Privacy Policy
About This Policy
All Kinds of Minds Assessments respects the privacy and confidentiality of the children, young people, families, and professionals who use or contribute to the service. This Privacy Policy explains what personal information is collected, why it is needed, how it is used and protected, who it may be shared with, how long it is retained, and the rights that apply under the General Data Protection Regulation (G.D.P.R.), the Data Protection Act 2018, and other applicable Irish law.
This Policy applies to private clients, people making enquiries or submitting referral information, and children and young people referred to All Kinds of Minds Assessments through an H.S.E.-commissioned assessment pathway.
Who Is Responsible for Your Personal Data?
All Kinds of Minds Assessments is the registered business name under which Shaun Frandsen operates the practice as a sole trader. For private assessments and the general administration of the practice, Shaun Frandsen, trading as All Kinds of Minds Assessments, acts as the data controller. This means that she is responsible for determining why and how personal data are processed and for protecting the data-protection rights of the people to whom those data relate.
The practice address is 1st Floor, 10 Stephen Street, Rathquarter, Sligo, F91 V2XR. Data-protection enquiries may be directed to contact@allkindsofminds.ie.
Different arrangements apply to some information processed as part of an H.S.E.-commissioned assessment. These are explained under H.S.E.-Commissioned Assessments below.
Information Collected
The information collected depends on the nature and stage of the enquiry, referral, consultation, or assessment and is limited to what is reasonably necessary for the relevant clinical, professional, contractual, administrative, or legal purpose. It may include:
identity and contact information, such as names, dates of birth, addresses, telephone numbers, and email addresses;
information required to establish legal guardianship and valid consent for an assessment;
developmental, medical, mental-health, family, sensory, communication, behavioural, and everyday-functioning information relevant to understanding the child or young person;
educational history, school information, teacher observations, questionnaires, reports, and information about educational supports;
clinical observations, interview information, responses to standardised measures, test scores, rating-scale results, professional formulations, diagnostic conclusions, and recommendations;
appointment details, correspondence, consent records, and other relevant administrative information;
payment, invoice, refund, and transaction information required to administer the service and meet financial or taxation obligations; and
limited Website information, including analytics information where the Website user has chosen to accept optional cookies.
Because an assessment concerns a child or young person within a wider developmental, family, educational, and healthcare context, relevant information may also relate to parents or legal guardians, siblings, other family members, teachers, or professionals. Information about another person is collected only where it is relevant and proportionate to understanding or providing the service.
Where Information Comes From and Why It Is Used
Most information is provided directly by the child or young person, their parent or legal guardian, or generated through the assessment itself. Relevant information may also be received from teachers and schools, G.P.s, other health or social-care professionals, previous reports or records supplied for consideration, secure questionnaire and assessment systems, or the H.S.E. where an assessment has been commissioned through an H.S.E. pathway. Information received from another source is handled with the same standards of confidentiality and data protection as information provided directly to the practice.
Personal information may be used to:
respond to enquiries and determine whether the service is appropriate;
review referral suitability and establish whether the proposed assessment falls within the practice’s scope;
establish and document valid consent for assessment;
provide a comprehensive psychological or neurodevelopmental assessment;
gather, integrate, and interpret relevant information from different sources;
administer, score, interpret, and report standardised assessment measures;
arrange appointments and communicate with children, young people, families, and relevant professionals;
prepare clinical reports, recommendations, and feedback;
support multidisciplinary assessment, professional supervision, and clinical governance;
process payments and maintain appropriate administrative and financial records;
manage complaints, risk, quality assurance, and information security;
meet H.S.E. contractual requirements where an assessment is H.S.E.-commissioned; and
meet safeguarding, taxation, data-protection, legal, and professional obligations.
Reports are prepared predominantly using professional templates authored, developed, and maintained by the Clinical Psychologist. Artificial-intelligence-assisted tools may be used on a limited and supplementary basis to assist with the research, review, organisation, or refinement of general, non-client-specific material. Client records, assessment materials, reports, correspondence, raw assessment data, and identifiable or private information concerning a child, young person, family, or other person involved in an assessment are not entered into these tools. AI-assisted tools are not used to determine assessment findings, clinical formulations, diagnostic conclusions, or individualised recommendations.
