August 2025. Version 2
1. Who we are
At Active Play Therapies (APT), we provide therapeutic support to children, young people, and families. We are committed to safeguarding your privacy and handling your personal information in a transparent and lawful way.
APT is the data controller for the information we collect from you. If you have any questions or concerns, please contact us at:
📧 hello@activeplaytherapies.com
2. The information we collect and how we use it
We collect and process personal data to provide our therapy services and operate our organisation. This may include:
- Personal data: Name, address, contact details, date of birth, school attended, parent/guardian contact, health or developmental history.
- Special category data: Information relating to mental health, emotional wellbeing, family circumstances, safeguarding concerns.
- Assessment tools and questionnaires: We use third-party services such as WPS (Western Psychological Services) to support sensory or psychological assessments. We use WPS for a specific type of standardised sensory questionnaire, the Sensory Processing Measure 2. This platform collects data directly from you, your child, or your child’s school/education setting to generate reports or recommendations.
We collect this information directly from you, your child, your referrer, or other professionals involved in the care of the child or young person.
3. Our lawful basis for processing data
Under the UK GDPR, we rely on the following lawful bases:
| Data type | Lawful basis under UK GDPR | Special category condition (if applicable) |
| Contact and referral details | Article 6(1)(b) – Contract (e.g. to provide services) | N/A |
| Therapeutic records and reports | Article 6(1)(a) – Consent / Article 6(1)(b) – Contract | Article 9(2)(a) – Explicit consent / Article 9(2)(h) – Health/social care provision |
| Assessment data and session notes | Article 6(1)(f) – Legitimate interests (supporting client wellbeing) | Article 9(2)(h) – Provision of health or social care |
| Invoicing and payments | Article 6(1)(c) – Legal obligation (accounting) | N/A |
| Safeguarding concerns | Article 6(1)(d) – Vital interests | Article 9(2)(c) – Vital interests |
Where we rely on consent, you have the right to withdraw it at any time by contacting us.
4. How we store and secure your information
We take data security seriously. Personal and sensitive data is stored securely using the following safeguards:
- Password-protected and encrypted digital systems
- Secure, locked filing systems for paper-based information
- Information is accessed only by authorised individuals directly involved in the care or support of the child
5. Who we may share your information with
We will only share personal data when necessary and appropriate, and typically only with:
- Referrers, such as schools or local authorities
- Other professionals involved in care (e.g. CAMHS, social workers), with your consent
- Third-party assessment providers, such as WPS, which hosts secure sensory processing and psychological questionnaires. Data entered into WPS may be stored and processed in the United States under strict contractual safeguards.
- In rare cases, safeguarding partners (e.g. police, children’s services), if there is a risk of harm to the child or others
All sharing is done on a case-by-case basis, in line with our safeguarding responsibilities and relevant legal obligations.
Cliniko is the secure UK-based practice management system we use to store client contact details, appointment records, clinical notes, and invoices. This platform is fully compliant with UK data protection law and accessible only by authorised APT staff.
6. How long we keep your information
In accordance with guidance from the Health and Care Professions Council (HCPC), our professional indemnity insurers, and relevant UK legislation (including the Limitation Act 1980), we retain therapy records for the following periods:
- Children and young people: Records are kept until the client’s 25th birthday (i.e. 7 years after reaching age 18).
- Adults: Records are retained for 8 years after the end of therapy.
- In some cases (e.g. safeguarding concerns, complaints, or legal obligations), we may retain records for longer if necessary.
If therapy ends early, we will still retain your data for the appropriate period unless you request deletion and it is lawful, ethical, and safe to do so.
All records are stored securely and are destroyed confidentially at the end of the retention period.
7. Children’s data and your rights
We take extra care when handling children’s personal data. Children have the same rights as adults under the UK GDPR. Where appropriate, we explain confidentiality and data use to children in an age-appropriate way. Their welfare is always our priority.
For children under 18, parents or guardians are asked to give consent. However, we assess capacity on a case-by-case basis.
If a child requests access to their records, we will only withhold it if doing so is clearly in their best interests or required by law.
8. Your data rights
You have the following rights under UK GDPR:
- The right to access your personal data
- The right to correct inaccurate information
- The right to request erasure (“right to be forgotten”) in certain cases
- The right to restrict or object to processing
- The right to data portability (where applicable)
- The right to withdraw consent at any time
- The right to lodge a complaint with the Information Commissioner’s Office (ICO)
📍 Information Commissioner’s Office
Website: www.ico.org.uk
Helpline: 0303 123 1113
9. International transfers
We use secure, trusted third-party providers to support our therapy practice, which may involve the transfer of personal data outside the UK:
- WPS (Western Psychological Services) provides sensory and psychological assessments. Data may be processed and stored in the United States, which does not currently have an adequacy decision from the UK. However, WPS implements Standard Contractual Clauses (SCCs) to safeguard personal data.
We only use international services that meet our standards for security and compliance. If you have concerns about how your or your child’s data is handled internationally, please contact us.
10. Use of digital services and cookies
Our website may collect limited information through the use of cookies or embedded third-party tools (such as Google Fonts, contact forms, or web analytics). These tools may store small files (cookies) on your device.
We do not use cookies for advertising or behavioural profiling. However, by using our website, you consent to any essential or embedded third-party cookies that support its functionality.
You can manage or block cookies through your browser settings at any time.
11. How we review this notice
We review our privacy notice annually or sooner if required by law. You will be notified of any material changes. The current version will always be available on our website.
Author: Anna Willis
Designation: Director of Active Play Therapies
Creation Date: May 2018
Reviewed: August 2025
Next Review: August 2026