Privacy Policy

OT Network Ltd

Last updated: September 2026

OT Network Ltd respects your privacy and is committed to protecting the personal information we hold about you, your child or the person you represent.

This Privacy Notice explains how we collect, use, store and share personal information when we provide occupational therapy and related services, including services provided to children and young people. We aim to explain this in clear and accessible language.

1. Who we are
OT Network Ltd is the data controller for the personal information we process in connection with the occupational therapy and related services that we provide, unless we specifically tell you that another organisation is the data controller for a particular service or processing activity.

OT Network Ltd
31 West Street, Swadlincote, England, DE11 9DN
Company No. 14023495
sensory@otnet.co.uk

For privacy or data protection enquiries, please contact: sensory@otnet.co.uk

Where another organisation, such as an NHS body, local authority, school or commissioner, is the data controller for information it provides to us or requires us to process on its behalf, that organisation may have its own privacy notice. We will explain the respective roles where this is relevant.

2. What personal information do we collect?
Depending on the service we provide and how you are referred or commissioned, we may collect and process:

Personal and contact information
● Name
● Date of birth and age
● Address
● Telephone number
● Email address
● Emergency contact details
● Relationship to the person receiving the service

Information about occupational therapy and care needs. This may include information about:
● Health conditions, disabilities and diagnoses
● Physical, sensory, cognitive and developmental needs
● Mental health information where relevant to the service
● Functional abilities and difficulties
● Communication needs
● Mobility and moving and handling needs
● Equipment and assistive technology needs
● Housing and environmental circumstances where relevant
● Previous assessments, interventions and recommendations
● Information about education, care and support
● Risk and safeguarding information
● Relevant medical, social care or therapy information
● Information contained in reports, assessments, correspondence and clinical records

Health information is special category personal data under UK data protection law and therefore receives additional protection.

Information about children and young people
Where we provide paediatric occupational therapy, we may process information about the child or young person, including developmental, educational, health, care, functional and family information that is relevant to their assessment and support.
We may also need information about parents, carers or other people involved in the child’s care where this is relevant to providing the service.

Information provided by other people or organisations. We may receive information from:
● Parents or people with parental responsibility
● Children and young people themselves
● Family members and carers
● GPs and other healthcare professionals
● Occupational therapists and other therapists
● NHS organisations
● Local authorities
● Social workers
● Schools, colleges and educational settings
● Special educational needs and disability (SEND) services
● Care providers
● Case managers
● Commissioners and funding bodies
● Other professionals involved in the person’s care or support

We may also collect information about our referrers, commissioners and professional contacts where this is necessary to manage referrals, appointments, contracts and services.

3. How do we use your information?
We only use personal information where we have a lawful basis to do so. The purposes for which we may process information include the following.

Purpose	Personal information used	Article 6 lawful basis	Article 9 condition where health data is involved
Receiving and assessing an occupational therapy referral	Identity, contact, referral and health information	Article 6(1)(e) public task, where we are providing a commissioned public service; otherwise Article 6(1)(b) contract or Article 6(1)(f) legitimate interests, depending on the arrangement	Article 9(2)(h) health or social care
Providing occupational therapy assessment, treatment, advice or recommendations	Identity, health, functional, care and relevant social information	Article 6(1)(e) public task where applicable to the commissioned service; otherwise Article 6(1)(b) contract	Article 9(2)(h) health or social care
Preparing clinical, occupational therapy and professional reports	Clinical and assessment information	Article 6(1)(e) public task where applicable; otherwise Article 6(1)(b) contract	Article 9(2)(h) health or social care
Communicating with parents, carers and other professionals involved in care	Contact, clinical and relevant care information	Article 6(1)(e) public task, 6(1)(b) contract or 6(1)(f) legitimate interests, depending on the service arrangement	Article 9(2)(h) health or social care
Sharing relevant information with referrers, commissioners and professionals involved in care	Relevant clinical, functional and administrative information	Article 6(1)(e) public task where applicable; otherwise Article 6(1)(b) or 6(1)(f) as appropriate	Article 9(2)(h) health or social care
Safeguarding children and adults at risk	Relevant health, care, safeguarding and other information	Article 6(1)(c) legal obligation and/or 6(1)(e) public task, where applicable	Article 9(2)(g) substantial public interest or 9(2)(h) health or social care, depending on the circumstances
Managing appointments and service administration	Contact, appointment and service information	Article 6(1)(b) contract or 6(1)(f) legitimate interests	Usually not required; where the information reveals health information, Article 9(2)(h) may apply
Billing, invoicing and financial administration	Contact, service and payment information	Article 6(1)(b) contract and/or Article 6(1)(c) legal obligation	Normally not required unless health information is involved
Meeting professional, regulatory and legal requirements	Clinical and administrative records	Article 6(1)(c) legal obligation and/or Article 6(1)(f) legitimate interests	Article 9(2)(h) where necessary for health or social care; another Article 9 condition may apply where required
Managing complaints, incidents and legal claims	Relevant clinical and administrative information	Article 6(1)(c) and/or Article 6(1)(f)	Article 9(2)(f) legal claims and/or Article 9(2)(h) where applicable
Website enquiries and requests for information	Name, contact details and enquiry information	Article 6(1)(f) legitimate interests or Article 6(1)(b) contract, where applicable	Usually not required; if health information is voluntarily provided and needs to be processed, Article 9(2)(h) may apply
Website security, technical administration and preventing misuse	IP address, device and technical information	Article 6(1)(f) legitimate interests	Not normally applicable
Sending optional marketing communications	Name and contact details	Article 6(1)(a) consent or another lawful basis where permitted by applicable electronic marketing rules	Not normally applicable

