ask for consent. For example, we may ask for consent to:
share information with a particular professional
use photographs, video or audio recordings
send certain marketing communications
contact additional people or organisations involved in a client’s care, education or support
Where we rely on consent, you can withdraw it at any time. Withdrawing consent will not affect anything we have already lawfully done before consent was withdrawn.
However, we do not rely on consent for every use of personal information. There may be situations where we are legally or professionally required or permitted to use or share information without consent. This may include safeguarding concerns, legal obligations, court orders, professional regulation, insurance requirements, legal claims or risks of serious harm.
8. Sharing information
We only share personal information where there is a lawful basis to do so and where sharing is necessary and appropriate.
We may share information with:
parents, carers and people with parental responsibility
schools, nurseries, colleges and SENCos
GPs
NHS consultants
NHS services
educational psychologists
occupational therapists
psychologists
local authorities
solicitors
SEND Tribunal or court bodies, where relevant
insurers
case managers
safeguarding teams or statutory agencies
professional regulators
our legal advisers
our accountants
our insurers
IT, cloud software, clinical record, booking, CRM, HR, accounting, payment, email and website service providers
Assessment and review reports are regularly shared with school SENCos, GPs and relevant NHS consultants where consent is given. They may occasionally be shared with local authorities, solicitors, SEND Tribunal, insurers and case managers where appropriate and consent is given.
We will not sell your personal information.
Where possible and appropriate, we will discuss professional information sharing with you in advance. However, we may share information without consent where we are legally required or permitted to do so, including for safeguarding, legal proceedings, regulatory requirements or the prevention of serious harm.
9. Software and service providers we use
We use trusted software and service providers to help us deliver and manage our services.
These include:
WriteUpp for clinical records and case management until 31 August 2026
Splose for clinical records and case management from 1 September 2026
Microsoft 365 for email, cloud storage, file sharing, Microsoft Teams video calls and related business tools
Xero for accounting
BrightHR for HR and health and safety information
PayPal, GoCardless and Stripe for payment processing
Skedda for professional room bookings
Squarespace for website forms and website-related functions
Mailchimp for marketing emails
HubSpot for customer relationship management
These providers may process personal information on our behalf. Where required, we expect our providers to handle personal information securely and in line with data protection law.
10. International transfers
Some of our software, cloud storage, payment, CRM, website, booking, marketing and administration providers may store or access personal information outside the UK.
Where personal information is transferred outside the UK, we will take steps to ensure that appropriate safeguards are in place. These may include UK adequacy arrangements, UK-approved contractual clauses or other safeguards recognised under UK data protection law.
This is particularly relevant because some major providers, including Microsoft 365, Mailchimp, HubSpot, Stripe, PayPal, GoCardless, Squarespace and other cloud-based services, may involve international data transfers depending on their infrastructure and settings.
11. How we store and protect personal information
We take appropriate steps to keep personal information secure.
Confidential clinical data is stored in clinical software and is not stored locally on laptops, phones, tablets or other devices.
We use measures such as:
encrypted cloud-based systems
password-protected accounts
enhance email filtering protection
access controls
secure clinical record systems
Microsoft 365 security controls
staff confidentiality obligations
staff training
secure deletion and retention processes
limiting access to people who need the information for their role
No system can be guaranteed to be completely secure, but we take reasonable and proportionate steps to protect personal information from unauthorised access, loss, misuse, alteration or disclosure.
12. How long we keep personal information
We only keep personal information for as long as necessary.
Paediatric clinical records
We retain paediatric clinical records until 7 years after the client’s 18th birthday.
Adult clinical records
We retain adult clinical records for 7 years following completion of treatment.
SEND, EHCP and Tribunal-related reports
Assessment reports for SEND Tribunal and EHCP-related work are retained until 7 years after the child’s 18th birthday, or for 7 years if the person was over 18 at the time of assessment.
Enquiries and waiting list information
Information about enquiries that do not become clients, including waiting list information, is retained for 1 year.
