Privacy notice

Superpower Therapy Limited · Effective 25 October 2026

This notice explains how we use information about children, parents and carers, enquirers, and professional contacts. It covers Anna Badcock’s independent practice, not her separate NHS employment. All SPT services are remote. Individual family support is limited to children outside Stockport NHS Foundation Trust’s catchment and excludes the Trust’s caseload and waiting lists. General professional review work is subject to the same conflict checks. Read our NHS priority and conflicts-of-interest policy.

Who is responsible?

Superpower Therapy Limited is the data controller for information collected in its independent practice. Company number: 11957374. Registered office and postal contact: 84 Ernocroft Road, Marple Bridge, Stockport, Greater Manchester, SK6 5DY, United Kingdom. This is not a clinic.

Anna Badcock is the contact for privacy questions and requests: anna@superpowertherapy.co.uk or 07572 579140. Our Information Commissioner’s Office registration is ZA759705 — view the public entry. Registration is not ICO approval or certification of our services.

What information do we use?

We collect only information relevant to your enquiry, care or the work agreed. This can include:

• Names, date of birth, contact details, parent/carer details, parental responsibility, the child’s school or nursery, and the minimum information needed to check relevant NHS service catchment eligibility and caseload/waiting-list status. We obtain eligibility information through SPT’s private channels; Anna does not access NHS systems or use her NHS role to screen SPT enquiries.
• Communication and developmental history, relevant health information, assessment findings, goals, session notes, reports and correspondence. Health information is special category personal data.
• Relevant family, education and safeguarding information, including information about other people where necessary for the child’s care.
• Appointments, agreements, invoices, payment status, complaints and professional or organisational contact details.
• Technical website connection information, such as IP address, device/browser information and security logs processed by hosting providers.

We do not routinely record calls or video sessions. Any proposed recording needs a separate explanation and agreement in advance. We do not use clinical information for advertising or sell personal information.

Where does information come from?

Usually from you and your child during enquiries, appointments and correspondence. Where appropriate and lawful, we also receive information from someone with parental responsibility, a referring organisation, schools or nurseries, NHS or independent health professionals, and other professionals supporting the child. We explain relevant information sharing and obtain permission where appropriate. Safeguarding information may sometimes be obtained or shared without permission.

Why we use information and our legal bases

We use information to respond to enquiries, assess suitability, arrange and provide care, plan and record therapy, communicate with families and relevant professionals, manage fees, handle concerns and meet professional and legal responsibilities.

• Contract — Article 6(1)(b): arranging and delivering services with the person who enters the contract, and related billing.
• Legitimate interests — Article 6(1)(f): responding to enquiries, checking service eligibility and conflicts, arranging and providing an eligible child’s care where the child is not the contracting party, maintaining clinical records, necessary professional liaison, managing the practice and resolving concerns or legal claims. Our interests are safe, effective care and responsible practice management; we consider the child’s rights and use only necessary information.
• Legal obligation — Article 6(1)(c): where a specific legal requirement applies, such as tax/accounting records or a binding disclosure requirement.
• Consent — Article 6(1)(a): optional uses where we specifically request consent. You can withdraw that consent at any time without affecting earlier lawful use.

For health information used in care, the additional condition is Article 9(2)(h) (healthcare), with the Data Protection Act 2018, Schedule 1, Part 1, paragraph 2, under professional confidentiality. For information necessary for legal claims, Article 9(2)(f) may apply. Safeguarding disclosures rely on the legal basis and special category condition applicable to the circumstances, which we record; this can include substantial public interest under Article 9(2)(g) and Schedule 1 paragraph 18 where its conditions are met. In a genuine emergency, vital interests provisions may apply where their legal conditions are satisfied.

Agreeing to therapy is distinct from giving data-protection consent. We do not rely on consent for every part of clinical record keeping. You do not have to provide optional information, but without information necessary for safe care or a service agreement we may be unable to provide the service. We explain this at the time.

Who may receive information?

Anna has access to information needed for your care. Information may be shared, on a necessary and lawful basis, with parents/carers, agreed school or nursery staff, referring or treating professionals, safeguarding authorities, regulators, legal advisers or insurers, and financial advisers for relevant business records. We consider parental responsibility, the child’s understanding, confidentiality and best interests; parents do not automatically have unrestricted access to every record.

Service providers may process information to deliver email, website hosting, communications or technical support. Our email and video-call provider is Proton AG (Proton Mail and Proton Meet). The website is hosted using ChatGPT Sites/OpenAI and Cloudflare infrastructure. Telephone and internet providers also process connection information needed to deliver their services. Video support is provided using Proton Meet. Before using a different service to exchange clinical information, we will explain the provider and any material privacy implications. You can ask for details of relevant providers and safeguards.

For general policy, practice and document review work with professional organisations, that organisation may be a separate controller, or we may process information on its instructions. Organisations should provide anonymised or non-personal material wherever possible. Identifiable clinical material must not be sent without a separately agreed lawful scope and eligibility/conflict assessment. We clarify responsibilities and applicable privacy information before the work starts. Working in the NHS does not give Anna’s independent practice automatic access to NHS records.

