Privacy Policy

This policy was last updated on 23rd September 2026

​

1. Who we are and what this policy covers

This Privacy Policy explains how Silent Stories Ltd ("we", "our", "us") collects, uses, stores and protects personal information through our website and services.

Silent Stories Ltd is the data controller responsible for the personal information we process.

We are committed to protecting your privacy and confidentiality, particularly given the sensitive nature of the services we provide to children, young people and families.

This policy applies to information provided to us through our website, enquiry and referral forms, email, telephone, text message, social media and other communications relating to our services. It is intended to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. What is personal data?

Personal data is information that can identify an individual, either directly or when combined with other information. Depending on the circumstances, the information we process may include information about a child or young person, their parent or carer, and other individuals involved in supporting them.

Some of the information we process is special category data under Article 9 of the UK GDPR — in our case, primarily information relating to health, emotional wellbeing and other sensitive personal circumstances. Special category data requires two separate legal footings: a lawful basis under Article 6, and a specific condition for processing under Article 9. Section 3 below sets out how we meet both requirements at each stage of a client's journey with us.

We only collect information that is relevant to the purposes for which it is required.

3. The basis on which we process your information

Data protection law requires us to identify, for every processing activity, both:

• a lawful basis under Article 6 of the UK GDPR (e.g. contract, legitimate interests, legal obligation, consent); and

• where special category data is involved (health, emotional wellbeing and related information), a separate condition under Article 9.

These two do not have to be linked — for example, we may rely on legitimate interests as our Article 6 basis while relying on a different, specific Article 9 condition for the special category elements of the same processing.

Article 6 basis. Depending on the stage at which you are engaging with Silent Stories, we process personal data because:

• it is necessary to take steps at your request before entering into a service (enquiry and referral stages);

• it is necessary to provide services under a contract (once the therapy agreement is in place);

• we have a legitimate interest in responding to enquiries, managing referrals, maintaining appropriate records, and managing our waiting list;

• we have a legal or regulatory obligation to process the information (for example, safeguarding); or

• you have given consent, where consent is the appropriate basis for that specific activity (see below).

Article 9 condition for special category data. Silent Stories relies on two Article 9 conditions, applied to different parts of our processing:

• Article 9(2)(h) (health or social care) for the core therapeutic relationship — the referral assessment, parent assessment meeting, and the therapeutic service itself — paired with the relevant condition in Schedule 1 of the Data Protection Act 2018.

• Article 9(2)(a) (explicit consent) for narrower, clearly optional activities such as photographic or video recording (see Section 21), where consent is genuinely freely given and can be withdrawn without affecting the wider therapeutic service.

Providing information necessary for us to assess or provide a requested service is different from giving consent to receive marketing communications, and the two are always kept separate.

4. Information we process at different stages

The amount and type of information we collect will depend on the stage at which you engage with Silent Stories.

Initial enquiry. You may contact us to ask about our services, whether we may be able to support your child, availability, costs, how Play Therapy works, or any other information about our services. At this stage, we use the information you provide to respond to your enquiry and consider whether our service may be relevant to your circumstances. An enquiry does not automatically mean that a referral has been made or that therapeutic services will be provided.

Referral. If you decide to proceed with a referral, we may collect additional information about the child or young person and the support they may require, to understand the reason for referral, assess suitability, and make appropriate arrangements. Completing a referral form does not, by itself, mean that a therapeutic relationship has been established.

Complimentary introductory call. Following a returned referral form, we hold a 30-minute complimentary call to gather further information and provide general play therapy advice. There is no charge to the parent/carer at this stage.

Parent assessment meeting. Should the parent/carer wish to proceed, the next stage is a chargeable parent assessment meeting, at which we gather more detailed information about the young person, their circumstances, and the parents/carers. An invoice is raised for this meeting, and it references this Privacy Policy.

Waiting list. Where a child or young person is considered potentially suitable for our service but a therapeutic space is not immediately available, relevant information may be retained to manage the referral and waiting-list process. Being placed on a waiting list does not restart or extend the applicable retention period (see Section 17).

Therapeutic service. If therapeutic services commence, the therapy agreement is issued and signed before therapy begins, and information relating to the provision of therapy becomes part of the child's or young person's therapeutic record, which is subject to its own retention period (see Section 17).

5. Information we collect about you

Depending on the circumstances, we may collect: parent or carer name and contact details; child's or young person's name, date of birth or age; information about the reason for seeking support; information about emotional wellbeing or mental health; information about school, friendships, family circumstances or other relevant experiences; information provided through referral forms; information provided by professionals where appropriate; information contained in emails or other communications; appointment and service information; and technical information such as IP address, browser type and device information.

We only collect information that is relevant and necessary for the purposes for which it is being processed.

6. Information we receive from other sources

Where appropriate and where there is a lawful basis for doing so, we may receive information from other people or organisations involved in supporting a child or young person, such as schools, other professionals, or health or support services. We will only request or use such information where there is an appropriate lawful basis and where it is relevant to the support being considered or provided.

