Privacy & data protection.

Spark Speech Speech & Language Therapy, trading as Spark Speech (Priory Drive, Stillorgan, Co. Dublin, Ireland), is the data controller responsible for the personal data described in this notice. We provide private, CORU registered paediatric speech and language therapy.

You can contact us about any data protection matter at hello@sparkspeech.ie.

Depending on how you interact with us, we may collect:

• Enquiry and contact details , a parent or guardian's name, email address, phone number, your child's age, the service you are enquiring about, and any message you choose to share with us through our contact form, by phone or by email.
• Clinical and health data , once your child becomes a patient, assessment notes, therapy records, progress reports, correspondence with other professionals involved in your child's care, and information you provide about your child's communication, development, medical or educational history. This is "special category" data under Article 9 GDPR and receives extra protection.
• Billing and insurance information , where relevant to pay for or claim against the cost of therapy, for example when liaising with a private health insurer.
• Sparky assistant questions , if you type a question into Sparky, our website assistant, that question text is processed as described in section 5 below.

We do not use advertising, analytics or tracking cookies on this website, and we only ask for the personal data we actually need to respond to your enquiry or provide therapy.

General enquiry details are processed on the basis that it is necessary to take steps, at your request, before entering into a contract for therapy with us (Article 6(1)(b) GDPR), and, where you consent, on the basis of your consent (Article 6(1)(a)).

Your child's clinical and health records are special category data. We process this data because it is necessary for the provision of health or social care or treatment, under Article 9(2)(h) GDPR and section 52 of the Data Protection Act 2018, and subject to the professional confidentiality duties that apply to CORU registered therapists. Where we rely on your consent to share clinical information with a third party, for example an insurer or another professional, that consent is explicit and can be withdrawn at any time, as explained in section 9.

Our clients are children, so almost all of the clinical data we hold relates to a child. We collect this data from, and with the consent of, a parent or legal guardian, and we process it to provide the therapy you have asked us to provide. We take extra care with children's data: we only collect what is clinically necessary, we do not use it for marketing, and we explain, in plain language where appropriate, how it will be used.

A parent or guardian can exercise any of the rights in section 8 on behalf of a child who is not yet able to exercise them personally.

Sparky can answer general questions about Spark Speech directly on this website. For research style questions, Sparky uses OpenAI's API to search for and summarise published academic sources. The text of your question is sent to OpenAI, a processor based in the United States, in order to generate a response; we have configured this feature so that OpenAI does not retain your question after the response is generated. Please avoid including your child's name or other identifying details when using Sparky, since it is a general information tool and not part of your child's clinical record.

We only share personal data where it is necessary and appropriate, for example with:

• Other professionals involved in your child's care (for example a GP, HSE service, school or other therapist), where you have asked us to liaise with them or given your consent.
• Private health insurers, such as Vhi Healthcare, Laya Healthcare, Irish Life Health or Level Health, where you ask us to support an insurance claim.
• Trusted service providers who support our practice, such as our website hosting and IT providers, under contracts that require them to protect your data and only use it as we instruct.
• Our professional and legal advisers, where necessary for our legitimate interests.
• A regulator, professional body or court, where we are legally required to do so.

We do not sell personal data, and we do not use it for marketing by any third party.

This website is hosted on infrastructure located outside the European Economic Area, and the Sparky assistant described in section 5 sends question text to a United States based processor. Where personal data is transferred outside the EEA, we rely on safeguards recognised under GDPR, such as the EU US Data Privacy Framework or standard contractual clauses, to ensure it continues to receive an equivalent level of protection. You can contact us for more information about these safeguards.

If you contact us but do not go on to become a patient, we keep your enquiry details for as long as reasonably necessary to respond to you, and then delete them.

Clinical records relating to your child's assessment and therapy are kept for longer, in line with professional guidance for healthcare records in Ireland. This generally means retaining a child's clinical records until they turn 25, or 26 if they were 17 when their care concluded, reflecting the extended period in which a claim can be brought on behalf of a minor. We review and securely dispose of records once they are no longer required.

Under the GDPR, you (or, on behalf of your child, their parent or guardian) have the right to:

• Ask us what personal data we hold and get a copy of it (right of access).
• Ask us to correct inaccurate or incomplete data (right to rectification).
• Ask us to delete data, where we are not required to keep it (right to erasure).
• Ask us to restrict how we use your data in certain circumstances.
• Ask us to provide your data in a portable, machine readable format, where applicable.
• Object to processing that is based on our legitimate interests.
• Withdraw consent at any time, where we rely on consent, without affecting what we did before you withdrew it.

To exercise any of these rights, contact us at hello@sparkspeech.ie. We may need to verify your identity, and your relationship to a child, before acting on a request.

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss or disclosure, including restricted access to clinical records, secure hosting, and confidentiality obligations on our team in line with their professional and CORU registration requirements. No system is completely immune to risk, and we keep our security measures under review.

Given the size of our practice, we have assessed that we are not currently required to appoint a statutory Data Protection Officer under Article 37 GDPR. Responsibility for data protection sits with the practice, and you can raise any question, concern or request at hello@sparkspeech.ie.

If you are unhappy with how we have handled your personal data, please contact us first so we can try to resolve it. You also have the right to lodge a complaint with Ireland's supervisory authority, the Data Protection Commission, at www.dataprotection.ie.

We may update this notice from time to time, for example as our services, systems or the law change. The version published on this page is always the current one.