Sensoryflex Privacy Notice


Last updated: 21st July 2026


Sensoryflex CIC respects your privacy and is committed to protecting the personal information of children, young people, families and professionals who contact or work with us.


This Privacy Notice explains what information we collect, why we collect it, how we use it, who we may share it with, how long we keep it, and your rights.


Sensoryflex provides occupational therapy and related support for children and young people, including sensory integration-informed therapy, parent consultation, school support, assessment, reports, EHCP-related work and commissioned provision.


1. Who we are


Sensoryflex CIC is the organisation responsible for the personal information we collect and use.


Organisation: Sensoryflex CIC
Company/CIC number: 17128228
Registered address: The Pavilion, Recreation Ground, Tolleshunt D’Arcy, Essex
Service location: The Pavilion, Recreation Ground, Tolleshunt D’Arcy, Essex
Website: www.sensoryflex.com
Email: contact@sensoryflex.com
Privacy contact: William Westmancott


Sensoryflex is the “data controller” for the information we collect for our own services. This means we decide why and how personal information is used.


Where Sensoryflex is commissioned by another organisation, such as a school, local authority or another service, responsibilities for data protection may be shared or may depend on the commissioning arrangement.


2. Who this Privacy Notice is for


This Privacy Notice applies to:

  • children and young people who receive support from Sensoryflex
  • parents, carers and family members
  • people with parental responsibility
  • schools, local authorities and other professionals
  • people who contact us through our website, forms, email, telephone, booking system or social media
  • people who attend sessions, events, groups or consultations

3. What information we collect

We only collect information that is relevant to providing safe, appropriate and effective support.

This may include:


Child or young person information


  • name, date of birth and age
  • address and contact details
  • education setting, year group and attendance information
  • reason for referral
  • strengths, interests, priorities and goals
  • developmental, sensory, motor, emotional, behavioural and functional information
  • health, medical, diagnostic and SEND information
  • medication, allergies, seizures, emergency plans and safety risks
  • communication needs and reasonable adjustments
  • details of professionals involved
  • EHCP, EOTAS, tribunal or local authority information where relevant
  • clinical notes, assessment findings, reports, therapy plans and recommendations
  • photographs or video recordings, where these are clinically necessary and agreed


Parent, carer and family information


  • names and contact details
  • relationship to the child or young person
  • parental responsibility and consent information
  • emergency contact details
  • relevant family context where this affects support, safety or communication
  • billing, booking and payment information
  • emails, messages, forms and telephone notes


Professional and commissioner information


  • names, roles and contact details
  • school, local authority, NHS, social care or other professional involvement
  • referral information, reports, emails and meeting notes
  • commissioning, funding and service agreement information


Website and enquiry information


If you contact us through the website, email, social media, booking system or online forms, we may collect the information you choose to provide, such as your name, contact details and message.

Our website may also collect basic technical information, such as IP address, browser type and website usage data, depending on the website tools and cookies in use.


4. Special category data


Some of the information we collect is classed as “special category data” under UK data protection law. This includes health information and information about disability, neurodevelopmental needs, mental health, therapy, diagnosis and support needs.


We collect this information because it is necessary to understand the child or young person’s needs, plan safe support, make appropriate clinical decisions, keep accurate records and meet professional responsibilities.


We treat this information with particular care.


5. Why we use personal information


We use personal information to:

  • respond to enquiries
  • decide whether Sensoryflex is an appropriate service
  • arrange appointments, consultations, assessments, groups or therapy sessions
  • understand the child or young person’s needs
  • plan and provide safe and appropriate occupational therapy support
  • make reasonable adjustments
  • communicate with families and professionals
  • complete clinical notes, reports, programmes and recommendations
  • support EHCP, EOTAS, school or local authority work where relevant
  • manage bookings, payments, cancellations and administration
  • keep records required by professional, legal, insurance and safeguarding responsibilities
  • respond to complaints, concerns or requests for information
  • protect children, young people, families, staff and others from harm
  • improve and develop our service


6. Our lawful bases for using information


Under UK data protection law, we must have a lawful basis for using personal information.

