top of page

​​

 

 

 

 

Version 1.0 | Effective October 2026 | Last reviewed October 2026

 

Serenity Occupational Therapy Ltd (“Serenity”, “we”, “us” or “our”) is committed to protecting your privacy and handling personal information lawfully, fairly and securely. 

​

This Privacy Notice explains how we collect, use, store and share personal information when you: 

  • use our website; 

  • enquire about our services; 

  • receive Occupational Therapy services from us; 

  • are referred to us by a Case Manager, insurer, solicitor, employer, Occupational Health provider, GP or other healthcare professional; 

  • act as a family member, carer or representative of a client; 

  • commission or fund our services; or 

  • communicate with Serenity in a professional capacity. 

This notice should be read alongside any service-specific consent information, contractual terms or information provided to you when Occupational Therapy services commence. 

 

1. Who we are 

Serenity Occupational Therapy Ltd provides specialist Occupational Therapy services including functional assessment and rehabilitation, mental health Occupational Therapy, neurodivergence support, vocational rehabilitation, workplace assessment and return-to-work services. 

​

For data-protection purposes, Serenity Occupational Therapy Ltd is the data controller for personal information where we determine why and how that information is processed. 

​

Website: www.serenityoccupationaltherapy.co.uk 

Email: info@serenityoccupationaltherapy.co.uk 

Registered office: 31 Balmoral Place, Aberdeen AB10 6HR 

Company number: SC807290 

ICO registration number: ZB774279  

Privacy and data-protection enquiries should be directed to the Clinical Director at: 

info@serenityoccupationaltherapy.co.uk 

 

2. Who this Privacy Notice applies to 

This notice may apply to: 

  • prospective, current and former clients; 

  • self-funding clients; 

  • people referred by Case Managers; 

  • people referred through insurers or solicitors; 

  • employees referred by employers, HR or Occupational Health; 

  • people referred by GPs or other healthcare professionals; 

  • family members, carers, attorneys, guardians or representatives where their information is relevant to our involvement; 

  • Case Managers and rehabilitation professionals; 

  • employers, HR and Occupational Health professionals; 

  • solicitors, insurers and other commissioners; 

  • healthcare and rehabilitation professionals; 

  • website visitors; and 

  • people making enquiries about our services. 

 

3. What personal information we may collect 

The information we collect depends on the nature of our relationship with you and the service being provided. 

It may include: 

  • Identity and contact information, such as your name, date of birth, address, telephone number, email address and preferred method of contact. 

  • Referral information, including the reason for referral, referral questions, details of the referring professional and information provided by the organisation commissioning our services. 

  • Health and clinical information, including information about physical health, mental health, diagnoses, injuries, medication, treatment, rehabilitation and relevant medical history. 

  • Occupational and functional information, including information about daily activities, self-care, domestic tasks, routines, community participation, cognition, executive functioning, fatigue, sensory processing, interests, roles and occupational performance. 

  • Employment and vocational information, including employment status, occupation, job demands, sickness absence, workplace difficulties, Occupational Health information, reasonable adjustments and return-to-work planning. 

  • Assessment information, including Occupational Therapy assessment findings, observations, outcome measures, clinical reasoning, recommendations and reports. 

  • Risk and safeguarding information, where relevant to safe and appropriate Occupational Therapy practice. 

  • Communication and correspondence, including relevant emails, telephone discussions, professional liaison and records of communication. 

  • Financial and commissioning information, including quotations, invoices, purchase orders, funding approval and commissioner details. 

  • Website and technical information, which may include IP address, browser/device information, cookie information and information about how our website is used. 

  • Health information and some other information we process may be classed as special-category personal data under UK data-protection law.

​

4. Where we obtain information from 

We may receive information directly from you. 

Where you are referred to Serenity by another person or organisation, we may initially receive information from: 

  • a Case Manager or rehabilitation professional; 

  • an insurer or solicitor; 

  • your employer, HR department or Occupational Health provider; 

  • a GP, consultant or other healthcare professional; 

  • another rehabilitation professional; 

  • a family member, carer or authorised representative; or 

  • another organisation involved in your care, rehabilitation or funding, where appropriate. 

We may also receive reports or records created by other professionals where these are relevant to our involvement. 

We may also obtain professional contact information from publicly available business sources, including company websites, professional directories and professional networking platforms, where it is appropriate to contact individuals in their professional capacity. 

