Privacy Notice

We also provide a shorter, accessible Young Person’s Privacy Information version.

Data Protection Officer: Dr Hema Kumar, an independent, externally appointed Data Protection Officer. Contact: [email protected].

General contact: [email protected]. Clinical safety matters: [email protected].

EnrichMyCare is registered with the Information Commissioner’s Office (ICO).

1. Who This Notice Covers, and Who It Doesn’t

EnrichMyCare is used in different ways depending on how a family or professional comes to it, and this Notice covers all of them. But EnrichMyCare is not always the organisation that decides how your information is used.

Where EnrichMyCare provides its platform to an NHS organisation or a school, that organisation has its own responsibilities under data protection law, including publishing its own privacy information. This Notice explains EnrichMyCare’s own role — it does not replace, and should not be read as overriding, the privacy information, Data Processing Agreement or other governance arrangements of the NHS organisation or school involved in your or your child’s care. Where EnrichMyCare’s role in a particular activity is to process information on that organisation’s instructions, rather than to decide how it is used, we say so clearly, and you should look to that organisation’s own privacy notice for the fuller picture of its own responsibilities.

2. The Different Ways EnrichMyCare Is Used

Four situations cover most of how people use EnrichMyCare. We use these terms consistently throughout this Notice:

Who is responsible in law for deciding how a particular piece of information is used — the Controller — depends on the purpose for which that information is being processed and the instructions under which EnrichMyCare is acting when it processes it. It does not change simply because a clinician, teacher or other professional happens to open or look at information on a given occasion, and, as Section 5 explains, one EnrichMyCare account can support more than one of these situations at the same time. Section 4 below sets out, activity by activity, who is Controller and who is Processor.

3. Information We Collect

3.1 Account Information

Whoever creates an account — a parent, carer, clinician, or school staff member — we collect the name, contact details and login credentials needed to administer that account and keep it secure.

3.2 Your Child’s Information

Where a parent or carer records information about their child, this can include identity and contact details; health, development and care information; appointments and care-team information; responses to questionnaires and diaries; and photos, videos, voice notes or documents they choose to upload. The exact information recorded depends on how EnrichMyCare is being used and what the parent, carer or relevant organisation chooses to provide.

3.3 Information From Professionals and Schools

Where a clinician, other professional or school staff member contributes information as part of a child’s care — for example clinical reports, structured referral information, or a SENCO’s classroom observations — we collect that information, along with the name, role and contact details of the professional providing it.

3.4 Technical Information

Like most digital services, we automatically collect some technical information when you use our website or digital services, such as device type, IP address and information about how you interact with the service. Where our public website uses cookies or similar technologies, our separate Cookie Notice provides further information about those website technologies.

3.5 Information You Give Us Directly

If you contact our support team or otherwise get in touch, we use the information you provide to respond to and manage your enquiry. We do not maintain routine support correspondence for longer than needed unless it forms part of a complaint, security or clinical-safety incident, legal matter, or other record that must be retained. Section 8 explains our position on research and service evaluation activity.

4. Who Is Responsible for Your Information, Activity by Activity

This section explains, for each of the four situations described in Section 2, who is the Controller and what role EnrichMyCare plays.

4(a). Independent Family Service

EnrichMyCare is the Controller. When you create an account and use EnrichMyCare independently — without an NHS organisation or school being involved — we decide how that information is used, in line with this Notice.

Within the Independent Family Service, you can invite an education staff member to create their own account to view and contribute information through the access provided following your invitation. This is separate from the School-Linked Pathway described in Section 4(c), which is arranged by the school itself. You can also separately share an individual record with a healthcare professional, social care professional, carer or other agency; the recipient accesses only that specific record through EnrichMyCare’s secure, verified sharing process. In both cases, the parent or carer decides whether to grant access or share the record, and EnrichMyCare facilitates that choice as part of the Independent Family Service. Neither mechanism gives the recipient access to the Professional/Clinician dashboard or the AI-assisted tools described in Section 6; access to those tools is separately provisioned by EnrichMyCare only for organisation-linked professional users.

4(b). NHS-Linked Pathway

The NHS organisation is the Controller; EnrichMyCare is the Processor. Where an NHS organisation has arranged for EnrichMyCare to support a referral or care pathway, that organisation decides how information is used, and EnrichMyCare processes it under a formal Data Processing Agreement, on that organisation’s instructions. The NHS organisation is responsible for its own transparency information about this processing; you should also refer to its own privacy notice.