Depending on the situation, we may rely on one or more of the following lawful bases:


Contract

We may use information because it is necessary to provide a service you have requested or to take steps before providing that service.

For example, this may include arranging appointments, providing therapy, sending reports, managing bookings or handling payment.


Legal obligation

We may use or keep information where we have a legal duty to do so.

For example, this may include safeguarding duties, accounting records, responding to lawful requests, or meeting legal and regulatory requirements.


Legitimate interests

We may use information where it is necessary for Sensoryflex’s legitimate interests, provided this does not override the rights and interests of the child, young person or family.

For example, this may include responding to enquiries, keeping appropriate business records, managing service quality, handling complaints, protecting the organisation and maintaining safe working practices.


Vital interests

In an emergency, we may use or share information if this is necessary to protect someone’s life or prevent serious harm.


Consent

We may ask for consent for specific activities where appropriate.


For example, we may ask for consent for:

  • clinical photography or video
  • sharing information with named people or organisations
  • using anonymised feedback
  • receiving newsletters or marketing updates
  • using photographs, stories or comments for publicity


Consent can normally be withdrawn at any time. Withdrawing consent does not affect anything we have already done lawfully before consent was withdrawn.


7. Our condition for using health and special category information


Because we provide health-related occupational therapy support, we may use health and SEND information where it is necessary for the provision of health or social care, assessment, treatment, professional record keeping and related management of care.

Where this does not apply, we will identify another appropriate condition, such as explicit consent, safeguarding, legal claims or substantial public interest, depending on the situation.


8. Consent, capacity and children’s involvement

Where a child or young person is able to understand decisions about their information, we will involve them as much as possible.

For younger children, or where a child or young person does not have sufficient understanding to make a particular decision, we will usually rely on a person with parental responsibility or another person legally able to act on their behalf.

We will still aim to explain information in a way the child or young person can understand and respect their views, wishes and feelings wherever possible.


9. Who we may share information with

We only share personal information where there is a clear reason to do so.

Depending on the service, we may share relevant information with:


  • parents or carers
  • people with parental responsibility
  • the child or young person, where appropriate
  • schools, colleges or education providers
  • local authorities
  • NHS or private health professionals
  • social care professionals
  • safeguarding agencies
  • other professionals involved in the child or young person’s support
  • insurers, legal advisers or professional advisers
  • booking, payment, IT, email, website, accounting or administrative service providers
  • regulators or public bodies where required


We will normally discuss information sharing with you unless there is a safeguarding concern, legal reason, emergency or serious risk that means we need to share information without prior agreement.

We will not sell personal information.


10. Safeguarding and serious risk

Sensoryflex has a responsibility to act if we are concerned that a child, young person or another person may be at risk of harm.

If we believe there is a safeguarding concern, serious risk, medical emergency or legal requirement, we may share relevant information with appropriate people or agencies without asking for consent first.

This may include children’s social care, emergency services, healthcare professionals, schools, local authorities or safeguarding leads.

Where possible and appropriate, we will try to discuss this with the family, child or young person.


11. Clinical photography and video

Photographs or videos may sometimes be helpful for clinical purposes, such as recording posture, movement, equipment use, participation, regulation strategies or progress.

We will only use photographs or video for clinical purposes where this is relevant and agreed.

Clinical images or videos are treated as part of the clinical record. They are not used for publicity, marketing, social media, fundraising or website content unless separate, specific consent has been obtained.

You can refuse clinical photography or video without this affecting access to support, unless the image or recording is essential for a specific assessment or report. If that happens, we will explain why.


12. Publicity, marketing and social media

Sensoryflex will not use identifiable photographs, video, names, comments, stories or case examples for publicity, social media, fundraising, marketing or website content without separate consent.

Consent for publicity or marketing is optional and separate from consent for therapy or assessment.

