Privacy Policy 

Effective date: 21 August 2026  |  Version 1.0

​

Your privacy matters to us. This policy explains what personal information SaplingSLT collects, why we use it, how we protect it and the choices you have.

​

1. Who we are

SaplingSLT is an online speech and language therapy service for children and their families.

Suzie Griffiths, trading as SaplingSLT, is the data controller. This means that she is responsible for deciding how and why personal information is used.

You can contact us about privacy or data protection at suzie@saplingslt.co.uk.

​

2. What this policy covers

This policy applies when you:

• visit saplingslt.co.uk or use a SaplingSLT online form;

• contact us by email, telephone, social media or WhatsApp;

• book, pay for or receive a consultation, assessment, therapy, parent-coaching or early-years service;

• subscribe to updates, download a resource, complete a questionnaire or provide feedback; or

• otherwise communicate or work with SaplingSLT.

 

3. Information we may collect

Information about parents, carers and other adults

• name and contact details, including email address, telephone number, address or postcode;

• relationship to the child and, where relevant, parental responsibility or authority to act;

• enquiries, messages, questionnaire answers, appointment details and communication history;

• marketing preferences, feedback, reviews and testimonial permissions; and

• technical information such as IP address, device, browser and cookie information when you use our website.

Information about children

• name, date of birth, age and contact or location details where needed for service delivery;

• speech, language, communication, developmental, educational, behavioural, sensory and medical information;

• relevant family history, nursery or school information, reports, referrals and information from other professionals;

• assessment findings, clinical notes, goals, therapy plans, progress information and professional reports; and

• audio, video, photographs or session recordings only where these are necessary and appropriate and the required consent has been obtained.

Information about a child's health, development or care may be special-category personal data and receives additional legal protection.

​

4. How we collect information

We normally receive information directly from a parent, carer or professional who contacts us. We may also receive information:

• through our website, questionnaires, booking and payment processes;

• during consultations, assessments, therapy sessions and ongoing support;

• from a nursery, school, NHS service or other professional where you have authorised this or another lawful basis applies;

• from website and communications providers through cookies, security logs and similar technologies; and

• from public social-media interactions or messages you choose to send to us.

Please do not send detailed clinical information through public social-media comments or direct messages. Email or an agreed secure clinical channel is more appropriate.

​

5. Why we use information and our lawful bases

We only use personal information when we have a lawful reason. Depending on the circumstances, we may use it to:

• respond to an enquiry and take steps requested

• provide consultations, assessments, therapy, parent coaching and early-years services under our contract with you;

• maintain safe, clear and accurate clinical and business records;

• process payments, administer bookings and meet accounting, tax, safeguarding, regulatory and other legal obligations;

• communicate with you about the service you have requested;

• protect children and others where there is a safeguarding concern or serious risk;

• improve, secure and administer our website and services where this is in our legitimate interests and does not override your rights;

• send optional marketing or updates where you have consented or where another lawful basis is available; and

• publish a testimonial, image, recording or case example only with the appropriate specific permission and safeguards.

Where we process health, developmental or other special-category information for clinical care, we generally rely on the condition for health or social-care provision by a regulated professional subject to confidentiality. Where appropriate, we may instead rely on explicit consent, vital interests, safeguarding or another condition permitted by law.

Consent to data processing is separate from clinical consent to assessment or therapy. Where we rely on consent, you may withdraw it at any time, although this will not make earlier lawful processing unlawful.

​

6. Who we may share information with

We do not sell personal information. We may share only the information that is reasonably necessary with:

• parents, carers or others with parental responsibility, subject to the child's rights and any relevant legal restrictions;

• nurseries, schools, NHS teams, GPs and other professionals involved in a child's care where there is permission or another lawful basis;

• professional advisers, insurers, regulators, safeguarding authorities, courts or law-enforcement bodies where required or justified; and

• trusted service providers acting for us, subject to appropriate confidentiality, security and data-protection terms.

Our service providers may include:

• Wix, for website hosting, forms, security and website functionality;

• Google services, including Gmail or Google Workspace, for business communications and file handling where applicable;

• WriteUpp, for practice administration and secure clinical record keeping;

• Zoom, for online consultations, therapy and training;

• WhatsApp and Meta services, where you choose to use WhatsApp support or contact us through social media; and

• approved clinical or administrative support technology, such as Heidi Health, where its use has been separately explained and any required consent obtained.

Providers may change as our services develop. We assess providers and limit the information shared to what is needed for their role.

 

7. International transfers

Where personal information is transferred internationally, we use providers and arrangements intended to provide an appropriate level of protection, such as an adequacy decision, approved standard contractual clauses, the UK International Data Transfer Agreement or other lawful safeguards, as applicable.

​

8. How long we keep information

We keep personal information only for as long as needed for the purpose for which it was collected and to meet clinical, professional, legal, accounting, safeguarding and insurance requirements.

When information is no longer needed, it is securely deleted.

​

9. Security and confidentiality

We use reasonable technical and organisational measures designed to protect personal information from loss, misuse, unauthorised access, alteration or disclosure. These include appropriate access controls, passwords, secure clinical systems, confidentiality arrangements, device security and careful selection of service providers.

No online system is completely risk free. If we become aware of a personal-data breach, we will assess it and notify affected people and the relevant supervisory authority where the law requires this.

​

10. Cookies and website analytics

Our Wix website may use essential cookies needed for security and functionality. It may also use analytics, preference or marketing technologies. Where required, non-essential cookies should only be used after you have made a choice through the cookie banner.

You can use your browser settings to manage cookies. Blocking some cookies may affect how the website works.

​

11. Other websites and social media

Our website may contain links to other websites, social-media platforms or resources. Their privacy practices are controlled by those organisations. Please read their privacy information before providing personal data.

​

12. Changes to this policy

We may update this policy when our services, providers or legal obligations change. The current version will be published on saplingslt.co.uk with its effective date and version number. Material changes will be highlighted where appropriate.

​

13. Contact

Data controller: Suzie Griffiths, SaplingSLT

Email: suzie@saplingslt.co.uk

Website: https://www.saplingslt.co.uk