We will select the lawful basis that applies to the actual service and circumstances rather than automatically relying on consent.

In particular, consent to receive healthcare is not the same thing as the UK GDPR lawful basis for processing personal information. The ICO specifically recognises that healthcare providers may rely on other lawful bases, such as public task or contract, together with Article 9(2)(h) for health or social care information.

4. Children’s information
OT Network Ltd provides occupational therapy services to children and young people and takes particular care when processing children’s information.

Children have their own data protection rights. The way those rights are exercised will depend on the child’s age, maturity, understanding and circumstances.

We may receive information about a child from their parent, a person with parental responsibility, a carer, school, local authority, healthcare professional, commissioner or another professional involved in their care.

Parents and people with parental responsibility
Parents or people with parental responsibility may provide information about a child, participate in assessments and receive information about the service where appropriate.

However, having parental responsibility does not automatically mean that an adult has unrestricted access to all information relating to a child.

Where appropriate, we will consider:
● The child’s age and level of understanding
● The child’s wishes and feelings
● Whether the child has sufficient understanding to exercise their own rights
● Whether the request is in the child’s best interests
● Any safeguarding or confidentiality concerns
● The legal basis for providing the information requested

Where a child is capable of understanding what is being requested, we will involve them appropriately and explain how their information is being used in a way that is suitable for their age and understanding.

The ICO recommends that privacy information for children is clear, accessible and age-appropriate and that information is provided to both children and parents.

Schools and educational settings
Where a school, college or other educational setting is involved in a referral or the provision of occupational therapy, we may receive or share relevant information with appropriate staff.

We will only share information that is relevant and necessary for the agreed purpose and will consider confidentiality, safeguarding and the child’s best interests.

Local authorities and commissioners
Where OT Network Ltd is commissioned by a local authority, NHS organisation or another commissioning body, we may receive and provide information necessary to assess, deliver, monitor or report on the commissioned service.

The commissioning organisation may have its own privacy notice explaining how it uses personal information.

The precise data protection responsibilities of OT Network Ltd and the commissioning organisation will depend on the contractual and operational arrangements for that service.

Referrers and other professionals
Where a referral is made by a healthcare professional, social worker, case manager, school, local authority or another professional, we may use information supplied by the referrer to assess and provide the requested service.

We may also communicate relevant findings and recommendations to professionals involved in the person’s care or support where this is necessary and lawful.

5. Who may we share information with?
We only share personal information where there is a lawful basis and where the information is relevant and necessary.

Depending on the service, information may be shared with:
● The person receiving occupational therapy
● Parents or people with parental responsibility, where appropriate
● Carers
● GPs and other healthcare professionals
● Other therapists and healthcare providers
● Social workers and social care professionals
● Schools and educational settings
● Local authorities
● NHS organisations
● Commissioners and funding organisations
● Case managers
● Care providers
● Other professionals involved in the person’s care
● Professional, regulatory or statutory bodies where required
● Our insurers, legal advisers or professional advisers where necessary
● Service providers who process information on our behalf

We will not sell personal information.

We will not disclose confidential clinical information simply because someone asks for it. We will consider whether the disclosure is lawful, necessary and appropriate.

6. Safeguarding
The safety and welfare of children and adults at risk is important to us.

If we have concerns about someone’s safety or welfare, we may need to share relevant information with safeguarding teams, social services, healthcare professionals, emergency services, the police or another appropriate organisation.

Where the law permits, we will normally explain this to the person concerned. However, there may be circumstances where we cannot tell someone before sharing information, for example where doing so could increase the risk of harm or prejudice a safeguarding or legal process.

The ICO recognises that information about children may need to be shared for safeguarding purposes and that the usual expectation is to provide clear information about how children’s information is used and shared, subject to appropriate exceptions.

7. Confidentiality
Our occupational therapists are healthcare professionals and are subject to professional duties of confidentiality.