You can withdraw publicity or marketing consent at any time. We will stop using the material where we reasonably can, although we may not be able to remove material that has already been printed, shared externally or copied by others.


13. Email, forms and online systems

We may use secure online forms, email, booking systems, payment systems, cloud storage, website tools and administrative software to provide our service.

Examples may include:

  • Microsoft Forms or Microsoft 365
  • Bookwhen or another booking system
  • Stripe or another payment processor
  • website enquiry forms
  • secure cloud storage
  • accounting or administrative software
  • email and calendar systems


These providers may process information on our behalf. We aim to use reputable providers with appropriate security and data protection arrangements.

Please be aware that email is not always a fully secure method of communication. We will take reasonable steps to protect sensitive information, but families and professionals should avoid sending unnecessary highly sensitive information by email where a more secure option is available.


14. Reports and documents from other services

You may choose to send us reports or documents from schools, NHS services, local authorities, private professionals or other organisations.

We will use these documents to understand needs, avoid unnecessary repetition, plan support and prepare reports or recommendations where relevant.

Please only send documents that are relevant to the service being requested.

If a document contains information about other people, we will only use what is necessary for the purpose of providing support.


15. How we keep information safe

We take reasonable steps to protect personal information, including:

  • using password-protected systems
  • limiting access to people who need the information
  • keeping clinical records and reports securely
  • using appropriate electronic storage
  • taking care when sending sensitive information
  • using secure passwords and device protection
  • keeping paper records secure where used
  • reviewing what information we collect and keep

No system can be guaranteed to be completely secure, but we take confidentiality and information security seriously.


16. How long we keep information

We keep information only for as long as we need it for the purpose it was collected, including clinical, safeguarding, legal, insurance, tax and professional record keeping requirements.

As Sensoryflex works with children and young people, clinical records are usually kept until the child or young person reaches their 25th birthday, or 26th birthday if they were 17 when treatment ended.

Some records may be kept for longer where this is necessary, for example where there are safeguarding concerns, legal proceedings, complaints, insurance issues or another clear reason.

Financial and accounting records are usually kept for at least 6 years.

Enquiry information that does not lead to a service may be kept for a shorter period, unless there is a reason to keep it longer.

When information is no longer needed, we will delete it or dispose of it securely.


17. Your rights

Under UK data protection law, you may have the right to:

  • ask for a copy of personal information we hold
  • ask us to correct inaccurate information
  • ask us to delete information in some circumstances
  • ask us to restrict how we use information in some circumstances
  • object to how we use information in some circumstances
  • withdraw consent where we are relying on consent
  • ask for information to be transferred to another organisation in some circumstances
  • complain to the Information Commissioner’s Office

These rights do not apply in every situation. For example, we may need to keep certain clinical, safeguarding, legal or accounting records even if someone asks us to delete them.


18. Requests for records

Parents, carers, children and young people may ask for access to records.

When a request relates to a child or young person, we will consider:

  • who has parental responsibility
  • the child or young person’s age and understanding
  • the child or young person’s views, where appropriate
  • whether sharing the information is in the child or young person’s best interests
  • whether the record contains information about other people
  • whether any safeguarding, legal or professional restrictions apply

We may need to confirm identity before responding to a request.


19. Changes to this Privacy Notice

We may update this Privacy Notice from time to time.

The latest version will be available on our website. If we make significant changes, we may take additional steps to let families know.


20. Contact us

If you have any questions about this Privacy Notice or how Sensoryflex uses personal information, please contact:

Sensoryflex CIC
Email: contact@sensoryflex.com
Address: The Pavilion on the Recreation Ground, Tollesbury Road, Tolleshunt D'Arcy, CM9 8UA

Please mark privacy-related emails as: Privacy Request


21. Complaints


If you are unhappy with how we use personal information, please contact us first so we can try to resolve the issue.


You also have the right to complain to the Information Commissioner’s Office, which is the UK regulator for data protection.


Information Commissioner’s Office:


Website: www.ico.org.uk
Telephone: 0303 123 1113