Last updated: 25 September 2026
This notice explains how Unlocking Language collects, uses and protects personal information. It covers:
- visitors to our website
- parents, carers and clients (including children and young people) who use our speech and language therapy and occupational therapy services
- schools, local authorities, NHS bodies, solicitors and other organisations we work with
- customers of our online shop
If you work for us or apply for a job with us, we have separate privacy notices for staff, contractors and job applicants. Please ask us for a copy.
1. Who we are
Unlocking Language Limited is the controller of your personal information. We are a company registered in England and Wales (company number 08103210). Our registered office is Unit 3, 12 Pepper Street, London E14 9RP.
We are registered with the Information Commissioner’s Office (ICO). Our registration number is ZA208682.
Data protection lead: Mohammed Wasi, Operations Director
Email: admin@unlockinglanguage.co.uk
Phone: 0207 536 9299
Post: Data Protection Lead, Unlocking Language, Unit 3, 12 Pepper Street, London E14 9RP
2. The law we follow
We process personal information in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Data (Use and Access) Act 2025 and the Privacy and Electronic Communications Regulations (PECR). As healthcare professionals, our therapists also follow the confidentiality standards of the Health and Care Professions Council (HCPC) and the Royal College of Speech and Language Therapists (RCSLT).
3. Information we collect
If you use our therapy services
- Contact details: names, addresses, phone numbers and email addresses of the client and parents or carers.
- Background information: date of birth, school or setting, family and language background, and referral information.
- Health and development information: assessment results, diagnoses, clinical notes, reports, therapy plans, video or audio recordings made for clinical purposes, and information from EHC plans.
- Safeguarding information where there is a concern about a child’s welfare.
- Billing information: invoices, payment history and Direct Debit mandates. We do not store full card numbers. Card payments are handled securely by our payment providers.
- Communications: emails, messages, call notes, feedback and complaints.
If you visit our website or contact us online
- Information you enter in forms, booking tools or live chat, such as your name, contact details and the reason for your enquiry.
- Technical information such as your IP address, browser, device and the pages you visit, collected by cookies and similar technologies. See our Cookie Policy.
If you buy from our online shop
- Name, billing and delivery address, email, phone number, order history and account login details.
If you are a professional or organisation we work with
- Your name, job title, organisation and work contact details, and records of our correspondence and contracts.
4. Where we get your information
Most information comes directly from you. With your knowledge, we may also receive information from GPs and other health professionals, NHS services, schools and nurseries, local authorities (including EHC plans), solicitors and case managers, and other therapists who have worked with you or your child.
5. Why we use your information and our lawful basis
| What we do | Lawful basis (UK GDPR Article 6) | Condition for health data (Article 9) |
|---|---|---|
| Assess, treat and support clients, write reports and keep clinical records | Contract with you (private clients) or legitimate interests in delivering services commissioned by a school, local authority or NHS body | Health or social care purposes (Article 9(2)(h) and DPA 2018 Schedule 1, paragraph 2) |
| Share information with schools, health professionals or local authorities involved in your or your child’s care | Legitimate interests, or contract | Health or social care purposes |
| Safeguard children and adults at risk | Legal obligation, or recognised legitimate interests (safeguarding) | Substantial public interest: safeguarding (DPA 2018 Schedule 1, paragraph 18) |
| Prepare expert reports and evidence for tribunals or courts | Contract, or legitimate interests | Legal claims (Article 9(2)(f)) |
| Invoicing, collecting payments and keeping accounts | Contract and legal obligation (tax and accounting law) | Not applicable |
| Handle enquiries, bookings and complaints | Contract, or legitimate interests | Health or social care purposes, where health information is involved |
| Process and deliver shop orders | Contract | Not applicable |
| Improve our services through feedback, clinical audit and quality checks | Legitimate interests | Health or social care purposes |
| Send newsletters and marketing emails | Your consent, or for existing clients and customers, similar services (the “soft opt-in”). You can unsubscribe at any time. | Not applicable |
| Use testimonials, photos or videos in our marketing | Your explicit consent, which you can withdraw at any time | Explicit consent |
| Website analytics, session recordings and advertising cookies | Your consent through our cookie banner | Not applicable |
| Comply with the law, regulators and legal claims | Legal obligation, or legitimate interests | Legal claims |
If you do not give us the information we need to deliver a service, we may not be able to provide it.
