Data Protection Policy

Last updated: 12 October 2026 · Next review: October 2027

This policy sets out how we look after personal data. What we hold about students and why is explained in our NMH Privacy Notice.

Responsibility

Neurodivergent Minds is the data controller. The person responsible for data protection is the owner of Neurodivergent Minds, contactable at nmh@neurodivergentminds.com. Anyone delivering support for us must follow this policy.

Principles we follow

Personal data is:

1. used lawfully, fairly and transparently;
2. collected only for clear purposes (arranging, delivering, recording and invoicing DSA-funded support, and safeguarding);
3. limited to what's necessary: session notes are brief and factual;
4. kept accurate and up to date;
5. kept no longer than needed: at least 6 years from a student's last session, as Student Finance England requires, then securely deleted;
6. kept secure.

Information about a student's disability or health is special category data, and we give it extra protection.

Security measures

• Student records are held only on encrypted, password-protected devices and systems, with two-factor authentication where available.
• The online timesheet system is private and login-protected, uses HTTPS, and is backed up regularly to encrypted storage.
• Session confirmation links are unique, single-use, and stop working once used or replaced.
• Devices lock automatically and run up-to-date software and antivirus.
• Student data is never stored on personal social media or messaging apps, or on removable drives that aren't encrypted.
• Paper records (such as signed timesheets) are scanned, then stored in a locked cabinet or securely shredded.
• Emails to students contain only what's needed. We don't put detailed health information in email.
• Remote sessions are held in private, never recorded, and use secure meeting links (see Remote Support Policy).

Sharing data

We share personal data only as described in the NMH Privacy Notice: with Student Finance England and DfE for invoicing and audit, with a student's university with consent (or where there is a safeguarding concern), and with service providers working under written data processing terms. We record any sharing that happens without consent, and the reason.

Students' rights

We respond to requests (copies of data, correction, deletion, restriction, objection) within one month, free of charge. We check identity before releasing information. Records we're legally required to keep, such as timesheets and invoices, are retained for the required period even if deletion is requested.

Data breaches

If personal data is lost, stolen, sent to the wrong person, or accessed without permission:

1. we act straight away to contain it (for example, recalling an email or revoking access);
2. we record what happened, the data involved, and the likely risk;
3. we report it to the ICO within 72 hours if it's likely to put anyone's rights at risk;
4. we tell the affected student without delay if there is a high risk to them;
5. we review what went wrong and change how we work to stop it happening again.

Training and review

Anyone handling student data completes data protection training before starting and refreshes it every year. We review this policy every year, or sooner if the law or our systems change.

Questions about this policy

Email nmh@neurodivergentminds.com. You can ask for this policy in another format (large print, plain text, or read through together in a session).

← All NMH policies