Personal information is not sold or used for unrelated commercial purposes.
Legal Bases for Processing
Different legal bases apply depending on why particular information is being processed.
For private services, ordinary personal data needed to respond to a request for assessment, establish the service agreement, and provide the agreed service are principally processed because this is necessary to take steps at the person’s request before entering into a contract or to perform that contract under Article 6(1)(b) G.D.P.R.
Some processing is required to meet legal obligations under Article 6(1)(c), including particular safeguarding, taxation, data-protection, and other statutory responsibilities. Limited processing may also be necessary under Article 6(1)(f) for the legitimate interests of securely and responsibly administering the practice, maintaining professional governance, responding to complaints, protecting information and systems, or establishing, exercising, or defending legal rights. Particular care is taken before relying on legitimate interests where a child’s personal data are involved.
Psychological and neurodevelopmental assessment involves health information and other special-category personal data. Where this information is necessary for psychological assessment, diagnosis, or the provision or management of health or social care, it is processed under the additional protections provided by Article 9(2)(h) G.D.P.R. and section 52 of the Data Protection Act 2018, together with the applicable professional duty of confidentiality. Another lawful basis may apply where particular processing is required for safeguarding, legal claims, or another specific statutory or professional purpose.
Where an assessment is commissioned by the H.S.E., the lawful basis and respective responsibilities of the H.S.E. and All Kinds of Minds Assessments depend on the particular processing activity and the applicable H.S.E. contractual and data-processing arrangements.
Consent and Psychological Assessment
Consent to participate in a psychological assessment is an important clinical and professional requirement and is managed in accordance with applicable law, professional standards, and the H.S.E. National Consent Policy where relevant. This is distinct from consent as a legal basis for processing personal data under the G.D.P.R.
All Kinds of Minds Assessments does not rely on data-protection consent as the sole basis for processing information that is necessary to provide an assessment, maintain an appropriate clinical record, or meet legal and professional responsibilities.
Consent to continue with an assessment may be withdrawn at any stage. Depending on the stage reached, this may mean that the assessment cannot continue or be completed. Withdrawal does not ordinarily require information already lawfully processed or professional records already created to be deleted.
Consent may also be requested for genuinely optional processing or disclosures. For example, where the practice is asked to send a private assessment report or other clinical information directly to a school or another professional, valid consent or another lawful basis must support that disclosure. Private reports are otherwise issued to the appropriate parent or legal guardian, or to the young person where applicable, who decides whether to share the report with another person or organisation.
Where a particular disclosure or processing activity genuinely relies on consent, that consent may be withdrawn in relation to future processing. Withdrawal does not affect processing that was lawful before consent was withdrawn.
Some information is necessary to establish valid assessment consent, determine whether the service is appropriate, conduct the assessment safely, and reach a sufficiently informed and professionally responsible clinical conclusion. If information necessary for these purposes is not available, it may not be possible to proceed with or complete the assessment.
H.S.E.-Commissioned Assessments
Where a child or young person is referred through an H.S.E.-commissioned pathway, the respective data-protection responsibilities of the H.S.E. and All Kinds of Minds Assessments are determined by the applicable H.S.E. contractual and data-processing arrangements.
Where All Kinds of Minds Assessments processes information on the documented instructions of the H.S.E., the H.S.E. acts as controller and All Kinds of Minds Assessments acts as processor for that processing. Where All Kinds of Minds Assessments independently determines why and how particular information must be processed to meet a separate professional or legal responsibility, it may act as controller for that specific activity.
H.S.E. referral and assessment information is handled through approved secure processes. Feedback and access to the final clinical report are provided to the child or young person and the appropriate parent or legal guardian in accordance with the young person’s age, legal capacity, consent, confidentiality rights, and the applicable H.S.E. arrangements.
On completion of an H.S.E.-commissioned assessment, the completed clinical report, any required Assessment of Need documentation, and other information required under the commissioned pathway are securely provided to the nominated H.S.E. recipient through the H.S.E.-designated secure transfer environment, currently ShareFile. The H.S.E. describes ShareFile as a service through which information and files can be shared securely.