Where we obtain personal information from someone other than you, we will normally provide or make this Privacy Notice available to you when we first communicate with you and within the timescales required by data-protection law, unless an applicable exemption means we are not required to do so. The ICO generally requires privacy information obtained indirectly to be provided within a reasonable period and no later than one month, or earlier when first contacting or disclosing information about the person. 

 

5. Why we use personal information 

We may use personal information to: 

  • respond to enquiries; 

  • assess whether a referral is appropriate for Serenity Occupational Therapy; 

  • arrange and provide Occupational Therapy assessments; 

  • provide Occupational Therapy intervention and rehabilitation; 

  • undertake functional, cognitive, sensory, vocational or workplace assessment where appropriate; 

  • plan and review rehabilitation; 

  • produce clinical, functional or vocational reports; 

  • make recommendations regarding support, rehabilitation, workplace adjustments or return to work; 

  • communicate with clients and relevant professionals; 

  • coordinate with Case Managers and rehabilitation teams; 

  • manage consent, risk and safeguarding matters; 

  • maintain accurate clinical records; 

  • manage appointments and administration; 

  • provide quotations and manage funding authority; 

  • issue invoices and maintain financial records; 

  • meet professional, regulatory, insurance and legal requirements; 

  • establish, exercise or defend legal claims where necessary; 

  • maintain the security and effective operation of our services and systems; and 

  • operate and improve our website and services. 

We only collect and use information that is relevant to the purposes for which we require it. 

 

6. Our lawful basis for using personal information 

​

Purpose: Responding to enquiries / arranging self-funded services 

Article 6 Lawful Basis we may rely on: Steps before contract / Contract 

 

Purpose: Providing services directly to a self-funded client 

Article 6 Lawful Basis we may rely on: Contract 

 

Purpose: Providing OT where a Case Manager, employer, insurer or solicitor commissions the service. 

Article 6 Lawful Basis we may rely on: Legitimate interests, because the contract may be with the commissioner rather than the person being assessed. 

 

Purpose: Clinical record keeping and safe professional practice 

Article 6 Lawful Basis we may rely on: Legitimate interests and, where a specific legal requirement applies, Legal obligation 

 

Purpose: Invoicing, accounting and tax 

Article 6 Lawful Basis we may rely on: Contract and/or Legal obligation 

 

Purpose: Managing complaints or legal disputes 

Article 6 Lawful Basis we may rely on: Legitimate interests and/or Legal obligation 

 

Purpose: Safeguarding / urgent protection 

Article 6 Lawful Basis we may rely on: Legal obligation, vital interests or legitimate interests depending on the circumstances 

 

Purpose: Website security and administration 

Article 6 Lawful Basis we may rely on: Legitimate interests 

 

Purpose: Non-essential cookies/analytics 

Article 6 Lawful Basis we may rely on: Consent where required 

 

Purpose: Direct marketing / professional outreach 

Article 6 Lawful Basis we may rely on: Legitimate interests and/or Consent, subject to PECR 

 

Our legitimate interests 

Where we rely on legitimate interests, these may include operating and administering Serenity Occupational Therapy effectively; receiving and assessing professional referrals; providing and managing commissioned Occupational Therapy services; maintaining appropriate professional and clinical records; communicating with clients, referrers and other professionals; protecting the security and integrity of our systems; managing complaints, disputes and legal claims; and promoting our services appropriately to relevant professional contacts. 

​

Where we rely on legitimate interests, we consider whether the processing is necessary and balance our interests against the rights, interests and reasonable expectations of the individuals concerned. 

 

Providing information to Serenity 

Where we ask you to provide information that is necessary to assess a referral, enter into or perform a contract, or provide Occupational Therapy safely and appropriately, you are not generally under a statutory obligation to provide it.  However, if relevant information is not provided, we may be unable to accept a referral, complete an assessment or provide the requested service. 

 

Where we rely on consent 

Where Serenity relies on your consent to process personal information, you may withdraw that consent at any time. You can do this by contacting info@serenityoccupationaltherapy.co.uk or, where applicable, by using the relevant unsubscribe or cookie-preference controls provided to you. 

​

Withdrawing consent does not affect the lawfulness of any processing carried out before consent was withdrawn. 

