1. Who we are
EP for Schools is an online Educational Psychology service delivered by Corban Psychology Ltd.
Data controller: Corban Psychology Ltd
Service: EP for Schools
Email:
admin@corbanpsychology.com
Corban Psychology ordinarily acts as an independent data controller for professional records created through the service. The commissioning school remains responsible for the personal information it holds and for its own data-protection obligations.
2. Whose information we process
We may process personal information relating to:
- children and young people referred for online Educational Psychology involvement;
- parents, carers and other family members;
- school and multi-academy trust staff; and
- other professionals involved with the child or young person.
3. Information we may collect
The information required depends on the purpose of the work. It may include:
- names, dates of birth, contact details, school and year group;
- information about education, development, learning, communication and behaviour;
- health, disability, emotional wellbeing and family information where relevant;
- views provided by the pupil, their family and school staff;
- professional notes, questionnaires, observations and work samples;
- relevant reports and records supplied securely by the school;
- short video clips supplied for remote observation where agreed; and
- business correspondence and invoicing information.
Some of this is special category data, particularly information about health, disability, ethnicity or other sensitive matters.
4. Where information comes from
Information is normally supplied by the commissioning school and obtained during online consultation with staff, parents or carers and the pupil where appropriate. Relevant information may also be provided by other professionals where it is appropriate and lawful to do so.
5. How and why we use information
Personal information may be used to:
- consider and respond to a school’s referral questions;
- plan and deliver online Educational Psychology consultation;
- understand the pupil’s strengths, needs and circumstances;
- prepare written psychological advice and practical recommendations;
- communicate with the school, family and relevant professionals;
- maintain appropriate professional records;
- manage contracts, invoicing and administration; and
- meet professional, safeguarding, insurance and legal responsibilities.
6. Lawful bases
Under Article 6 of the UK GDPR, the lawful bases used will depend on the information and purpose. They are principally:
- legitimate interests — providing requested professional Educational Psychology services, maintaining records and managing the service;
- contract — arranging and delivering work commissioned by a school or multi-academy trust; and
- legal obligation — where information must be processed to meet a legal or regulatory requirement.
Where special category data is processed, an additional condition under Article 9 of the UK GDPR and the Data Protection Act 2018 is required. Depending on the circumstances, this may include the provision or management of health or social care by a professional subject to confidentiality, substantial public interest conditions such as safeguarding, or explicit consent where that is the appropriate condition.
Consent to a pupil taking part in Educational Psychology work is an important professional and ethical requirement. However, consent to participate and the data-protection lawful basis are not necessarily the same thing.
7. Online consultations, video and file sharing
Online meetings and secure file-transfer services are used where necessary to deliver the service. Only information reasonably required for the work should be shared.
Meetings are not routinely recorded. Short video clips supplied for observation are used only for the agreed professional purpose, are not used for publicity or training and are securely deleted when they are no longer required for the work or related professional responsibilities.
8. Sharing information
Information and reports will normally be shared with the commissioning school and with parents or carers through the arrangements agreed for the work. Information may also be shared with:
- other professionals where this is agreed, necessary and lawful;
- professional advisers, insurers or regulators where required;
- law-enforcement or safeguarding bodies where there is a legal duty or serious concern; and
- trusted providers supporting secure email, storage, videoconferencing, IT, administration or hosting.
Service providers may use personal information only as necessary to provide their contracted services. Information is not sold or used for unrelated marketing.
9. International transfers
Some technology providers may process information outside the United Kingdom. Where this happens, providers and safeguards intended to meet UK data-protection requirements are used, such as UK adequacy regulations or approved contractual safeguards.
10. Security
Appropriate technical and organisational measures are used to protect personal information. These include password-protected systems, access controls, secure information-sharing arrangements and confidential disposal. Access is limited to those who need the information for an authorised purpose.
11. How long information is kept
Personal information is retained only for as long as reasonably necessary for the purpose for which it was collected and to meet professional, safeguarding, insurance and legal responsibilities. Different records may have different retention periods. Information is securely deleted or destroyed when no longer required. Further information about the retention schedule is available on request.
12. Your rights
Depending on the circumstances, individuals may have the right to:
- be informed about how their data is used;
- request access to their personal information;
- have inaccurate information corrected;
- request erasure in certain circumstances;
- request restriction of processing;
- object to processing based on legitimate interests;
- request data portability where applicable; and
- withdraw consent where consent is the lawful basis.
Your right to object: You may object to processing based on legitimate interests by contacting admin@corbanpsychology.com. This right is not absolute, and there may be compelling legitimate or legal reasons to continue processing particular information.
Requests will normally be answered within one month. Identity may need to be confirmed before information is released. Some rights are not absolute and may not apply in every situation.
13. Website information
This website does not use advertising cookies or sell visitor information. The hosting provider may process basic technical information, such as IP address, browser type, pages requested and visit time, to operate and secure the website.
14. Questions and complaints
Questions, requests or concerns should be sent to admin@corbanpsychology.com.
You also have the right to complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint.
15. Changes to this notice
This notice may be updated when services, working practices or legal requirements change.
Last updated: 27 July 2026