Privacy Policy

HG Mind Works

Privacy notice

Autism assessments for West Suffolk NHS Foundation Trust

Version 0.1 · 22 October 2026

1. Who we are

This notice explains how we use your child’s and your family’s information during their autism assessment. It applies only to children referred to us by West Suffolk NHS Foundation Trust (WSFT).

HG Mind Works Ltd carries out these assessments for WSFT’s Integrated Community Paediatric Service (ICPS). In data protection law, WSFT and HG Mind Works are each a data controller, and each is responsible for the information it holds.

• We are responsible for the records we create and hold while assessing your child: your forms, appointment records, health check and assessment notes, MDT records and the report.
• WSFT is responsible for your child’s NHS records, including the original referral and the copy of the report it adds to your child’s record.

WSFT has its own privacy notice, which covers the records it holds. You can read it on WSFT’s data and privacy page.

2. What information we hold

We hold only what we need to assess your child well and safely.

From WSFT, when your child is referred to us

• your child’s name, date of birth, NHS number, address and school
• parent or carer names, phone numbers and email addresses
• the referral information, including the family (Part 1) and school (Part 2) information you and the school gave WSFT
• any reports already on file, such as educational psychology, speech and language, EHCP or GP letters
• safeguarding information WSFT needs us to know to keep your child safe

From you, through our forms and appointments

• registration and safety details (Form 1)
• your child’s health, development, family background and daily life (Form 2)
• the results of the nurse’s physical health check
• what we observe and record during the assessment, including the ADOS-2 and ADI-R
• notes of your feedback appointment and any messages between us

Created by us

• clinical notes, the multidisciplinary team (MDT) discussion and the final diagnostic report
• appointment records, including attendance and missed appointments

Much of this is health information, which the law treats as “special category” data and protects more strictly.

3. How we use it, and why we are allowed to

We use your child’s information to:

• contact you, send forms and arrange appointments
• carry out the health check and autism assessment
• discuss your child’s assessment at an MDT meeting and reach a clinical decision
• write your child’s report and hold your feedback appointment
• recommend next steps and share the outcome with the professionals involved in your child’s care
• keep your child safe if we have a safeguarding concern
• report activity to WSFT so it can monitor the service and pay for it

We never use it for marketing, and we never sell it.

Our legal basis. We provide this assessment as NHS care commissioned by WSFT. We rely on these parts of UK data protection law:

• UK GDPR Article 6(1)(e): delivering NHS care is a task carried out in the public interest
• UK GDPR Article 9(2)(h) and the Data Protection Act 2018, Schedule 1, paragraph 2: processing health information to provide health care
• for safeguarding, Data Protection Act 2018, Schedule 1, paragraph 18: safeguarding children at risk

We do not rely on your consent as the legal basis for using your child’s information. We do ask for your agreement before WSFT passes your child’s referral to us, and you can tell us at any point if you no longer want the assessment to go ahead. If you withdraw, we return your child’s referral to WSFT.

Because this is your child’s direct care, the NHS National Data Opt-Out does not apply.

4. Who sees your child’s information

Only people who need it to assess or care for your child, or where the law requires it.

We do not share your child’s information with anyone else without your agreement.

5. How we keep it safe

Your child’s information is stored in secure, access-controlled systems. Staff can see only what they need for their role, and everyone working on the service completes data protection and confidentiality training every year. We meet the standards of the NHS Data Security and Protection Toolkit, and hold Cyber Essentials certification.

Semble stores your child’s information in the UK.

6. How long we keep it

We keep your child’s assessment records in line with the NHS Records Management Code of Practice. For children, this is normally until their 25th birthday, or their 26th if they were 17 when their care ended. After that, we delete them securely.

WSFT keeps its own records, including the copy of your child’s report, under its own retention policy.

7. Your rights, and your child’s

You and your child have the right to:

• see a copy of the information held about your child
• ask us to correct anything that is wrong or incomplete
• object to, or ask us to limit, how the information is used, although this may not always be possible if it would stop us providing safe care
• ask for information to be deleted. This right is limited for health records, which usually have to be kept

These rights belong to your child. While your child is young, you will normally use them on their behalf. Older children who understand what they are asking can make requests themselves, and we will always consider your child’s best interests and wishes. Occasionally the law allows us to withhold information, for example if sharing it could cause serious harm.

How to make a request. Email us at dataprotection@hg-vc.com or contact WSFT directly at NDDdatatransfer@wsh.nhs.uk. We deal with requests about the records we hold. For your child’s NHS records, contact WSFT. If you are not sure who holds what, contact us and we will help, or pass your request on with your agreement. Requests are free, and you should normally receive a response within one month. We may need to check your identity first.

8. Questions and complaints

If you have a question or concern about how we use your child’s information, contact our Data Protection Officer, Faye Evans, at dataprotection@hg-vc.com or write to us at Camperdene House, High Street, Chipping Campden, Gloucestershire GL55 6AT. Please tell us your child’s name and NHS number so we can find their record. We will look into your concern and reply.

You can also contact WSFT’s Information Governance team at NDDdatatransfer@wsh.nhs.uk.

If you are still unhappy, you can complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint or 0303 123 1113.

Changes to this notice. We will update this notice if the way we use information changes, and show the date of the latest version here.