Information may also be made available where necessary for contractual governance, audit, safeguarding, or quality-assurance purposes, with access and disclosure limited to what is authorised, relevant, and necessary.
Records associated with H.S.E.-commissioned work are returned, retained, or securely deleted in accordance with the applicable H.S.E. Data Processing Agreement, contractual requirements, and H.S.E. instructions, subject to any independent legal or professional obligation requiring particular information to be retained.
Sharing Information and Service Providers
Confidentiality is fundamental to psychological practice. Personal information is shared only where there is an appropriate purpose and lawful basis and is limited to what is reasonably necessary in the circumstances.
Depending on the assessment or situation, information may be shared with:
another regulated clinician contributing directly to the assessment or multidisciplinary formulation;
an appropriately qualified professional supervisor or other clinical-governance professional where this supports safe and competent practice;
the H.S.E. where an assessment has been commissioned by the H.S.E.;
a G.P., school, health professional, social-care professional, or educational professional where the practice has been asked to share relevant information and valid consent has been provided, where sharing forms part of an H.S.E.-commissioned pathway, or where another lawful basis applies;
specialist service providers supporting secure clinical-record management, appointments, electronic forms, professional communication, psychological test administration and scoring, payment processing, Website hosting, secure file transfer, and other necessary practice functions; and
Tusla, a court, another statutory authority, a professional indemnity insurer, a legal adviser, or another appropriate body where disclosure is required or permitted by law or is necessary to protect legal rights or safety.
Where a Speech and Language Therapist contributes to a multidisciplinary assessment, relevant information is made available only to the extent required for that professional work. The Clinical Psychologist remains professionally responsible for the Clinical Psychology work undertaken, and the Speech and Language Therapist remains professionally responsible for the Speech and Language Therapy work they undertake.
Where information is discussed within professional supervision or clinical governance, identifying information is minimised wherever reasonably practicable, and the professional receiving the information is subject to appropriate confidentiality obligations.
Where an external service provider processes personal information on behalf of All Kinds of Minds Assessments, appropriate data-processing, confidentiality, and security arrangements are maintained. Access is restricted to what is required to provide the relevant service, and the practice maintains and reviews an internal record of relevant processors and sub-processors.
International Transfers and Data Security
Some service providers or their sub-processors may store or access information outside the European Economic Area. Where this occurs, personal data are transferred only where an appropriate legal mechanism and safeguards are in place. These may include a European Commission adequacy decision or approved Standard Contractual Clauses, together with appropriate technical and organisational protections. Additional H.S.E. requirements apply where H.S.E.-controlled information is involved.
All Kinds of Minds Assessments uses proportionate technical and organisational safeguards appropriate to the sensitivity of psychological and health information. These include controlled access to clinical information, secure professional systems, individual accounts, multi-factor authentication, encryption, protected devices, secure methods of transferring documents, and procedures for secure retention and destruction.
Private assessment reports are provided electronically as passcode-protected P.D.F. documents. Passcode protection reduces the risk of unauthorised access if a document is intercepted or accessed unintentionally. Recipients remain responsible for taking reasonable care when storing, forwarding, printing, or otherwise sharing their copy of a report.
These security arrangements are reviewed as part of ongoing practice governance, recognising that no information-security system can eliminate every possible risk. Any suspected or confirmed personal-data breach is assessed, contained, and documented. Where All Kinds of Minds Assessments is the controller and a breach is likely to result in a risk to people’s rights and freedoms, the Data Protection Commission will be notified without undue delay and, where feasible, within 72 hours of the practice becoming aware of the breach. Where a breach is likely to result in a high risk, affected individuals will also be informed where required.
Where the H.S.E. is controller, All Kinds of Minds Assessments will notify and assist the H.S.E. in accordance with the applicable contractual and data-processing arrangements.
How Long Information Is Kept
Personal information is retained only for as long as there is an appropriate professional, contractual, legal, safeguarding, insurance, or administrative reason to keep it.