6. Children’s information
Most of our clients are children. We usually deal with a parent or carer who has parental responsibility. Where a child is mature enough to understand, we will involve them in decisions about their information. We will respect their views in line with their age and understanding. We also provide a summary privacy notice for young people on request.
7. Who we share your information with
We only share what is necessary, with:
- schools, nurseries, local authorities and NHS services involved in the client’s care, usually with the knowledge of the client or parent
- other health professionals, when you ask us to or it is in the client’s clinical interest
- solicitors, courts and tribunals, when we are instructed or legally required
- professional advisers, auditors, insurers and regulators
- the police or social care, where the law requires it or to protect someone from harm
- a buyer or successor, if our business is sold or restructured
We use trusted suppliers (processors) who handle data only on our instructions and under written contracts:
| Supplier | Purpose |
|---|---|
| Google (Workspace, Analytics, Ads) | Email, document storage, website analytics and advertising measurement |
| Ninox | Client records and scheduling |
| Xero | Invoicing and accounting |
| GoHighLevel (LeadConnector) | Enquiry forms, bookings, client communications and CRM |
| Lark | Internal team communication and collaboration |
| Stripe | Card payments |
| GoCardless | Direct Debit payments |
| Hotjar | Website usage analysis (only with your cookie consent) |
| Our website host and maintenance agency | Hosting, security and maintenance of this website |
We never sell your personal information.
8. International transfers
Some of our suppliers store or access data outside the UK, including in the European Economic Area, the United States and Asia. When this happens we make sure the data is protected by UK adequacy regulations (including the UK-US Data Bridge where the supplier is certified), or by the ICO’s International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses. Contact us for more details.
9. How long we keep information
| Record | How long we keep it |
|---|---|
| Children’s clinical records | Until the client’s 25th birthday (26th if they were 17 when treatment ended), or 8 years after treatment ends, whichever is later |
| Adult clinical records | 8 years after treatment ends |
| Expert and tribunal reports | As for clinical records, or longer if legal proceedings are ongoing |
| Invoices and financial records | 6 years from the end of the financial year |
| Enquiries that do not become clients | 2 years |
| Complaints | 6 years after the complaint is closed |
| Safeguarding records | In line with statutory safeguarding guidance |
| Online shop orders | 6 years |
| Marketing lists | Until you unsubscribe |
| CCTV at our clinic entrance | 3 months, unless needed to investigate an incident |
Our full retention schedule is available on request.
10. How we protect your information
We use access controls, encryption, secure cloud systems, staff training and confidentiality agreements. Only people who need information for their role can see it. If a data breach is likely to put you at risk, we will tell you and the ICO as the law requires.
11. Your rights
You have the right to:
- access the personal information we hold about you (a subject access request)
- correct information that is wrong or incomplete
- erase information in some circumstances. Clinical records usually have to be kept for the periods above.
- restrict or object to how we use your information
- data portability, where the processing is based on consent or contract and carried out electronically
- withdraw consent at any time, where we rely on consent
- object to direct marketing at any time
- not be subject to decisions made solely by automated means that significantly affect you. We do not make such decisions.
To use any of these rights, contact our data protection lead. We will not normally charge. We will respond within one month, or up to three months for complex requests, and we will tell you if we need longer. We carry out reasonable and proportionate searches and may ask you to prove your identity.
12. Complaints
If you are unhappy with how we have handled your personal information, please contact our data protection lead first. We will acknowledge your complaint within 30 days and respond without undue delay.
You also have the right to complain to the Information Commissioner’s Office:
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Phone: 0303 123 1113 | Website: ico.org.uk/make-a-complaint
13. Changes to this notice
We review this notice regularly. The latest version is always on this page. If we make significant changes that affect how we use your information, we will let you know.
