Privacy Notice
Sutton Dyslexia Practice
Last updated: August 2026
1. Who I Am
This Privacy Notice explains how Robert Brooks, trading as Sutton Dyslexia Practice (“Sutton Dyslexia Practice”, “I”, “me” or “my”), collects, uses, stores and protects personal information when you use my website, contact me or use my services.
Services may include dyslexia and literacy screening, specialist dyslexia teaching, numeracy and maths support, SEND Advice & Consultation and exam access arrangement assessment services.
For the purposes of UK data-protection law, I am the data controller for personal information where I determine how and why that information is used.
I am registered with the Information Commissioner's Office (ICO) as a data controller.
If you have any questions about this Privacy Notice or how I handle personal information, please contact:
Robert Brooks
Sutton Dyslexia Practice
Email: robert@suttondyslexia.co.uk
Telephone: 07776 199081
2. Information I May Collect
The information collected depends on the service being provided and the individual circumstances. This may include:
names and contact details of parents/carers, adult clients or professional contacts, including email addresses, telephone numbers and, where necessary, addresses;
a learner's name, date of birth or age, school or educational setting and year group;
information about the reason for referral and the learner's educational history, strengths, areas of difficulty and previous support;
relevant information about SEND, disability, diagnoses, health or developmental history where necessary and relevant to the service;
reports, previous assessment or screening information, school information, support plans and exam access arrangement information supplied by parents/carers, schools or other professionals;
screening results, scores and professional notes;
teaching plans, lesson evaluations, progress information and related records;
SEND consultation notes;
reports, recommendations and other professional documents produced as part of a service;
relevant email, WhatsApp and other correspondence;
information relating to bookings, invoices and payments;
information necessary to record and respond to safeguarding concerns where these arise; and
where AI-assisted transcription or note-taking functionality is used, temporary transcripts and AI-assisted notes.
I aim to collect only information that is relevant and reasonably necessary for the purposes for which it is collected.
3. Where Information Comes From
Most information is provided directly by the adult client or by the parent/carer arranging a service for a child or young person.
Information may also be provided by or obtained from a school, college or other professional where this is appropriate to the service and there is a lawful basis for doing so.
For example, exam access arrangement work may require information and evidence to be provided directly by the candidate's school or college.
4. How I Use Personal Information
Personal information may be used to:
respond to enquiries and arrange services;
understand a learner's background, needs and reason for referral;
provide dyslexia and literacy screening and interpret findings;
prepare screening reports and personalised recommendations;
plan, deliver and review dyslexia teaching services;
provide SEND Advice & Consultation;
undertake exam access arrangement work and liaise appropriately with schools or colleges;
communicate about appointments, reports, progress and services;
maintain appropriate professional records;
manage invoices, payments and business administration;
meet professional, insurance, safeguarding, legal and regulatory responsibilities;
establish, exercise or defend legal claims where necessary; and
support professional note-taking, lesson evaluation, planning and continuity of support where appropriate technology is used.
Personal information collected through screening, teaching or consultation is not used to make solely automated decisions about a learner.
AI-assisted tools may support note-taking or administrative activities, but professional conclusions, recommendations and decisions are made by me.
5. Lawful Bases for Using Personal Information
UK data-protection law requires an appropriate lawful basis for processing personal information.
Depending on the purpose and circumstances, I may rely on:
Contract – where processing is necessary to take steps requested before entering into a contract or to provide an agreed service.
Legitimate interests – where processing is reasonably necessary for the operation and protection of my professional practice, such as maintaining appropriate professional records, administering services or dealing with potential claims, provided those interests are not overridden by the individual's rights and interests.
Legal obligation – where processing is necessary to comply with an applicable legal requirement.
Other appropriate lawful bases may apply in particular circumstances, including safeguarding situations.
The appropriate lawful basis depends on the purpose for which information is being used.
6. Special Category Information
Some information relevant to dyslexia, SEND and educational support may constitute special category personal information, particularly information relating to health or disability.
Special category information receives additional protection under UK data-protection law.
Where necessary and appropriate for providing a requested service, I may ask for explicit consent to process relevant special category information.
Other lawful conditions may apply in particular circumstances, including where processing is necessary in connection with safeguarding or the establishment, exercise or defence of legal claims.
Sensitive information will only be requested and used where it is relevant and reasonably necessary.
