Privacy Policy

Who we are and how to contact us

The OT Centre is Green Tomato Ltd, a company registered in England and Wales under number 7016731, whose registered office is at Unit 20 Market Hall, Carmarthen Street, Llandeilo, Carms SA19 6BJ. We provide private occupational therapy and sensory integration assessment and treatment across the UK, through a network of self-employed occupational therapists (our Associates).

We are the controller of the personal information described in this policy. We are registered with the Information Commissioner’s Office (ICO) under number Z2417855.

For any question about your information, or to use any of your rights, contact us:

• by email: client-services@theotcentre.co.uk

• by post: Data Protection, Unit 20 Market Hall, Carmarthen Street, Llandeilo, Carms SA19 6BJ

• by phone: 01550 537 537

Who this policy covers

This policy explains how we use personal information about:

• people who visit our website;

• people who contact us, ask for a call back or make an enquiry;

• our clients, including children and young people, and the parents or carers who act for them;

• professionals who instruct us or work with us on a case, such as case managers, solicitors, schools and local authorities, and the people they refer to us;

• our Associates, and people who apply to work with us.

When a professional refers someone to us, we may receive that person’s information from the professional rather than from them directly. This policy applies to that information too.

We never see or store your card details: if you pay online, your card is processed by our payment provider, and we see only that a payment was made.

How we use it, and our lawful basis

The law requires a lawful basis for each use of personal information. Ours are:

Health information is special category data and needs a further condition. We use it for health and social care purposes, by or under the responsibility of a registered health professional bound by a duty of confidentiality (UK GDPR Article 9(2)(h) and the Data Protection Act 2018, Schedule 1, paragraph 2). For legal cases we also rely on the condition for establishing, exercising or defending legal claims (Article 9(2)(f)). Where neither applies, we ask for your explicit consent first.

For children, we deal with a parent or person with parental responsibility, and we involve the young person as their age and understanding allow.

We do not make decisions about you by automated means alone, and we do not sell your information or use it for advertising.

Who we share it with

We share information only as far as each purpose needs:

• Our Associates: the occupational therapist working with you sees the information needed for your care or report. Associates work under contract to us, are registered with the Health and Care Professions Council (HCPC), and are bound by confidentiality.

• The person or organisation who instructed us: in legal and case-managed work, reports and updates go to the instructing solicitor or case manager, as agreed when we were instructed.

• Other professionals, with your agreement: for example your GP, school or another therapist.

• Service providers who process information for us, under contract and only on our instructions:

• Google, for email, document storage, forms, video conferencing, our website and website analytics;

• Copper CRM, our client relationship management system;

• Claude AI (Anthropic), for drafting and administrative support, without client-identifiable information;

• Xero, for invoicing and accounts;

• Stripe, for card payments;

• Make iPaaS, to move information between our systems;

• Indeed, for recruitment and reviews by our Associates.

• Our professional advisers and insurers, where needed.

• Authorities, when the law requires it: for example HMRC, a court order, the HCPC, or to protect someone at risk of serious harm.

We never sell personal information.

Transfers outside the UK

Some of our service providers store or process information outside the UK, mainly in the European Economic Area and the United States. When they do, the transfer is protected in one of two ways: the UK has recognised the country as giving adequate protection (for the United States, this covers companies certified under the UK Extension to the EU–US Data Privacy Framework), or we use the transfer terms approved by the ICO. You can ask us for details of the protection used for any provider.

How long we keep it

We keep information only as long as we need it, then delete or destroy it securely.

Clinical retention follows the periods used across UK health and care services. We keep information longer only if the law requires it, or while a complaint or legal claim is open.

Cookies and analytics on this website

Our website is built on Google Sites. Cookies are small files a website stores on your device.

• Necessary cookies: Google Sites uses these so the site works and stays secure. They cannot be switched off.

• Analytics cookies: we use Google Analytics to count visits and see which pages are used, including when someone submits our enquiry or call-back form, so we can improve the site. It tells us about visits in general, not who you are. We use it only for these statistics: Google’s advertising features are switched off, and we do not let Google use our analytics data for its own purposes. The law allows cookies used only for this kind of statistics without asking you first, provided we tell you about them and you can easily refuse them. The next paragraph explains how.

• Embedded content: some pages show content from other services, such as YouTube videos or Google Maps, which may set their own cookies.

You can block or delete cookies in your browser settings, and you can stop Google Analytics collecting your visits with Google’s opt-out browser add-on (tools.google.com/dlpage/gaoptout). Blocking necessary cookies may stop parts of the site working.

Our internal Google tool: The OT Centre Keyword Planner

The OT Centre Keyword Planner is an internal tool, used only by our own staff, that helps us plan our website. It is not offered to the public, and it holds no information about our clients, Associates or website visitors.

When a member of our staff signs in to it with their Google account and gives permission, it:

• reads keyword planning data from The OT Centre’s own Google Ads account: how many people search each month for phrases such as “occupational therapist Cardiff”;

• reads one list of search phrases, and saves the results, in one folder of The OT Centre’s Google Drive.

It does not read email, contacts or any other files, and it does not manage or change advertising. The search figures it collects are not personal information. They are kept in our Google Drive for as long as we use them to plan the website, are not shared with anyone, and are never sold or used for advertising. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

Anyone who has signed in to the tool can remove its access at any time at myaccount.google.com/permissions.

Your rights

You have the right to:

• access the information we hold about you;

• have inaccurate information corrected;

• have information deleted, where we no longer have a good reason to keep it;

• restrict how we use it, or object to a use based on our legitimate interests;

• receive information you gave us in a portable format;

• withdraw consent at any time, where we rely on it.

Some rights have limits. For example, we must keep clinical and financial records for the periods above, and a report for a legal case belongs to the case.

To use a right, contact us using the details at the top of this policy. It is free. We reply within one month, or tell you within that month if a complex request needs up to two months more. A parent or carer can act for a child who cannot yet act for themselves.

How to complain

If you are unhappy with how we have handled your information, please tell us first, using the contact details at the top of this policy, by any means you choose. We acknowledge every complaint within 30 days, look into it without undue delay, keep you updated, and tell you the outcome.

You can also complain to the Information Commissioner’s Office:

• online: ico.org.uk/make-a-complaint

• by phone: 0303 123 1113

• by post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Changes to this policy

We review this policy when the way we use information changes, and at least once a year. The latest version is always on this page.

Last updated: 21st Oct 2026.