7. How we use your information

We may use personal information to: respond to enquiries; assess referrals; determine whether our service may be appropriate; manage our waiting list; arrange appointments; provide therapeutic services; communicate with parents, carers and relevant professionals where appropriate; maintain appropriate therapeutic and administrative records; meet legal, safeguarding, professional and insurance requirements; manage complaints; maintain the security of our systems; improve our services and website; and use anonymised or aggregated information for service evaluation and improvement.

We do not sell personal information.

8. Marketing communications

We will not use your personal information for direct marketing without an appropriate lawful basis and, where consent is required, your consent.

Where you have specifically consented to receive marketing communications, for example by opting in when submitting an enquiry, we may send occasional emails containing articles, resources and information that may support you and your family.

You can withdraw marketing consent at any time by using the unsubscribe option provided in the communication or by contacting hello@silentstories.co.uk. Withdrawing consent to marketing will not affect any therapeutic services you are receiving or any enquiry or referral you have made. Marketing preferences are kept separate from information required to manage enquiries, referrals and therapeutic services.

9. Contacting us through our website

When you contact us, we collect and store the information you provide in order to respond to your enquiry and, where appropriate, progress your enquiry or referral. We may retain a record of communications to ensure continuity and maintain an accurate record of our contact with you. The retention period for this information is set out in Section 17.

10. Information provided by email, telephone, text message or social media

Parents and carers may initially contact Silent Stories by email, telephone, text message or social media. These channels may not be appropriate for sharing detailed or highly sensitive information, and we encourage parents and carers to limit what is shared this way, using our referral form or another agreed method where more detail is required.

We cannot guarantee the security of information transmitted through third-party platforms outside our control, such as email providers, messaging services or social media platforms. However, information received by us will be handled in accordance with our data protection obligations.

11. Children's information

Silent Stories provides services to children and young people. Where information relating to a child or young person is provided by a parent or person with parental responsibility, we may process that information for the purposes of assessing, arranging and providing appropriate support. We recognise the importance of protecting children's privacy and will consider the child's age, understanding and circumstances when handling their information. Where appropriate, we may also seek the views or an age-appropriate explanation of, and where relevant consent from, the child or young person — for example, at the start of therapy (see also the therapy agreement).

12. Cookies

We use cookies and similar technologies to improve website functionality and understand how our website is used. Where required, we will obtain consent before placing non-essential cookies. You can manage cookies through your browser or the cookie controls provided on our website.

13. Website analytics and technical information

We may collect technical information relating to website use, including IP address, device type, browser type, pages visited, and general browsing information, to understand website performance and how people find and use our services. Where possible, this information is aggregated or anonymised.

14. Remarketing

Where applicable, we may use remarketing technologies to understand or improve how people interact with our website and advertising. Where consent is required, we will obtain it, and you can manage your cookie preferences through the relevant controls on our website.

15. Call tracking and recorded calls

We may use call-tracking technology to understand how people engage with our services and to improve the way we respond to enquiries. Where calls are recorded, you will be informed at the point of contact, and recordings will only be processed where there is an appropriate lawful basis.

16. Sharing your information

We do not sell or rent personal information to third parties.

We may share information where necessary and lawful, including with: professionals involved in supporting a child or young person; service providers who process information on our behalf; relevant authorities where there is a legal requirement; safeguarding services where necessary; insurers or professional advisers where appropriate; or other organisations where there is an appropriate lawful basis.

Where the information shared includes special category data, we ensure that both an Article 6 lawful basis and an Article 9 condition apply to that specific disclosure, in the same way as for our own processing (see Section 3).

We will only share information that is relevant and necessary for the purpose for which it is being shared.

17. Retention period for personal data

We retain personal information only for as long as it is necessary for the purpose for which it was collected, or where there is a legal, safeguarding, professional, insurance or other legitimate reason for retaining it for longer. The retention period depends on whether therapeutic services commence.

Initial enquiries and referrals where therapy does not commence

Where you make an initial enquiry about Silent Stories but do not proceed to a referral, information relating to that enquiry will normally be retained for 12 months from the date of the initial contact. Where a referral is subsequently made, the relevant retention period will normally be 12 months from the date of the initial contact relating to that referral. The initial contact date is the date on which the parent, carer or other referrer first contacts Silent Stories in relation to the request for support that subsequently becomes the relevant enquiry or referral.

The following do not restart or extend the 12-month period: completion of a referral form; the complimentary introductory call; being placed on a waiting list; subsequent telephone calls or emails; updates regarding availability; a short period of waiting for a therapeutic space; or other routine communications relating to the same enquiry or referral.

Our waiting list is intended to manage short-term availability and does not create an indefinite period of data retention.

Referral or assessment does not proceed to therapy

Where a referral is completed, or a chargeable parent assessment meeting takes place, but therapeutic services do not commence — including where the family decides not to proceed, another service is chosen, the family no longer requires support, or a suitable therapeutic space is not taken up — the information will normally be securely deleted 12 months from the initial contact date relating to the referral. This remains the case even where the child or young person has previously been placed on our waiting list.