4(c). School-Linked Pathway

The school is the Controller for information collected by school staff; EnrichMyCare is the Processor. Where a SENCO or teacher records observations as part of a school referral, the school decides how that information is used, and EnrichMyCare processes it under an agreement with the school. School staff only ever see the specific questionnaire forms they complete and any classroom strategies later sent back to them — never a child’s full clinical record, AI-generated summaries, or clinical correspondence.

Where information originally collected by a school subsequently forms part of an NHS organisation’s care pathway for the same child, the NHS organisation is separately the Controller for its own processing of that information for the child’s care, in line with Section 4(b) above.

4(d). Professional/Clinician Access

A clinician or other professional’s own employment or contractual relationship with their organisation — not this Notice — governs their own data protection obligations to that organisation. This Notice describes what EnrichMyCare does with the information a professional accesses or contributes as part of a child’s care.

5. Linking an Independently Created Account to an NHS Pathway

You can use EnrichMyCare’s Independent Family Service to record diaries, complete questionnaires and organise your child’s information without any NHS organisation being involved. If your child is later referred for an NHS assessment, or you want your child’s NHS care team to see this information, you can choose to link your account to that NHS organisation.

When you do this:

• —You are asked to clearly authorise EnrichMyCare to make the relevant historical information available to the NHS organisation for your child’s care. This is a specific, separate action from creating your account, and you will be told what will be shared before you confirm it.
• —Your authorisation to share is not, by itself, the NHS organisation’s lawful basis for using your child’s information for their care. The NHS organisation has its own lawful basis for processing information as part of providing healthcare, which it explains in its own privacy information. Your authorisation is what allows the information you’ve already recorded to be made available to them; it does not replace the NHS organisation’s own responsibilities as Controller for what it then does with that information.
• —When your account is linked, the information made available to the NHS organisation is processed for the purposes of your child’s NHS care. For that processing, the NHS organisation is the Controller and EnrichMyCare acts as its Processor, in the same way described in Section 4(b).
• —Linking does not change the status of your whole account. If you continue to use features of the Independent Family Service for your own purposes — for example, keeping a private diary you haven’t chosen to share — EnrichMyCare may continue to act as Controller for that separate processing. The same EnrichMyCare account can support more than one of these processing contexts at the same time.
• —Once linked, relevant shared information may be used by the clinician-facing AI-assisted tools described in Section 6, under the same professional oversight that applies to other information in an NHS-Linked Pathway.

6. How We Use AI

6.1 AI Used to Support Clinical Care

Within organisation-linked clinical pathways, EnrichMyCare uses AI-assisted tools to help authorised healthcare professionals review and organise information, prepare clinical summaries, and support aspects of clinical triage. These tools support healthcare professionals; they do not make decisions about your child’s care on their own, and an authorised healthcare professional reviews AI-assisted output before it is used in clinical decision-making.

These AI-assisted tools are only available to authorised professionals within an organisation-linked clinical pathway. They are not available to anyone using the Independent Family Service, or to school staff, and this remains the case where a parent has invited an education staff member or shared an individual record as described in Section 4(a).

6.2 Personalised Information and Resources

EnrichMyCare may also use information about your child to provide personalised information and resources as part of their care pathway. Where appropriate, these are provided with clinical oversight, and do not replace assessment or advice from your child’s healthcare team.

6.3 Safeguarding

Safeguarding concerns identified in connection with a child’s care remain the responsibility of the relevant clinical or education team and are handled in accordance with that organisation’s safeguarding procedures. EnrichMyCare does not replace those responsibilities or procedures.

7. Who We Share Information With

• —The clinical team responsible for your child’s care, where EnrichMyCare is used as part of that care pathway.
• —School or education staff, according to the access route and role described in Sections 4(a) and 4(c).
• —Trusted service providers who help us run EnrichMyCare, supporting hosting, security, communications and notifications. Given the sensitivity of health information, all clinical data is hosted on Microsoft Azure, exclusively within the UK.
• —People you choose to share an individual record with through EnrichMyCare’s secure, verified sharing process.
• —Regulators, courts or other authorities where we are required to disclose information by law.

We do not sell personal information, and we do not share it with advertisers.

