Privacy Policy
The Foundations Practice is run by Hannah Reichardt, a sole trader and INPP Licentiate based in St Albans, Hertfordshire. This policy explains what personal information I collect, why, and how I look after it.
Under data protection law I am the data controller for the information I hold about you and your child. This means I decide how it is used and I am responsible for keeping it safe.
Contact: hannah@thefoundationspractice.com
ICO registration number: ZC269569
Last updated: 20 October 2026
What information I collect
I only collect what I need to provide a safe, effective programme for your child.
If you contact me or use the website:
Your name, email address, phone number and anything you tell me in your message.
Basic website usage information collected through cookies (see "Cookies" below).
If your child has an assessment or programme with me:
Your details: name, address, email, phone number, and confirmation that you have parental responsibility.
Your child's details: name, date of birth, school and year group.
Developmental and health background, such as pregnancy and birth history, early milestones, medical history, diagnoses, and any learning, behavioural or emotional concerns. You give me this through the questionnaire and at the assessment.
My assessment notes, test results, programme plans and progress reviews. With your consent, this may include photos or short videos of exercises.
Payment records: what you paid and when. I do not store card details.
Information about your child's health and development is special category data. The law requires extra care with it, and I treat it accordingly.
Schools programme
When I deliver the INPP Schools Programme, the school is responsible for pupils' information and its own privacy notice applies. I use pupil information only as agreed with the school. .
Why I use it, and the legal basis
Data protection law says I must have a valid reason, called a lawful basis, for each use of your information.
| What I use data for | Legal basis |
|---|---|
|
Replying to your enquiry and arranging appointments |
Legitimate interests: responding to people who contact me |
|
Carrying out the assessment, designing the home programme and reviewing progress |
Contract: to provide the service you have booked |
|
Using your child's health and developmental information |
Your explicit consent, which you give in writing before the assessment |
|
Sharing information with your child's GP, school or another professional |
Your explicit consent, asked for each time |
|
Using photos or videos of exercises |
Your consent, which is optional |
| Keeping financial records and invoices |
Legal obligation: HMRC record-keeping rules |
| Keeping records in case of a complaint or insurance claim | Legitimate interests: protecting my practice and meeting insurance requirements |
You can withdraw your consent at any time by emailing me. This will not affect anything done before you withdrew it. If you withdraw consent to my using your child's health information, I may not be able to continue the programme safely, and I will explain what that means.
I never sell your information, use it for marketing without your permission, or make decisions about your child by automated means.
Who I share it with
Your child's information is confidential. I only share it when one of the following applies.
With your consent: for example, a report to your child's school, GP or another therapist.
Service providers who help me run the practice: website hosting (Squarespace), email, secure record storage [name system] and banking (Monzo). They can only use your information to provide their service to me.
My accountant (Peatty & Co.): financial records only, never clinical information.
My insurer (Balens) or legal advisers: only if needed to deal with a complaint or claim.
Professional supervision: I may discuss cases with an INPP supervisor to support good practice. I remove names and identifying details first.
When the law requires it: if I have a safeguarding concern about a child, I may need to share information with children's services or the police without consent. I will tell you first unless doing so would put a child at risk.
How I keep it safe
Electronic records are kept in password-protected, encrypted systems with two-step login.
Paper records, such as completed questionnaires, are kept in a locked cabinet. Where possible they are scanned and then shredded.
Only I have access to client records.
Some service providers, such as Squarespace, may store data outside the UK. Where they do, they use legal safeguards approved under UK law to protect it.
If something goes wrong with your information that could put you or your child at risk, I will tell you, and I will report it to the ICO where the law requires.
How long I keep it
I keep information only for as long as I need it, then delete or shred it securely.
| Information |
How long I keep it (and why) |
|---|---|
|
Enquiries that do not lead to a booking |
12 months after last contact (in case you get back in touch) |
|
Your child's assessment and programme records |
7 years or until your child's 25th birthday |
|
Invoices and payment records |
6 years after the end of the tax year (HMRC rules) |
|
Photos and videos of exercises |
Deleted when the programme ends, unless you agree otherwise (only needed during the programme |
Yours rights
You have the right to:
See the information I hold about you or your child, and get a copy.
Correct anything that is wrong or incomplete.
Ask me to delete information. I will, unless I have to keep it for legal or insurance reasons, in which case I will explain why.
Ask me to limit how I use it, or object to how I use it.
Receive information you gave me in a format you can pass to someone else.
Withdraw consent at any time.
To use any of these rights, email hannah@thefoundationspractice.com. You do not need to use a form or particular words. I will reply within one month and there is no charge.
Your child's rights. The information belongs to your child, and parents usually make these requests on their behalf. As children grow older and can understand their rights, they may make requests themselves. I will take their views into account.
Cookies
This website is hosted by Squarespace and uses cookies. Cookies are small files that help the site work and show me how many people visit it.
Essential cookies keep the site working and secure. They cannot be switched off.
Analytics cookies tell me which pages are visited, in a way that does not identify you. You can accept or decline these using the cookie banner.
You can also block or delete cookies in your browser settings. For more detail, see Squarespace's list of the cookies it uses.
Complaints
If you are unhappy with how I have handled your information, please tell me first by emailing hannah@thefoundationspractice.com. You have a legal right to complain to me directly. I will acknowledge your complaint within 30 days and let you know the outcome.
If you are still not satisfied, you can complain to the UK data protection regulator, the Information Commission's Office (ICO):
Website: ico.org.uk/make-a-complaint
Phone: 0303 123 1113
Changes to this policy
I will update this policy when the way I work changes. The date at the top shows when it was last updated.