 

7. Health and other special-category information 

Health information is classed as special-category personal data and receives additional protection under UK data-protection legislation. 

Where Serenity processes health or other special-category information for Occupational Therapy assessment, treatment, rehabilitation, occupational health or related professional purposes, we will identify an appropriate Article 9 condition in addition to an Article 6 lawful basis. 

This may include processing necessary for: 

  • the provision of health care or treatment; 

  • occupational medicine; 

  • assessment of an individual's working capacity; 

  • management of health or social-care services; or 

  • establishing, exercising or defending legal claims where applicable. 

Article 9(2)(h) specifically permits processing necessary for occupational medicine, assessment of working capacity and provision of health or social care where the legal safeguards are met, including processing under the responsibility of an appropriately bound health professional. 

​

Where processing of special-category information is necessary to establish, exercise or defend legal claims, Serenity may rely on Article 9(2)(f) of the UK GDPR. 

​

Serenity Occupational Therapy's clinical services are delivered by registered healthcare professionals subject to professional confidentiality obligations. 

 

8. Case-management and professional referrals 

Where a Case Manager or another professional refers you to Serenity, they may provide us with information before we have spoken to you directly. 

​

This may include your contact details, relevant health information, circumstances surrounding an accident or injury, rehabilitation information, functional difficulties and the reasons Occupational Therapy input is being requested. 

​

Case Managers may submit referral information using our Microsoft Forms referral system and may securely upload supporting reports or documentation through a restricted Microsoft SharePoint folder created specifically for the referral. 

​

External access to secure upload folders is intended to be temporary and is removed when it is no longer required. 

​

If the referral is accepted, relevant information required for continuing clinical care is transferred into your formal Serenity clinical record in Qunote. 

​

The SharePoint referral area is used for referral intake and commissioning administration and is not intended to operate as a separate permanent clinical record. 

 

9. Employer, HR and Occupational Health referrals 

Where an employer, HR professional or Occupational Health provider commissions Serenity to provide an assessment or rehabilitation service, we may receive information about your employment and the reasons for referral. 

​

We will only seek and process information relevant to the Occupational Therapy service being provided. 

​

Before sharing an Occupational Therapy report or recommendations with an employer or commissioning organisation, we will consider the purpose of the referral, the agreed scope of information sharing, relevant confidentiality requirements and any applicable consent arrangements. 

​

The fact that an employer is funding a service does not mean that they are automatically entitled to unrestricted access to your clinical information. 

 

10. GP and healthcare-professional referrals 

Where you are referred by a GP, consultant or other healthcare professional, Serenity may receive relevant medical, functional or rehabilitation information to allow us to understand the referral and provide appropriate Occupational Therapy services. 

​

Where clinically appropriate and authorised, we may communicate relevant findings or recommendations back to the referring professional or other professionals involved in your care. 

 

11. How we store clinical and referral information 

Serenity uses Qunote as its primary clinical-record system for accepted clients and Microsoft 365 services, including Outlook, Forms and SharePoint, for referral administration, secure document exchange and business communications. Further information about data location and international processing is provided in the International Transfers section below. 

 

12. Who we may share information with 

We do not sell personal information. 

​

Where necessary and appropriate, information may be shared with: 

  • you; 

  • your Case Manager; 

  • healthcare or rehabilitation professionals involved in your care; 

  • your GP or consultant; 

  • an insurer, solicitor or funding organisation where relevant and appropriately authorised; 

  • an employer, HR or Occupational Health professional where this forms part of the agreed service and information-sharing arrangements; 

  • family members, carers or authorised representatives where appropriate; 

  • service providers that process information on Serenity's behalf; 

  • professional advisers; 

  • regulatory or professional bodies; 

  • safeguarding authorities where necessary; or 

  • courts, law-enforcement bodies or other organisations where disclosure is required or permitted by law. 

We aim to share only the information necessary for the particular purpose. 

Where another organisation acts as a data processor for Serenity, appropriate contractual and data-protection arrangements are required. 

Where a Case Manager, employer, insurer, solicitor, healthcare professional or other organisation determines independently why and how it processes personal information, that organisation may act as a separate data controller in relation to its own processing activities. 

 

13. Confidentiality 

Occupational Therapists are healthcare professionals and are subject to professional duties of confidentiality. 

​

Information is not ordinarily shared outside the agreed care, rehabilitation or professional process without an appropriate reason. 