8. Research and Service Evaluation

EnrichMyCare may support research, service evaluation and pathway-improvement projects with healthcare organisations and research partners. Where a project involves additional uses of personal information beyond ordinary care or use of EnrichMyCare, you will be given appropriate project-specific privacy information and, where required, participant information before that processing takes place. This Notice describes our general processing of your information; it does not replace the specific information you would be given about any particular research or evaluation project.

9. Anonymised Information and Service Improvement

We may create aggregated or properly anonymised information from service data to understand how services and care pathways are performing and to improve our services. We do not publish information that identifies individual children or families as part of this activity. Properly anonymised information may also be used for service improvement, evaluation, evidence development and benchmarking where this is compatible with the applicable organisational arrangements.

10. The Legal Basis for Using Your Information

The lawful basis that applies depends on the purpose and context of the processing. When you use EnrichMyCare independently, EnrichMyCare is the Controller. For ordinary account administration and delivery of the Independent Family Service, we process personal information as necessary to provide the service you choose to use and, where appropriate, on the basis of your consent. Because information about your child’s health is special category data, we rely on explicit consent for that health information in the Independent Family Service. Where you choose to invite education staff or share an individual record, we process the information to carry out your instructions within the Independent Family Service.

NHS-Linked Pathway — the NHS organisation is the Controller and determines its own lawful basis for processing, which is explained in its privacy information. EnrichMyCare acts as Processor on that organisation’s instructions.

School-Linked Pathway — the school is the Controller for its processing and is responsible for determining and explaining the lawful basis that applies to its use of personal and special category information. EnrichMyCare acts as Processor on the school’s instructions.

Linking your account to an NHS pathway (see Section 5) is an action you initiate and authorise as a parent or carer. It is not itself the NHS organisation’s lawful basis for clinical processing. The NHS organisation determines and holds the lawful basis for its subsequent processing of the shared information, as explained in Section 5.

11. How Long We Keep Information

We keep personal information only for as long as it is needed for the purposes for which it is being used, and to meet applicable legal, regulatory, contractual and security requirements. The period depends on how EnrichMyCare is being used.

12. Keeping Information Secure

EnrichMyCare’s core clinical data is hosted in Microsoft Azure UK South and is encrypted both in transit and at rest. We also use trusted service providers for security, communications and notifications, subject to appropriate data-protection and security arrangements. Access is controlled on a role and least-privilege basis, with multi-factor authentication required for clinical and administrative accounts. Our security practices are independently tested each year. EnrichMyCare maintains security and information-governance controls designed for NHS deployment, including Cyber Essentials certification and NHS Data Security and Protection Toolkit Standards Met status. EnrichMyCare also maintains Digital Technology Assessment Criteria evidence for its relevant services.

13. Children’s Information

Much of the information EnrichMyCare holds relates to children and young people. We recognise that children and young people’s understanding and ability to exercise their own information rights develops as they grow. Depending on their age, understanding and circumstances, we may provide privacy information directly to a young person and take appropriate account of their views and rights, alongside those of their parent or carer where applicable. Where a child is too young to manage their own information, a parent or carer with parental responsibility provides and manages it on their behalf.

We also provide a shorter Young Person’s Privacy Information document, written in a more accessible way for children and young people.

14. Your Rights

Data protection law gives you a number of rights over your information, although the rights that apply in a particular situation depend on the lawful basis and circumstances of the processing — for example, some rights work differently for information held as part of your child’s NHS clinical record than for information you hold independently. Where they apply, these rights include: to be informed about how your information is used, to access it, to have it corrected, to have it erased in some circumstances, to restrict or object to some uses, to receive a copy in a portable format, and to withdraw consent where consent is the basis for processing. Where an NHS organisation or school is the Controller for a particular piece of information, requests about that information should usually go to them, but you can also contact us and we will help direct your request appropriately. You can also complain to the Information Commissioner’s Office at any time — see Section 17.

15. Cookies

Our public website may use cookies and similar technologies. Our Cookie Notice explains how these technologies are used on the website and the choices available to you.

16. Changes to This Notice

We will update this Notice as EnrichMyCare changes, and we’ll let you know about significant changes.

17. Contact Us

If you have questions about this Privacy Notice or how EnrichMyCare uses your information, get in touch using the details below.

Glossary