Privacy Policy

Version 0.2 (draft) · 28 September 2026

1. Who we are

ThriveND (“we”, “us”, “our”) provides specialist matching and coordination, booking, administrative and related support services, connecting families with specialists and offering practical neuro-affirming advice and strategies. We also provide consultancy and training to schools, trusts and local authorities on inclusion and SEND provision.

ThriveND Limited is a company registered in England and Wales, company number 17480834, with its registered office at 3 Cresford Road, London SW6 2AH. We are the data controller for the personal data described in this policy.

ICO registration: ThriveND Limited is registered with the Information Commissioner's Office (registration reference: ZC258806).

Contact: hello@thrivend.co.uk

2. What personal data we collect

Depending on how you interact with us, we may collect:

  • Contact details: name, email address, phone number, postal address.

  • Booking information: appointments booked, the specialist or service selected, and your answers to the questions we ask when you book a call (for example your child's age, the main reason you are getting in touch, and whether your child has a diagnosis or an EHCP).

  • Payment records: processed by Stripe. We do not store full card details ourselves.

  • Background and referral information: relevant context provided by you or by referring professionals (for example a school or local authority), where needed to match you with an appropriate specialist.

  • Information about a child or young person: where the service concerns a child, information relevant to their needs, including EHCPs and reports from professionals or schools, provided by a parent, guardian or referring professional.

  • Session summaries and notes: where produced, as described in our Terms & Conditions.

  • School and organisation contacts: where we work with a school, trust or local authority, the names, roles and contact details of the staff we work with, and information gathered during reviews and training (for example staffing structures and anonymised observations).

  • Technical data: limited to what is needed for our website and booking system to work (for example IP address and browser type).

3. Special category data

Information about a person's health, disability or special educational needs is “special category data” under UK GDPR and needs extra care. Where we hold this kind of information, for example about a child's diagnosis, SEN or EHCP, we do so only where necessary to provide the service.

As well as a lawful basis under section 4, we rely on one of the following conditions for special category data:

  • Explicit consent: given by a parent or guardian, for example when they tick the consent box on our booking form or share documents with us. Consent can be withdrawn at any time.

  • Safeguarding: where necessary to protect a child or vulnerable adult from harm, under the substantial public interest condition in the Data Protection Act 2018.

4. Why we process your data and our lawful basis

  1. Contract: to arrange and deliver the call, membership, specialist session or school service you have booked.

  2. Legitimate interests: to run and improve our coordination, administration and payment processes, and to keep appropriate records.

  3. Legal obligation: to meet our obligations under UK law, including safeguarding, tax and accounting requirements.

  4. Consent: where we ask for it specifically, for example for optional communications. You can withdraw consent at any time.

  5. Vital interests or substantial public interest (safeguarding): where necessary to protect a child or vulnerable person from harm, as set out in our Safeguarding Policy and our Terms & Conditions.

5. Who we share data with

We share personal data only where necessary, including with:

  • The independent specialist(s) you are referred to or booked with, so they can prepare for and deliver the session.

  • Our service providers, acting as processors on our instructions: Calendly (bookings and booking questions), Stripe (payments), Microsoft 365 (email and document storage) and Squarespace (website hosting).

  • Relevant authorities (for example children's social care or the police) where a safeguarding concern arises. See our Safeguarding Policy.

  • Professional advisers (for example accountants) and regulators where required by law.

We do not sell personal data, and we do not share it for marketing purposes without consent.

6. International transfers

Some of our service providers, including Stripe and Calendly, may process data outside the UK. Where this happens, the transfer is protected by safeguards recognised under UK GDPR, such as the International Data Transfer Addendum to the EU Standard Contractual Clauses, or certification under the UK Extension to the EU-U.S. Data Privacy Framework, as set out in each provider's data processing agreement. [Confirm the mechanism in Calendly's data processing agreement.]

7. How long we keep data

Client records, including booking answers, are kept for the duration of our relationship with you and for 2 years afterwards, then securely deleted unless a longer period applies below.

Financial records (invoices and payment records) are kept for 6 years, in line with HMRC requirements.

Safeguarding records are kept for longer, in line with our Safeguarding Policy: until a child's 25th birthday, or 7 years for concerns relating to a vulnerable adult.

8. Your rights

Under UK GDPR, you have the right to:

  • Access the personal data we hold about you.

  • Ask us to correct inaccurate data.

  • Ask us to delete your data, subject to our legal retention obligations (for example, we may not be able to delete safeguarding or financial records early).

  • Object to or restrict certain processing.

  • Request a copy of your data in a portable format.

  • Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact hello@thrivend.co.uk. You also have the right to complain to the Information Commissioner's Office (ico.org.uk) if you believe your data has been mishandled.

9. Children's data

Where our services concern a child, personal data is generally provided by a parent, guardian or a professional acting in the child's interests (for example a school or local authority), rather than collected directly from the child. We take particular care with this information given its sensitivity, and access is limited to those who need it to deliver or coordinate the service.

10. Data security

We take reasonable technical and organisational steps to protect personal data, including restricting access to those who need it and using reputable third-party processors for payments and bookings. No system is completely secure. We will notify affected individuals and, where required, the ICO, if a data breach is likely to result in a risk to people's rights and freedoms.

11. Cookies and website data

Our website uses only the cookies needed for the site and our booking system to work. [Confirm with the developer which cookies the site and the Calendly booking pages set. If any are for analytics or advertising, list them here and add a cookie consent banner.]

12. Changes to this policy

We may update this policy from time to time. The date at the top shows the most recent version. We will tell clients about material changes where appropriate.

13. Contact and complaints

Questions about this policy, or requests relating to your data, should be sent to hello@thrivend.co.uk. If you remain unsatisfied, you can contact the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.