Complaints
Complaints are retained for:
7 years for adult clients
7 years after the child’s 18th birthday for paediatric clients
Safeguarding records
Safeguarding concerns are retained for:
7 years for adult clients
7 years after the child’s 18th birthday for paediatric clients
Safeguarding records relating to adult staff allegations are retained for 10 years.
Financial records
Pay-related records are retained for 3 years following the period to which they relate.
Other accounting, tax and invoice-related records may be retained for the period required for accounting, tax, insurance and legal purposes.
Recruitment records
Recruitment records for unsuccessful candidates are retained for 12 months.
For successful candidates, recruitment information forms part of the HR file.
HR records
HR files for successful candidates are retained for 6 months following the last day of employment.
Pay-related records are retained for 3 years following the period to which they relate.
Training attendee records
Training attendee records are retained for 12 months.
Marketing records
Marketing subscription records are retained until you unsubscribe or ask us to remove you. We may retain a limited suppression record to ensure we do not contact you again.
At the end of the relevant retention period, information will be securely deleted, anonymised or archived where appropriate.
13. Payment information
We do not store full card details.
Payments may be processed through third-party payment providers, including PayPal, GoCardless and Stripe. These providers are responsible for processing payment details securely in accordance with their own privacy and security obligations.
We may retain records of payments, invoices, outstanding balances and transaction references for accounting and business administration purposes.
14. Website, cookies and analytics
When you use our website, we may collect technical information such as:
IP address
browser type
device information
pages visited
time spent on the website
referral source
cookie or analytics identifiers
Our website is hosted on the Squarespace platform and uses cookies to support the operation, security and performance of the website. With your consent, we also use Google Tag Manager and Google Analytics to collect anonymous information about how visitors use our website. This helps us understand website usage and improve the information and services we provide.
Non-essential analytics cookies are only used after you have given your consent through our cookie banner. You can change or withdraw your consent at any time by selecting the Cookie Preferences link available on our website.
Some cookies are necessary for the website to work. Other cookies, such as analytics or marketing cookies, may require consent. The ICO states that organisations must tell people if cookies are used, explain what they do and why, and obtain consent unless the cookie is strictly necessary for the service requested by the user. [ico.org.uk], [ico.org.uk]
Our website uses a cookie banner and further information is available in our Cookie Policy.
15. Mailing lists and marketing
People may join our mailing list by opting in and leaving us their email address.
Speech and language therapy clients also provide their email address when registering with us. We may use email to communicate about assessment, therapy, administration, invoicing and service-related matters.
We also send marketing emails about relevant services, training, events, clubs, professional opportunities and room hire.
We may send marketing to:
parents
schools
professionals
previous clients
current clients
room hire prospects
We use Mailchimp for marketing emails.
You can unsubscribe from marketing emails at any time by clicking the unsubscribe link in our emails or by contacting us.
We will not sell your contact details to third parties.
16. Children and young people
Many of our clients are children and young people. We take particular care when processing children’s information.
We usually work with parents, carers or people with parental responsibility when arranging therapy for a child. Our Terms and Conditions explain who can consent to therapy for a child.
Where appropriate, and taking into account the child’s age, understanding and circumstances, we will also explain to the child or young person how their information is used in a clear and accessible way.
Where a young person has sufficient understanding to make decisions about their own information, we will take this into account.
17. Separated parents and parental responsibility
We sometimes work with families where parents are separated and more than one person has parental responsibility.
Where one parent requests access to a child’s records, we will consider:
whether the requesting parent has parental responsibility
the child’s age, understanding and wishes, where relevant
the child’s best interests
any safeguarding concerns
any court orders or legal restrictions
confidentiality owed to the child or others
whether disclosure would adversely affect the rights and freedoms of another person
whether information should be redacted before disclosure
If another parent disagrees with disclosure, this does not automatically prevent us from responding to a valid request. However, we will carefully consider the circumstances before sharing information.
