Privacy Policy

This notice explains how Ilera Neurohealth Ltd uses personal information about people who visit our website, make an enquiry, are referred for or receive a service, act as a parent, carer or representative, provide information as a professional or informant, attend training, or use our secure portals.

Ilera Neurohealth Ltd is the data controller for the information described in this notice unless we tell you otherwise. Registered office: [CONFIRM]. Company number: [CONFIRM]. Data protection contact: [NAME OR ROLE AND EMAIL]. ICO registration number: [CONFIRM].

• Identity and contact details, including preferred name, pronouns and communication preferences.
• Referral, developmental, education, employment, family, health, social-care, disability, medication, risk and safeguarding information.
• Assessment questionnaires, interview and observation records, clinical notes, correspondence, reports and recommendations.
• Information from parents, carers, schools, employers, GPs, referrers and other professionals where there is an appropriate basis to obtain it.
• Consent, parental responsibility, legal authority and information-sharing preferences.
• Appointment, payment, invoice and transaction information. Payment-card details should be handled by the approved payment provider rather than stored by Ilera unless explicitly stated.
• Portal activity, security logs, device/browser information, website usage and cookie choices.

We collect information directly from you, from someone referring or supporting you, from professionals and organisations involved in your care or education where permitted, and through our website, portal, video, telephone and payment systems. We may also receive information from public authorities or emergency services where necessary and lawful.

We take the privacy and best interests of children and young people seriously. We provide age-appropriate information, consider the young person’s understanding and views, and check parental responsibility or other authority where required. A parent’s portal access does not automatically mean they may see every part of a young person’s record. Access and information sharing are reviewed according to consent, capacity, confidentiality, safeguarding and applicable law.

Where necessary and lawful, we may share relevant information with members of the Ilera clinical and coordination team, clinicians working for or with Ilera, the person who commissioned the service, GPs, schools, local authorities, social-care or other professionals, safeguarding bodies, emergency services, regulators, insurers, legal advisers and carefully selected technology providers. We share only what is necessary and apply contracts, confidentiality and access controls. We will explain routine sharing and seek consent where consent is the appropriate basis, unless the law permits or requires sharing without it.

If a supplier processes information outside the United Kingdom, we will use an approved transfer mechanism and appropriate safeguards, and assess the protection available. [Confirm suppliers and transfer locations.]

We keep information only for as long as necessary for the purpose for which it was collected and to meet clinical, safeguarding, insurance, professional and legal requirements. Retention periods differ for adults, children, enquiries, financial records, complaints and portal logs. Ilera’s approved retention schedule will state the exact periods. When information is no longer required, it will be securely deleted or anonymised.

Depending on the circumstances, you may have rights to be informed, access your information, correct inaccurate information, request deletion or restriction, object to certain uses, receive information in a portable format, and withdraw consent where processing relies on consent. Some rights are limited where another lawful requirement applies or where records must be retained. Contact [DATA PROTECTION EMAIL] to make a request. We may need to verify your identity and authority.

We use proportionate organisational and technical measures to protect information, including access controls, encryption, secure backups, audit logging and staff confidentiality requirements. No system is completely risk-free, so please tell us promptly if you suspect a security issue. Essential cookies support website and portal functions; non-essential cookies are used only in line with your choices. See our Cookie Notice for details.

If you are concerned about how we use your information, contact [DATA PROTECTION CONTACT]. You may also complain to the Information Commissioner’s Office at ico.org.uk. We would appreciate the opportunity to address your concern first. Effective date: [CONFIRM]. Review date: [CONFIRM].