7. Children and Young People
Many Sutton Dyslexia Practice services are provided to children and young people, and particular care is therefore taken when handling their personal information.
A parent or carer will normally arrange a service and provide relevant background information.
Where appropriate, the purpose of the service and how information will be used will also be explained to the child or young person in a way that is appropriate to their age and understanding.
As children and young people develop sufficient understanding, they may be able to exercise their own data-protection rights.
Requests relating to a child's information will therefore be considered according to the individual circumstances rather than assuming that a parent or carer is automatically entitled to every piece of information held about an older child or young person.
Information will only be shared where there is an appropriate reason and lawful basis to do so, including where necessary for safeguarding.
8. Who I May Share Information With
Personal information is not routinely shared with third parties unless there is an appropriate reason for doing so.
Depending on the circumstances, information may be shared with:
schools, colleges or other education professionals where necessary for an agreed service or where appropriate liaison has been requested;
parents or carers where a service is being provided for their child, taking account of the individual circumstances and the young person's rights where appropriate;
service providers that process information to support the operation of Sutton Dyslexia Practice;
professional advisers or insurers where reasonably necessary;
safeguarding professionals, local authorities or other appropriate organisations where information needs to be shared to protect a child or another person; and
courts, regulators, law-enforcement bodies or other authorities where disclosure is required or otherwise permitted by law.
Screening reports will normally be provided to the client who commissioned the service. They may then share the report with a school or other professional if they wish.
I do not sell clients' personal information to third parties.
9. Services and Technology I Use
A number of third-party services are used to operate Sutton Dyslexia Practice.
Depending on the service provided and how a client communicates with me, these may include:
Microsoft/OneDrive – for cloud storage, synchronisation and backup of professional files.
Google/Gmail – for email and correspondence.
Zoom – for online sessions and, where enabled, AI-assisted transcription or note-taking.
Squarespace – for website hosting and information submitted through the website.
FreeAgent – for accounting and financial administration.
WhatsApp/Meta – where clients choose to communicate using WhatsApp.
Banking and payment providers – for receiving and recording payments.
These providers process information in accordance with their respective services, security arrangements and data-protection responsibilities.
The services used by Sutton Dyslexia Practice may change from time to time as business and professional requirements develop.
10. Website, Analytics and Cookies
The Sutton Dyslexia Practice website is hosted by Squarespace. When you visit the website, Squarespace may process technical and usage information necessary to provide, secure and operate the website. This may include information about your browser, network and device, your IP address, pages you visit and information about how you interact with the website.
Squarespace Analytics is used to help me understand website traffic and how visitors use the website. Analytics information may include pages visited, clicks, referring websites, device and browser information and timestamps.
The website uses cookies and similar technologies. Some cookies are necessary for the website to operate correctly. Where applicable, analytics and performance cookies are used in accordance with the choices made through the website's cookie banner.
If you submit information through a form on the website, the information you provide is processed through Squarespace so that I can receive, manage and respond to your enquiry.
The website may also contain embedded content from third-party services, such as YouTube. When you interact with embedded content, the relevant third party may receive technical information about your device or interaction with that content in accordance with its own privacy practices.
11. International Transfers
Some service providers may process or store personal information outside the United Kingdom.
Where personal information is transferred internationally, appropriate steps will be taken to ensure that relevant protections are in place in accordance with UK data-protection law.
These protections may include UK adequacy regulations or approved contractual safeguards.
12. AI-Assisted Transcription and Note-Taking
AI-assisted transcription or note-taking functionality may be used during online services to support accurate professional note-taking, lesson evaluation, planning and continuity of support.
Where this functionality is used, temporary transcripts or AI-assisted notes may be generated.
Clients will be informed where AI-assisted transcription or note-taking is used. A client who would prefer this functionality not to be used may request that notes are taken manually instead.
AI-generated information is treated as a working aid and does not replace professional judgement or the professional records considered necessary to retain.
Temporary AI-generated transcripts and notes are retained only for as long as reasonably necessary for their intended purpose and may be deleted sooner than core professional records.
Online sessions are not normally separately audio or video recorded and retained as recordings unless this has been specifically discussed and agreed in advance.
13. How Long I Keep Information
Personal information is not kept indefinitely simply because it has been collected.
Core professional client records will normally be retained for seven years after the relevant service ends or the record is completed.