We may ask for evidence of parental responsibility or identity before disclosing records. We may also seek legal advice where requests are complex, disputed or connected to safeguarding, court proceedings or family conflict.
18. Legal names, preferred names and respectful communication
We may need to retain a client’s legal name for accurate record keeping, safeguarding, audit, invoicing, professional accountability or legal purposes.
We will also record and use a client’s preferred name. We will avoid using a previous name or name that a client does not use in correspondence or routine paperwork, unless this is legally required, clinically necessary, required for accurate identification, or requested by the client.
19. Reports, assessments and professional opinions
Where we provide assessments, reports or professional opinions, these may include personal information, clinical observations, assessment results, recommendations and information provided by parents, carers, clients, schools or other professionals.
Reports will usually be shared with the person who commissioned the report and with others where:
you have asked us to share it
sharing is necessary for the purpose of assessment, therapy, education, care or support
sharing is required as part of legal, tribunal, EHCP or insurance processes
we are legally required or permitted to share it
Where reports are prepared for legal, tribunal, educational or local authority purposes, they may be used within those proceedings or decision-making processes.
Some therapists may receive direct instructions from solicitors or act as expert witnesses where they are trained and competent to do so.
20. Safeguarding and legal disclosures
We may use or share personal information without consent if this is necessary to:
protect a child, young person or adult from harm
respond to safeguarding concerns
comply with a legal obligation
comply with a court order
cooperate with a regulator or statutory body
prevent or detect crime
protect someone’s vital interests
establish, exercise or defend legal claims
Where possible and appropriate, we will explain this to you. However, there may be situations where we are unable to do so, for example if this would place someone at risk or prejudice an investigation.
21. Your rights
Under UK data protection law, you have rights in relation to your personal information. These may include:
the right to be informed about how your information is used
the right to access your personal information
the right to correct inaccurate or incomplete information
the right to request deletion of your information in certain circumstances
the right to restrict how your information is used
the right to object to certain uses of your information
the right to data portability in certain circumstances
the right to withdraw consent where we rely on consent
the right to complain to the Information Commissioner’s Office
Your rights may depend on the lawful basis we rely on and the circumstances of the request. For example, we may need to retain some clinical, safeguarding, legal, insurance or accounting records even if you ask us to delete them.
The ICO explains that individuals have rights including access, rectification, erasure in certain circumstances, restriction, objection, data portability in certain circumstances, withdrawal of consent where relevant, and the right to complain. [ico.org.uk], [gdpr-info.eu]
22. Subject access requests
You can ask us for a copy of the personal information we hold about you. This is known as a subject access request.
You can make a request verbally or in writing.
Please contact:
Eleanor Harris, Data Protection Lead
Email: eleanor@magicwordstherapy.co.uk
Address: 1 Bassett Court, Newport Pagnell, Buckinghamshire, MK16 0JN
We may need to confirm your identity before responding.
We will usually respond within one month. This may be extended in limited circumstances, for example if a request is complex or if multiple requests have been made.
For children’s records, we will consider the child’s age, understanding, best interests, confidentiality and the rights of those with parental responsibility before disclosing information.
23. Accuracy and updating your information
We aim to keep personal information accurate and up to date.
Please tell us if your contact details, school details, GP details, parental responsibility arrangements or any other relevant information changes.
You can ask us to correct information that you believe is inaccurate or incomplete.
24. Complaints
If you have concerns about how we use your personal information, please contact us first so that we can try to resolve the issue.
Eleanor Harris, Data Protection Lead
Email: eleanor@magicwordstherapy.co.uk
Address: 1 Bassett Court, Newport Pagnell, Buckinghamshire, MK16 0JN
You also have the right to complain to the Information Commissioner’s Office.
Information Commissioner’s Office
Website: https://ico.org.uk
Telephone: 0303 123 1113
25. Changes to this Privacy Notice
We may update this Privacy Notice from time to time. The latest version will be available on our website.
If we make significant changes to how we use personal information, we will take appropriate steps to bring those changes to your attention.
