Privacy Notice
Version 1.0. Published 24th September 2026.Who we are
Welham Autism Centre Ltd is the data controller for the information described in this notice. We are registered in England and Wales, company number 17157339, and registered with the Information Commissioner's Office under registration ZC128089. Our registered office is Bartle House, Oxford Court, Manchester M2 3WQ.
If you have a question about your information, or you want to exercise any of the rights below, email info@welhamautismcentre.co.uk. Our data protection lead is Dan Welsh.
What this notice covers
This notice explains what we do with information about you and your child when you contact us, book a consultation, or go through an assessment with us. Please read it before you book. If your child is old enough to understand it, we'd encourage you to go through it with them; the information is about them too, and once they're old enough to make their own decisions about it, the rights below become theirs rather than yours.
What information we collect
From you: your name, contact details, your relationship to the child, and payment details. Detailed information about your child's development, health, education, behaviour, family history and daily life.
From your child: what they tell us and how they respond during the assessment, including our clinicians' observations.
From your child's school, where you ask us to approach them: a short questionnaire about how your child presents at school, or existing school reports.
From other professionals, where you ask us to: reports from a GP, paediatrician, therapist or previous assessment.
Recordings and transcripts of online appointments (see the separate section below).
From our website: basic technical information via cookies, covered in our cookie notice.
Almost all of this is special category data (health information), which the law protects more strictly than ordinary personal data. We treat it accordingly.
Why we use it, and our legal basis
To carry out the consultation, assessment and report you've engaged us for. This is what you've asked us to do under our agreement with you, and it is the provision of health care. (UK GDPR Article 6(1)(b) and Article 9(2)(h), with Data Protection Act 2018 Schedule 1, Part 1, paragraph 2.)
To keep clinical records. Our clinicians' professional standards require this, and so does the law. (Article 6(1)(c) and Article 9(2)(h).)
To share a concern about a child's safety with social care or the police, where we believe a child is at risk of harm. (Article 6(1)(c) and Article 9(2)(g), with Data Protection Act 2018 Schedule 1, Part 2, paragraph 18 - safeguarding of children.)
To take payment and keep financial records. Part of our agreement with you, and tax law requires us to keep the records. (Article 6(1)(b) and Article 6(1)(c).)
To run and improve the service, and to defend a complaint or a claim if one is ever made against us. (Article 6(1)(f) and Article 9(2)(f).)
We don't send marketing. If you ask us to let you know when we open for bookings, we'll use your email address for that and nothing else, and delete it once we've told you.
Recording and transcribing appointments
Online appointments are recorded and automatically transcribed in Microsoft Teams, within our own Microsoft 365 environment. We do this so the clinical record is accurate and complete, and so our clinicians can give you their attention rather than typing. The recording and transcript form part of your child's clinical record, which is why we rely on the health care basis above rather than asking for your consent.
You can ask us not to record. Tell us before the appointment or at the start of it, and we won't, it makes no difference to the assessment or its outcome.
Recordings are deleted once a clinician has checked the transcript. The transcript is kept in the clinical record.
In future we intend to use these transcripts to produce a first draft of your child's report. Where we do:
A clinician reads, edits and approves every report before it is issued, and is professionally responsible for all of it.
No decision about your child, including whether they are autistic, is made by automated means. That judgement is always a clinician's.
Your information is not used to train any artificial intelligence system, by us or by Microsoft.
We will update this notice, and tell existing clients, before we begin using transcripts to draft reports.
Who we share it with
Our clinical team. Assessments are carried out by more than one clinician, including associates working with us under contract. They are bound by the same confidentiality and security obligations we are, and by their own professional regulators.
Your child's school or other professionals, only where you have asked us to, or agreed that we should.
Our service providers, who process data on our instructions: Microsoft (record storage, email, appointments and transcription), Cal.com (booking) and Stripe (payments). We do not use any other tools that touch your information.
Social care, the police, or another agency, where we believe a child is at risk of harm. We will normally tell you first, but not where doing so would increase the risk to the child. This is the one situation in which we may share information without your agreement.
A court or regulator, where we are legally required to.
We do not sell your information, and we never share it for marketing.
Where your information is kept
Clinical records are held in Microsoft SharePoint within our own Microsoft 365 environment, configured so that data is stored in the UK or the European Union. Access is restricted to the people who need it, protected by multi-factor authentication, and logged. Some of our providers may process limited data outside the UK; where they do, this is covered by the safeguards UK data protection law requires, such as the International Data Transfer Addendum.
How long we keep it
We follow the NHS Records Management Code for children's health records: we keep your child's clinical record until their 25th birthday, or their 26th if they were 17 when we last added to it. Enquiries that don't lead to a booking are deleted after 12 months. Financial records are kept for seven years, as tax law requires. Recordings are deleted as described above.
Your rights
You can ask us to: give you a copy of the information we hold; correct anything inaccurate; delete information; limit what we do with it; provide it in a portable format; or object to our using it. You can also complain to us or to the regulator.
Some of these rights are limited where we have a professional or legal duty to keep clinical records, we can't delete a diagnostic record on request, for example, and we'll explain why if that arises. A request for a copy of the record is free and we'll respond within one month.
A note on your child's rights. The information is your child's as well as yours. As children get older they become able to exercise these rights themselves, and from around the age of 12 we will normally take their views into account before releasing their record to a parent. By 16 we would usually expect to deal with them directly. If that situation arises we'll talk it through with you.
Complaining
If you're unhappy with how we've handled your information, please tell us first: our complaints procedure explains how. You also have the right to complain directly to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.