Depending on the service, these may include:
final screening reports;
essential screening results and scores;
substantive professional notes;
teaching plans, progress and review information;
SEND consultation records;
relevant exam access arrangement records; and
other substantive professional documents forming part of the client record.
Temporary, duplicate or supporting information may be deleted sooner where it is no longer reasonably required.
Routine emails, WhatsApp messages and administrative correspondence are not deliberately retained for seven years unless their content forms an important part of the professional record.
Temporary AI-assisted transcripts and notes may be subject to substantially shorter retention periods.
Financial and tax records are retained for the period required under applicable tax and accounting requirements.
Safeguarding records may require different retention arrangements depending on the circumstances.
Exam access arrangement records may also be retained in accordance with professional or regulatory requirements applicable to the work undertaken.
Retention arrangements are reviewed periodically, and personal information will be securely deleted or anonymised when there is no longer an appropriate reason to retain it.
14. Standardised Tests and Copyrighted Materials
Some screening and assessment activities use published standardised tests and other materials protected by copyright, licensing conditions, confidentiality requirements and/or test-security requirements.
Copies of test booklets, stimulus materials, manuals, scoring materials or other protected test content therefore cannot normally be provided or reproduced.
This does not remove an individual's data-protection rights in relation to their own personal information.
Where a data-protection request relates to personal information contained within standardised test materials, the request will be considered in accordance with applicable data-protection law while also respecting relevant copyright, licensing, confidentiality and test-security requirements.
Where appropriate, personal information may be provided in another form rather than reproducing protected test materials themselves.
15. Keeping Information Secure
Appropriate technical and organisational measures are used to protect personal information against unauthorised access, accidental loss, misuse, alteration or disclosure.
These measures include, where appropriate:
password-protected devices and accounts;
appropriate access controls;
secure cloud-based storage and backup;
security measures provided by the technology services used; and
limiting access to personal information to those who have a legitimate reason to access it.
At present, Robert Brooks is the sole practitioner and primarily accesses professional client records himself.
If other practitioners or service providers are engaged in the future, appropriate confidentiality, data-protection and access arrangements will be established before they are given access to client information.
16. Safeguarding and Confidentiality
The welfare and safety of children and young people are taken seriously.
Information will normally be treated confidentially and only shared where there is an appropriate reason and lawful basis to do so.
However, confidentiality cannot be guaranteed where information indicates that a child, young person or another person may be at risk of harm or where there is another legal obligation to disclose information.
In these circumstances, relevant information may be shared with appropriate safeguarding professionals or authorities.
Where appropriate and safe to do so, this will normally be discussed with the parent/carer or client.
17. Personal Data Breaches
If a personal data breach occurs, appropriate steps will be taken to contain and assess the breach and reduce any potential harm.
Where required by data-protection law, the breach will be reported to the Information Commissioner's Office (ICO) and affected individuals will be informed.
18. Your Data-Protection Rights
Depending on the circumstances, individuals may have the right to:
ask for access to personal information held about them;
ask for inaccurate or incomplete information to be corrected;
ask for personal information to be deleted in certain circumstances;
ask for processing to be restricted in certain circumstances;
object to certain uses of their information;
receive certain personal information in a portable format where the right applies;
withdraw consent where processing relies upon consent; and
complain to the Information Commissioner's Office.
These rights are not absolute. Whether a particular right applies depends on the circumstances and the lawful basis for processing.
For example, a request for deletion does not necessarily require information to be deleted where there remains a lawful and justified reason for retaining it.
Requests relating to personal information should be made using the contact details below.
19. Questions, Requests and Complaints
If you have a question about this Privacy Notice, would like to exercise a data-protection right, or have concerns about how your personal information has been handled, please contact:
Robert Brooks
Sutton Dyslexia Practice
Email: robert@suttondyslexia.co.uk
Telephone: 07776 199081
I welcome the opportunity to address any concerns directly.
You also have the right to make a complaint to the Information Commissioner's Office (ICO), the UK's independent data-protection regulator.
20. Changes to This Privacy Notice
This Privacy Notice may be updated from time to time to reflect changes to services, professional practice, technology, service providers or applicable law.
The date at the top of the notice will show when it was last updated.
Where a significant change affects how existing personal information is used, appropriate steps will be taken to bring that change to the attention of affected individuals.