​

There are, however, circumstances in which Serenity may need to share information without consent, for example where there is a legal requirement, serious safeguarding concern or other lawful basis for disclosure. 

​

Any such disclosure will be considered carefully and limited to what is necessary and proportionate. 

 

14. How long we keep information 

Serenity does not keep personal information indefinitely. 

​

Retention periods depend on the type of record, purpose for which it is held, professional requirements, contractual requirements and applicable legal obligations. 

​

We maintain an internal Data Retention Schedule setting out standard retention periods for different categories of information. 

​

Examples include different retention arrangements for: 

  • enquiries that do not progress; 

  • referrals that are declined or withdrawn; 

  • temporary secure SharePoint uploads; 

  • active and former clinical records; 

  • reports and assessments; 

  • commissioning and funding records; 

  • financial records; and 

  • governance records. 

 

Where detailed referral information has been transferred into the formal Qunote clinical record, unnecessary duplicate copies held within temporary referral systems are reviewed and removed when they are no longer needed. 

​

Where information is relevant to an ongoing complaint, legal claim, investigation or other formal matter, normal deletion may be suspended until that matter is concluded. 

​

The UK GDPR does not prescribe one universal retention period; organisations must determine and justify how long information is needed and periodically review and delete or anonymise information that is no longer required.  

​

You may contact us if you would like further information about the retention period applicable to your information. 

 

15. Security 

Serenity takes appropriate technical and organisational measures to protect personal information against unauthorised access, accidental loss, misuse, alteration or disclosure. 

​

These measures include, where appropriate: 

  • restricted user access; 

  • authenticated Microsoft 365 accounts; 

  • controlled SharePoint permissions; 

  • named-user external sharing; 

  • secure clinical record systems; 

  • removal of temporary external access; 

  • access management; 

  • secure devices and account controls; and 

  • policies and procedures governing confidential information. 

 

No electronic system can be guaranteed to be completely secure, but Serenity takes proportionate measures appropriate to the sensitivity of the information we process. 

 

16. Email and electronic communication 

Email may be used for routine communication with clients, Case Managers and other professionals. 

​

Where sensitive clinical documentation needs to be transferred, Serenity may provide a secure SharePoint upload facility or another approved secure method. 

​

We ask professional referrers to use the secure upload route where one has been provided rather than sending detailed confidential clinical documentation through standard email attachments. 

​

Individuals should also be aware that ordinary email and text messaging may carry inherent privacy risks. 

 

17. International transfers 

Serenity Occupational Therapy uses third-party technology providers to support the secure delivery and administration of its services. 

 

Microsoft 365 

Serenity Occupational Therapy uses Microsoft 365, including Outlook, Microsoft Teams, OneDrive, SharePoint and Microsoft Forms, for business communications, referral administration and secure document exchange. 

Serenity’s Microsoft 365 tenant is provisioned in the United Kingdom. Microsoft confirms that core customer data held within Serenity’s Exchange Online, Microsoft Teams, OneDrive and SharePoint services has both its current and committed data-at-rest geography in the United Kingdom. 

Microsoft Forms is subject to separate data-residency arrangements. For United Kingdom Microsoft 365 tenants, Microsoft currently stores Forms data within its European data-storage region rather than guaranteeing that Forms data is stored solely within the United Kingdom. 

Microsoft may also use authorised subprocessors and may process limited information internationally in connection with the operation, security, maintenance and support of its services. Where personal information is transferred outside the United Kingdom, appropriate safeguards are applied in accordance with UK data-protection law. These may include UK adequacy regulations or recognised contractual transfer mechanisms where required. 

 

Qunote 

Serenity Occupational Therapy uses Qunote as its primary clinical-record system for accepted clients. 

Qunote states that its core client data is stored on UK-based infrastructure, with customer-account data processed within the United Kingdom and Ireland. 

Qunote may use contracted service providers and optional integrations in providing its services. Where international access or processing takes place, Qunote states that appropriate UK data-transfer safeguards are used where required. 

Serenity periodically reviews the data-location, security and data-protection arrangements of the technology providers it uses. 