For private clinical records relating to children and young people, records are ordinarily retained in accordance with the P.S.I. Guidelines for Confidentiality and Record Keeping in Practice. Those Guidelines recommend retaining records of work with children for a minimum of seven years after the child reaches adulthood. Private clinical records will therefore ordinarily be retained until at least the young person’s 25th birthday.
Longer retention may be necessary where there is a relevant professional, safeguarding, legal, insurance, complaint, or litigation reason. In accordance with the P.S.I. guidance, records involving child-protection concerns or otherwise falling under the Child Care Acts may be retained in perpetuity.
Information submitted solely for the purpose of determining referral or assessment suitability is retained temporarily while that process is completed. Where the referral does not proceed, that information is securely deleted unless limited retention is required because a safeguarding concern, complaint, legal obligation, professional responsibility, or another documented and lawful reason applies.
Different arrangements apply to H.S.E.-commissioned assessments. Those records are returned to the H.S.E., retained, or securely deleted in accordance with the H.S.E. contract, Data Processing Agreement, and instructions applicable to the case, subject to any independent legal or professional obligation requiring particular information to be retained.
Financial and taxation records are retained for the period required by Revenue. Enquiry, administrative, temporary-platform, and other information that does not require the same clinical retention period is retained only for as long as necessary for its particular purpose and is then securely deleted in accordance with the practice’s retention schedule.
Information about the retention of Website and cookie data is available in the Cookies Policy.
Your Data-Protection Rights
Data-protection rights apply subject to the circumstances of the particular request and any lawful limitations or exemptions. These include:
Access: You may ask whether personal data concerning you are being processed and request access to those data.
Rectification: You may ask for factually inaccurate personal information to be corrected or incomplete information to be completed.
Erasure: You may request deletion where the legal conditions for erasure apply. This right is not absolute and does not ordinarily require deletion of clinical records that must legitimately be retained.
Restriction: You may request that processing be restricted in circumstances provided for by the G.D.P.R.
Data Portability: Where the legal conditions apply, you may request certain personal information that you provided in a structured, commonly used, machine-readable format.
Objection: You may object to processing based on public task or legitimate interests where the circumstances provided for by the G.D.P.R. apply.
Withdrawal of Consent: Where a particular processing activity genuinely relies on consent as its legal basis, you may withdraw that consent at any time. This does not affect processing that was lawful before consent was withdrawn.
Automated Decision-Making: You have rights concerning decisions based solely on automated processing, including profiling, where those decisions produce legal or similarly significant effects. All Kinds of Minds Assessments does not use solely automated processing or profiling to make such decisions about a child or young person.
Requests will normally be responded to within one month, subject to the extensions permitted by the G.D.P.R. for particularly complex or numerous requests. Appropriate evidence of identity, guardianship, or authority to act for another person may be requested where this is necessary to protect confidentiality.
Where the H.S.E. is controller for the information concerned, All Kinds of Minds Assessments will assist in directing or coordinating the request appropriately.
Further information is available from the Data Protection Commission under Rights of Individuals under the G.D.P.R..
Children’s and Young People’s Information
Personal information about a child or young person remains their personal data. It does not become the personal data of a parent or legal guardian because the adult provided some of the information, arranged or paid for the service, or consented to the assessment.
A legal guardian may exercise data-protection rights on a child’s behalf where they have appropriate legal authority and doing so is consistent with the child’s rights and best interests. This does not create an automatic entitlement to every item of information held about the child.
When responding to a request involving a child’s information, consideration will be given to the child’s age, maturity, and capacity, their confidentiality and best interests, the circumstances in which the information was obtained, and the rights and freedoms of other people.
Depending on their age, maturity, and capacity, an older child or adolescent may be able to exercise their data-protection rights directly. A young person aged 16 or 17 who has consented to their own assessment will ordinarily be able to exercise the data-protection rights relating to that professional record directly, subject to the circumstances of the request and applicable law.
Assessment Records, Clinical Opinions, and Test Materials
Psychological assessment records contain both factual information and professional clinical judgement. Straightforward factual inaccuracies, such as an incorrect name, date, school, score, or other objectively verifiable detail, can be corrected.