We take appropriate measures to protect confidential health and care information.

Access to information is restricted to people who need it for their role, and we use appropriate technical and organisational safeguards to protect information against unauthorised access, loss, alteration or disclosure.

8. How we receive information
We may obtain information:
● Directly from you or the person receiving the service
● From parents, carers or people with parental responsibility
● From a referral
● From healthcare professionals
● From schools and educational settings
● From local authorities
● From commissioners
● From social care professionals
● From other professionals involved in care
● Through our website, email or telephone
● From organisations involved in funding or arranging the service

Where we receive information from someone other than the individual, we will provide the required privacy information unless an exemption applies.

9. How long do we keep information?
We retain personal information only for as long as it is necessary for the purpose for which it was collected and to meet our legal, professional, contractual and regulatory obligations.

Clinical and occupational therapy records
Clinical records will normally be retained in accordance with applicable health and care records management requirements.

Where the NHS Records Management Code of Practice applies to the service, it recommends that children’s health records are retained until the child’s 25th birthday, or 26th birthday where the individual was 17 when treatment ended. The Code also recommends an
eight-year retention period for many adult clinical records following the end of treatment.

For services that are not subject to the NHS Records Management Code, OT Network Ltd will apply its own documented retention schedule, taking account of contractual, professional, legal and clinical requirements.

Other information. Examples include:
● Enquiries: normally retained for as long as necessary to respond and deal with any resulting relationship or service.
● Appointment and administrative information: retained for the period required for service administration and relevant legal or accounting requirements.
● Financial records: retained for the period required by applicable financial and tax legislation.
● Complaints and incident information: retained for the period necessary to investigate the matter and meet legal, professional and insurance requirements.
● Marketing preferences: retained while you remain subscribed or until you withdraw your consent, together with a record of your preference where necessary.

When information is no longer required, it will be securely deleted, destroyed or anonymised.

10. Where we store information
Personal information may be held electronically and/or in paper records.

We use appropriate technical and organisational measures to protect information, including access controls, secure systems and appropriate confidentiality arrangements.

Where we use third-party service providers to store or process information, we require appropriate contractual and security safeguards.

11. International transfers
Where personal information is transferred outside the UK, we will ensure that the transfer is lawful and that appropriate safeguards are in place in accordance with UK data protection legislation.

12. Your data protection rights
Subject to certain legal exceptions, you have rights under UK data protection law. These may include the right to:
● Be informed about how your information is used
● Access the personal information we hold about you
● Rectify inaccurate or incomplete information
● Request erasure of your information in certain circumstances
● Restrict processing in certain circumstances
● Object to certain processing
● Data portability in certain circumstances
● Withdraw consent where we are relying on consent as our lawful basis

Not all rights apply in every situation. For example, the right to erasure does not apply where we need to retain information because of a legal or professional obligation.

Health and care records may also be subject to confidentiality and other legal requirements that affect how a request can be dealt with.

Children’s rights
Children have the same data protection rights as adults, although the way those rights are exercised may depend on their age, maturity, capacity and level of understanding.

We will support children, where appropriate, to understand and exercise their rights.

13. How to make a data protection request
To exercise your rights, please contact:

OT Network Ltd
31 West Street, Swadlincote, England, DE119DN
sensory@otnet.co.uk

Please provide enough information to allow us to identify you and understand your request.

We may need to verify your identity before providing personal information or acting on a request.

There is normally no charge for exercising your data protection rights. However, applicable data protection law allows us to charge a reasonable fee or refuse a request where a request is manifestly unfounded or excessive.

14. Complaints about how we use your information
If you have concerns about the way OT Network Ltd has handled your personal information, please contact us first so that we can investigate and try to resolve your concern.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator.

Information Commissioner’s Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113

You can find information about making a complaint on the ICO’s website: Information Commissioner’s Office – Make a complaint

15. Cookies and website information
When you visit our website, we may collect limited technical information such as your IP address, browser type, device information and information about how you use the website.

We use cookies and similar technologies where necessary to operate, secure and improve the website.

Where non-essential cookies or similar technologies are used, we will provide appropriate information and, where required, obtain your consent.

Please see our Cookie Policy for further information.

16. Changes to this Privacy Notice
We may update this Privacy Notice from time to time to reflect changes in our services, how we process information, legal requirements or regulatory guidance.

The latest version will always be made available on our website.

We recommend checking this page periodically for updates.

Privacy Notice last updated: September 2026

© OT Network Ltd / All Rights Reserved / Privacy Policy / Cookie Policy
OT Network Ltd is a company registered in England & Wales. Company No. 14023495 / Registered Office : 31 West Street, Swadlincote, England, DE11 9DN

A Five12 Design website, together we create