Wildflower Neuro Privacy Policy
Last updated: 28/4/26
This notice explains how Wildflower Neuro collects, uses, and protects your personal data. Please read it carefully.
1. Who we are and how to contact us
Wildflower Neuro is operated by Elizabeth Amos trading as Wildflower Neuro. We are the data controller for the personal information we collect and process about you.
Data controller: Elizabeth Amos trading as Wildflower Neuro
Address: Scarborough, North Yorkshire
Email: beth@wildflowerneuro.org.uk
Website: www.wildflowerneuro.org.uk
ICO registration number: ZC110813
If you have any questions about how we use your personal data, or wish to exercise any of your rights, please contact us using the details above.
Not happy with something?
We’re committed to treating your personal data with respect, transparency, and care. If you ever have questions or concerns about how your data is used, we want to hear from you, and we’ll do our best to resolve things quickly and fairly. Under the Data (Use and Access) Act 2025, you have the right to raise a complaint about how your personal data is handled. Here’s how:
Step 1: Email us at beth@wildflowerneuro.org.uk with a brief description of your concern. You don’t need to use legal language - just tell us what’s worrying you.
Step 2: We’ll acknowledge your message and respond without undue delay, usually within 10 working days.
Step 3: If you’re not satisfied with our response, you can escalate your concern to the Information Commissioner’s Office (ICO) at www.ico.org.uk.
2. What personal data we collect
We collect and process the following categories of personal data:
About you (the parent or carer)
Your full name and contact details (telephone number and email address)
Information about your concerns regarding your child’s behaviour and development
Notes from our consultations
Payment records (bank transfer confirmation)
Correspondence by telephone, email, and Microsoft Teams
About your child
Your child’s name, date of birth, and school
Information about your child’s behaviour, development, and educational experiences
Completed screening questionnaires and our scoring and analysis of these
Our professional assessment of traits that may be consistent with neurodevelopmental differences
Any other information you share with us about your child in the course of our work together
Special category data
Information about your child’s health, behaviour, and possible neurodevelopmental differences constitutes special category data under UK GDPR. We handle this data with the highest level of care and in accordance with our legal obligations. We only collect this data because it is necessary to provide the service you have requested.
Website visitors
If you visit our website at www.wildflowerneuro.org.uk, we may collect anonymised data about your visit through Google Analytics, including pages visited, time spent on the site, and your general location. This data does not identify you personally. Please see our Cookie Policy for further details.
3. How we collect your data
We collect personal data in the following ways:
When you contact us by telephone, email, or Microsoft Teams to enquire about or book our services
When you complete and return screening questionnaires provided by us
During consultation sessions (Session 1 and Session 2)
Through our ongoing professional work together, including any add-on sessions or meetings
When you make payment by bank transfer
When you visit our website (anonymised analytics data only)
4. Why we use your data and our lawful basis
We use your personal data for the following purposes and on the following legal bases under UK GDPR:
PURPOSE: To provide the neurodevelopmental needs consultation service
LAWFUL BASIS: Performance of a contract (Article 6(1)(b)) / Explicit consent for special category data (Article 9(2)(a))
PURPOSE: To produce and share a written report with you
LAWFUL BASIS: Performance of a contract (Article 6(1)(b))
PURPOSE: To communicate with you about your booking, sessions, and follow-up
LAWFUL BASIS: Performance of a contract (Article 6(1)(b)) / Legitimate interests (Article 6(1)(f))
PURPOSE: To fulfil our professional obligations as a registered social worker, including safeguarding duties
LAWFUL BASIS: Legal obligation (Article 6(1)(c)) / Protection of vital interests (Article 9(2)(c))
PURPOSE: To maintain records of our professional work for the purposes of supervision, audit, and professional accountability
LAWFUL BASIS: Legitimate interests (Article 6(1)(f)) / Explicit consent for special category data (Article 9(2)(a))
PURPOSE: To process payment
LAWFUL BASIS: Performance of a contract (Article 6(1)(b))
PURPOSE: Website analytics (anonymised)
LAWFUL BASIS: Consent via cookie preferences (Article 6(1)(a))
5. Who we share your data with
We do not sell, rent, or share your personal data with third parties for marketing purposes.
We may share your personal data in the following limited circumstances:
With your child’s school and/or GP, where you have asked us to provide a written report for this purpose
With other professionals involved in your child’s care, where you have given us explicit written consent to liaise with them
With our clinical supervisor, for the purposes of professional supervision. Any discussion will be anonymised wherever possible. Our supervisor is bound by equivalent confidentiality obligations.