How we protect information

Anna makes handwritten case notes, transcribes them into the digital clinical record, checks the transcription and then confidentially destroys the paper notes. Until destruction, paper information must be protected against unauthorised access. Digital clinical records are stored on an on-site encrypted server. Accounts use strong passwords and multi-factor authentication. Access is limited to authorised people with a need to know.

We use Proton Mail for email. Its encryption protects stored messages and supports secure communication, but ordinary email exchanged with other providers is not automatically end-to-end encrypted. Please avoid sending detailed medical information or reports in a first enquiry. Ask Anna to agree a suitable secure method for sensitive documents. Email subject lines should not contain unnecessary clinical details.

No system can guarantee absolute security. Our security obligations also apply to temporary copies, devices and any backups. We assess suspected incidents and notify affected people and the ICO where legally required.

Video appointments: Proton Meet uses end-to-end encryption for meeting audio, video, screen sharing and chat, so Proton cannot access the meeting content. Proton processes limited technical information needed to operate and secure the service, including temporary debugging logs. For details, read the Proton Meet privacy policy. Meeting links should be kept private and shared only with intended participants. Our policy of not routinely recording sessions also applies to video appointments.

International processing

The clinical record is held on our on-site server in the UK, but communications and website providers may process information outside the UK. Proton is based in Switzerland; the UK currently recognises Switzerland as providing adequate data protection. Provider services and support may also involve other countries. Where a restricted transfer is not covered by adequacy regulations, we must put an appropriate legal safeguard in place before that transfer, such as the UK International Data Transfer Agreement or UK Addendum to approved contractual clauses, with the required assessment. Contact Anna for details or a copy of relevant safeguards, with confidential information removed where necessary.

Eligibility and NHS separation

We do not use NHS contact lists, waiting lists, case records or internal systems to identify private clients or verify private eligibility. We ask families for the information needed and decline where eligibility or absence of conflict cannot be established. Refusal decisions are recorded with the minimum necessary detail. NHS records are not copied into SPT files. No SPT discussions take place in any NHS setting or context.

How long we keep information

Our retention policy uses the following periods, with a review before disposal:

• Children’s clinical records: normally until the child’s 25th birthday, in line with the usual children’s health-record benchmark. If treatment were to end at age 17, the benchmark would be the 26th birthday. Our current service is for children up to age 11.
• Initial enquiries that do not proceed and do not create a clinical/referral record: normally 12 months after the last meaningful contact.
• Referrals assessed but not accepted: normally two years after the decision, unless the information forms part of a clinical or safeguarding record.
• Financial and tax records: normally six years after the end of the relevant company financial year, or longer where a specific tax requirement applies. Clinical details are kept out of financial records where possible.
• Non-clinical contracts, organisational work and complaints: normally six years after completion or resolution; material forming part of the clinical record follows that record’s retention period.
• Technical connection and security records: for the period needed to deliver and protect the relevant service, according to the provider’s applicable retention arrangements. Ask us for the arrangements relevant to your use.

Records may be kept longer where necessary for safeguarding, an ongoing complaint, investigation, court order, legal claim or another justified legal or professional requirement. We record the reason and review the need. Relevant care correspondence is managed with the clinical record rather than kept indefinitely in email. At the end of the applicable period, records are reviewed and securely deleted or destroyed; any retained backup copy is protected, unavailable for ordinary use and expires under its backup cycle.

Your rights and your child’s rights

Depending on the circumstances, you have rights to be informed; request access and a copy; correct inaccurate information; request deletion or restriction; object to processing based on legitimate interests; and receive certain information in a portable format. These rights have conditions and exceptions. Clinical records cannot always be deleted on request, and professionally recorded opinions may be retained with a note of your disagreement. Where processing relies on consent, you can withdraw it.

The child’s information rights belong to the child. A person with parental responsibility may act for them where appropriate, taking account of the child’s understanding, wishes, confidentiality and best interests. We may check identity and authority before releasing information. Requests are normally free and answered within one month, subject to lawful extensions or other permitted adjustments. We explain any applicable limitation or refusal. Contact Anna using the details above.

We do not use solely automated decision-making or profiling to make decisions about your child’s care.

Questions or complaints

Please contact Anna first so we can investigate and respond. You may also complain to the Information Commissioner’s Office, telephone 0303 123 1113, or write to the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. You do not have to use our complaints process before contacting the ICO.

Website privacy and cookies

This website has no clinical-record upload facility or enquiry form. We have not added advertising trackers or analytics. Hosting, security and access providers may process technical connection data and use necessary cookies for their functions, including sign-in where access is restricted. External links, including LinkedIn and professional registers, have their own privacy arrangements. We will update our notice and obtain consent where required before adding optional tracking technologies.

Changes to this notice

We review this notice when our services, providers or processes change, and periodically. The effective date is shown above. We bring material changes affecting existing clients to their attention where appropriate.