A clinical formulation, professional opinion, or diagnostic conclusion is different. It records the professional judgement reached at a particular point in time on the basis of the information then available. A later difference of professional opinion, additional information, developmental change, or a later change in diagnostic understanding does not, in itself, make the original clinical record inaccurate. Where appropriate, subsequent information or an alternative perspective may instead be added to the record so that later developments are documented accurately.
The Data Protection Commission provides further guidance on the distinction between factual correction and professional clinical opinion under amendment or erasure of medical records.
All Kinds of Minds Assessments reports include all standardised scores and clinically relevant results arising from the assessment, together with explanation and interpretation of what those results mean within the assessment as a whole. The child, young person, and appropriate parent or legal guardian therefore receive the principal derived assessment data through the final report.
Some psychological assessment materials are copyrighted, proprietary, and subject to strict test-security requirements. These include test forms, item booklets, response forms, stimulus materials, scoring keys, algorithms, and other publisher-owned assessment materials. Copies of these materials are not provided to children, young people, parents or legal guardians, schools, or other third parties. Unrestricted reproduction could infringe intellectual-property rights and compromise the integrity, validity, and future use of standardised psychological tests.
This does not remove a person’s right to access the personal data about them contained within the assessment record. Where relevant personal data are contained within copyrighted or secure test materials, those data may be summarised or otherwise provided in an appropriate form rather than by supplying a copy of the original test material. The rights and freedoms of the assessment publisher, other people, and other affected parties will be considered where applicable.
All Kinds of Minds Assessments does not determine whether a child or young person meets criteria for a neurodevelopmental diagnosis on the basis of any single test, questionnaire, score, algorithm, or automated output. Digital systems may administer measures or calculate and present standardised scores, but diagnostic conclusions are reached by the Clinical Psychologist, or the clinicians contributing to a multidisciplinary assessment, through professional integration and interpretation of the assessment evidence as a whole.
Safeguarding and Other Required Disclosures
The Clinical Psychologist and the Speech and Language Therapist undertaking relevant assessment work through All Kinds of Minds Assessments are Mandated Persons under the Children First Act 2015.
Each Mandated Person has an individual statutory responsibility to make a report to Tusla where they know, believe, or have reasonable grounds to suspect that a child has been harmed, is being harmed, or is at risk of being harmed to the threshold established by the Act. The Act also applies to relevant direct disclosures made by a child and permits Tusla to request proportionate information and assistance from a Mandated Person when assessing a concern that has been the subject of a mandated report.
A child-welfare or protection concern that does not meet the statutory threshold for a mandated report may nevertheless be reported where appropriate in accordance with Children First: National Guidance for the Protection and Welfare of Children and the practice’s safeguarding procedures.
Information may also be disclosed without consent where another legal obligation applies, where disclosure is required by a court or competent statutory authority, or where it is otherwise lawful and necessary to respond to a serious risk to the safety or welfare of the child, young person, or another person. Any disclosure will be limited, as far as reasonably practicable, to information that is relevant and necessary for the applicable purpose.
Where possible and appropriate, the people concerned will be informed about a safeguarding or other required disclosure. This may not be appropriate where doing so could increase risk, prejudice a safeguarding process, expose another person to risk, or otherwise conflict with the protective purpose of the disclosure.
Contact and the Data Protection Commission
Questions about this Privacy Policy or requests concerning personal data may be directed to contact@allkindsofminds.ie.
If you are dissatisfied with how your personal information has been handled, you have the right to raise a concern or lodge a complaint with the Data Protection Commission, Ireland’s independent data-protection supervisory authority. You are welcome to contact All Kinds of Minds Assessments first so that the concern can be considered and, where possible, resolved, but doing so does not affect your right to contact the Data Protection Commission directly.
This Privacy Policy may be updated where the service, professional guidance, technology, contractual arrangements, or applicable legal or regulatory requirements change. The date of the most recent review is shown below.
Effective Date: 22 September 2023
Last Reviewed: 1 September 2026