With statutory agencies (such as children’s social care or the police) where we are legally required to do so, or where a safeguarding concern requires us to act to protect a child
With Google Analytics, in the form of anonymised website usage data (no personal information is shared)
We will not share your personal data with any other third party without your prior written consent, except where required by law.
6. Transfers outside the UK
Your personal data is stored and processed within the UK. If you contact us via Microsoft Teams, your data may be processed by Microsoft, which operates under standard contractual clauses approved by the ICO. Google Analytics data may be processed in the United States under appropriate data transfer safeguards. We do not otherwise transfer your personal data outside the UK.
7. How long we keep your data
We retain your personal data for the following periods:
Client consultation records (including notes, screening forms, and reports): 7 years from the date of the final session
Safeguarding records: minimum 10 years, or until the child reaches the age of 25 (whichever is longer)
Payment records: 7 years in line with HMRC requirements
General correspondence (email, telephone notes): 2 years from last contact
Website analytics data: as per Google Analytics retention settings (maximum 26 months)
After the relevant retention period, personal data will be securely deleted or destroyed.
8. How we keep your data secure
We take the security of your personal data seriously. Our security measures include:
Client records stored in password-protected cloud storage (Microsoft OneDrive or equivalent)
Written reports shared by encrypted email only
Devices used to access client data are password protected and kept secure
We do not store payment card details — payments are made by bank transfer only
Access to client records is restricted to Elizabeth Amos only, except where supervision or liaison requires otherwise
In the event of a personal data breach that is likely to affect your rights and freedoms, we will notify you and the ICO as required by UK GDPR.
9. Your rights
Under UK GDPR, you have the following rights in relation to your personal data:
Right of access: You can request a copy of the personal data we hold about you.
Right to rectification: You can ask us to correct inaccurate or incomplete data.
Right to erasure: You can ask us to delete your data in certain circumstances (note: this right may be limited by our legal and professional obligations to retain records).
Right to restrict processing: You can ask us to limit how we use your data in certain circumstances.
Right to data portability: You can ask us to provide your data in a commonly used, machine-readable format.
Right to object: You can object to processing based on legitimate interests.
Rights relating to automated decision-making: We do not use automated decision-making or profiling.
Right to withdraw consent: Where processing is based on your consent, you may withdraw it at any time. This does not affect the lawfulness of processing before withdrawal.
To exercise any of these rights, please contact us at elizabeth.amos@baswindependent.co.uk. We will respond within one month. We may need to verify your identity before processing your request.
10. Children’s personal data
Wildflower Neuro processes personal data about children as part of delivering its service. We only collect information about children that is necessary for the service, and we handle it with the utmost care.
Our service is provided to parents and carers, not directly to children. By engaging our services and signing our Client Service Agreement, you confirm that you have parental responsibility for the child concerned and are authorised to share information about them with us.
If you have concerns about how we handle your child’s data, please contact us directly.
11. Cookies and website analytics
Our website at www.wildflowerneuro.org.uk may use cookies, including Google Analytics cookies, to help us understand how visitors use the site. Analytics data is anonymised and does not identify you personally.
When you first visit our website, you will be asked to consent to non-essential cookies. You can change your cookie preferences at any time. For full details, please see our Cookies Policy.
12. How to make a complaint
If you are unhappy with how we have handled your personal data, please contact us in the first instance at beth@wildflowerneuro.org.uk and we will do our best to resolve your concern.
Step 1: Email us at beth@wildflowerneuro.org.uk with a brief description of your concern. You don’t need to use legal language - just tell us what’s worrying you.
Step 2: We’ll acknowledge your message and respond without undue delay, usually within 10 working days.
Step 3: If you’re not satisfied with our response, you can escalate your concern to the Information Commissioner’s Office (ICO) at www.ico.org.uk.
Elizabeth Amos is registered with the Information Commissioner’s Office (ICO) under registration number ZC110813 and complies with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
13. Changes to this privacy notice
We may update this privacy notice from time to time to reflect changes in our practices or legal requirements. The current version will always be available on our website at www.wildflowerneuro.org.uk. Where changes are significant, we will notify existing clients directly.
14. Safeguarding Statement – Wildflower Neuro
Wildflower Neuro is committed to promoting the safety and wellbeing of all children. Although this service works directly with parents rather than children, safeguarding is central to everything we do.
If information shared during our work together suggests that a child may be at risk of harm, I have a professional and legal duty to take appropriate action. This may include seeking advice, sharing relevant information with other professionals, or making a referral to statutory services. Wherever possible, I will discuss any concerns with you first, unless doing so would increase risk.
As a registered social worker with Social Work England, I follow national safeguarding legislation, professional standards, and the British Association of Social Workers (BASW) Code of Ethics. I also access regular clinical supervision to ensure safe, reflective, and accountable practice.