 

18. Your data-protection rights 

Depending on the circumstances and the lawful basis being relied upon, you may have rights relating to your personal information,

including: 

  • the right to be informed about how your information is used; 

  • the right of access to personal information held about you; 

  • the right to rectification of inaccurate or incomplete information; 

  • the right to erasure in certain circumstances; 

  • the right to restrict processing in certain circumstances; 

  • the right to object to certain types of processing; 

  • the right to data portability in circumstances where that right applies; and 

  • rights relating to certain forms of automated decision-making. 

 

Not every right applies in every situation. For example, a request to erase a clinical record may not apply where Serenity has an overriding professional, legal or evidential reason to retain it. 

​

The ICO confirms that rights including access and rectification apply broadly, while erasure, objection, restriction and portability depend on the circumstances and lawful basis. 

​

To exercise a data-protection right, contact: 

info@serenityoccupationaltherapy.co.uk 

We may need to confirm your identity before responding to a request. 

 

19. Right to object 

Where Serenity relies on legitimate interests as the lawful basis for processing your personal information, you have the right to object to that processing in certain circumstances. 

​

 

If you object, we will consider your particular circumstances and will stop the processing unless we can demonstrate compelling legitimate grounds for continuing that override your rights and interests, or the processing is necessary for the establishment, exercise or defence of legal claims. 

​

You have an absolute right to object at any time to the use of your personal information for direct marketing. If you object to direct marketing, we will stop using your personal information for that purpose. 

​

To object, please contact: 

info@serenityoccupationaltherapy.co.uk 

 

 

20. Automated decision-making 

Serenity does not currently use solely automated decision-making that produces legal effects or similarly significant effects on clients. 

Microsoft Forms may use branching to display different questions depending on an answer, but clinical referral and treatment decisions are made by appropriately qualified professionals. 

 

21. Website use and cookies 

When you use our website, limited technical information may be collected automatically, including information relating to your device, browser, IP address and use of the website. 

​

Cookies and similar technologies may also be used to support website operation, functionality and analytics. 

Where applicable, non-essential cookies will be managed in accordance with applicable privacy and electronic communications requirements. 

​

Further information about cookies may be provided through Serenity's cookie notice or website cookie settings. 

 

22. Website enquiries 

If you contact Serenity through the website, we may collect information including your name, contact details and the information contained in your enquiry. 

​

Website enquiry facilities should not be used to send extensive confidential clinical records where a secure referral or document-upload route has been provided. 

​

Information submitted through an enquiry will be used to respond to you and determine the appropriate next steps. 

 

23. Marketing and professional communications 

Serenity may communicate with professional contacts regarding our services where it is lawful and appropriate to do so. 

Where electronic marketing rules require consent, we will obtain it. 

​

You can ask us to stop sending marketing communications at any time. 

​

Stopping marketing communication will not prevent us from contacting you where communication is required in connection with an existing referral, service, contract or other legitimate professional matter. 

 

24. Children and young people 

Serenity's services are primarily directed towards adults unless a particular service has been agreed for a child or young person. 

​

Where Serenity processes information relating to a child or young person, additional consideration will be given to age, understanding, parental responsibility, consent, confidentiality and the individual's rights as appropriate to the circumstances. 

 

25. Changes to this Privacy Notice 

We may update this Privacy Notice from time to time to reflect changes in our services, systems, legal requirements or data-processing activities. 

​

The current version will be published on our website. 

Material changes may also be communicated directly where appropriate. 

 

26. Concerns and data-protection complaints 

If you have a concern or complaint about how Serenity Occupational Therapy has collected, used, shared, stored or otherwise handled your personal information, please contact us: 

Serenity Occupational Therapy Ltd 

Email: info@serenityoccupationaltherapy.co.uk 

Website: www.serenityoccupationaltherapy.co.uk 

 

We will acknowledge a data-protection complaint within 30 days of receiving it and will take appropriate steps to investigate and respond without undue delay. We will keep you informed where appropriate and will communicate the outcome of our investigation. 

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data-protection regulator. 

Information about making a complaint is available from the Information Commissioner's Office. 

 

27. Contact us 

For questions about this Privacy Notice, how Serenity uses personal information or to exercise a data-protection right, please contact: 

Serenity Occupational Therapy Ltd 

Email: info@serenityoccupationaltherapy.co.uk 

Website: www.serenityoccupationaltherapy.co.uk 

Privacy contact: Clinical Director 

​

Privacy Notice version 1.0 - October 2026

A PDF copy of this Privacy Notice is available to download here

bottom of page