Therapeutic services commence

Where therapeutic services commence (once the therapy agreement is signed and the assessment and play therapy blocks begin), information relating to the provision of therapy becomes part of the child's or young person's therapeutic record.

The therapeutic-record retention period for children and young people is confirmed as until the client reaches the age of 25 (or 26, if they were 17 years old when therapy ended). This follows the sector benchmark set out by BACP, the BPS, and NHS records guidance, reflecting that legal claims relating to treatment received as a minor can still arise some years after the client turns 18.

This retention period replaces the previous "7 years after therapy ends, or age 21, whichever is longer" formulation, which could in some cases have produced a shorter period than the sector benchmark. It is separate from the 12-month period that applies to enquiries, referrals and assessments where therapy does not commence.

Exceptional circumstances

There may be circumstances where information needs to be retained for longer than the periods described above, including safeguarding, legal proceedings, complaints, insurance matters, regulatory or professional requirements, or another legitimate reason recognised under applicable data protection law. Where information is retained beyond the normal retention period for one of these reasons, it will be reviewed and securely deleted when it is no longer required.

Secure deletion

When the applicable retention period has expired and there is no continuing legal, safeguarding, professional, insurance or other legitimate reason to retain the information, we will take appropriate steps to securely delete or destroy it. Our administrative systems may include a retention or deletion date based on the initial contact date, allowing us to identify records that have reached the end of their applicable retention period and review them for secure deletion.

18. Accessing and updating your personal information

You have rights in relation to the personal information we hold about you, which may include the right to: request access to your personal information; ask us to correct inaccurate information; request restriction of processing; request deletion of information where applicable; object to certain processing; and withdraw consent where processing is based on consent.

You can make a request by contacting hello@silentstories.co.uk. We may need to verify your identity before responding to a request. We will normally respond to valid requests within one month, in accordance with UK GDPR requirements. In some circumstances, information may be lawfully withheld, redacted or restricted where a specific legal exemption applies — for example, where disclosure would reveal information about another individual, or another recognised exemption applies.

19. Removal of your information

You may request that we delete personal information where you have a legal right to do so. The right to deletion is not absolute — we may need to retain information where there is a legal, safeguarding, professional, insurance or other legitimate requirement to do so. Where a retention period has already been established under this policy, information will be securely deleted when that period expires unless there is a valid reason for retaining it for longer.

20. Security of your data

We take appropriate technical and organisational measures to protect personal information against unauthorised access, accidental loss, misuse, alteration, disclosure and destruction. These measures may include secure storage systems, restricted access, appropriate password and account controls, encryption where applicable, and secure handling and disposal procedures. Access to personal information is limited to those who need it for legitimate business, administrative, therapeutic, safeguarding or legal purposes.

21. Photographic or video recording

Some therapeutic approaches may involve photographic or video recording of aspects of therapeutic work. Recording will only take place where explicit consent has been obtained from the parent or carer and, where appropriate, the child or young person. Consent to recording is optional and can be withdrawn at any time without affecting the provision of therapy.

Where consent is given, recordings may be used for purposes such as clinical reflection, professional supervision, supporting therapeutic practice, or training. Recordings focus on the play process rather than the child: no images of the child's face or other identifying features are recorded, and all images are pseudonymised. This standard applies consistently across supervision and any training use.

Recordings will be stored securely and handled in accordance with applicable data protection requirements.

22. Complaints regarding content on our website

If you complain about content published on our website, we may collect and process information necessary to investigate the complaint and take appropriate action.

23. Complaints about how we handle your data

If you have concerns about how Silent Stories handles your personal information, please contact us first at hello@silentstories.co.uk. You also have the right to complain to the Information Commissioner's Office (ICO) if you believe your personal information has been handled unlawfully: https://ico.org.uk/concerns/

24. Verification of your information

We may ask you to provide appropriate information to verify your identity before processing requests relating to your personal data, to help protect the confidentiality and security of the information we hold.

25. Information provided to us by you

When you contact Silent Stories, you may choose to provide personal or sensitive information relating to yourself, your child or another family member. We encourage you to provide only information that is relevant to your enquiry or referral.

Standard email, website forms, text messages and social media messaging may not always be fully secure methods of communication. Where more detailed or sensitive information is required, we may direct you towards our referral form, our assessment meeting, or another agreed communication method.

Any personal information you provide will be processed in accordance with this Privacy Policy and used only for appropriate purposes, including responding to your enquiry, assessing a referral, managing our waiting list or providing therapeutic support.

26. Compliance with the law

Silent Stories Ltd processes personal information in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We will review our data protection arrangements periodically and make changes where necessary.

27. Review of this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, systems, legal requirements or data protection practices. The version published on our website is the current version.

If you have any questions about this Privacy Policy or how Silent Stories processes personal information, please contact:

Silent Stories Ltd Email: hello@silentstories.co.uk