Privacy Policy

Last updated: June 2026

Identify Potential is committed to protecting your privacy and handling your personal information with care. This policy explains what data I collect, why, how it is stored, and the rights you have under UK data protection law.

1. Who I am

Identify Potential is the trading name of Sally Simmons, an independent specialist assessor operating as a sole trader from a home-based practice in Nottinghamshire. For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, I am the data controller for the information I hold about you.

Contact: sally@identify-potential.co.uk · 07983 714033
I am registered with the Information Commissioner’s Office (ICO) as a data controller and pay the annual data protection fee. My registration reference is available on request.

2. The information I collect

Depending on how you interact with me, I may collect:

When you make an enquiry

Your name and contact details, and your preferred contact method
A brief description of the concern or reason you are getting in touch

Before and during an assessment

Personal details of the person being assessed (and, for a child, their parent or guardian)
Date of birth, educational and developmental history, and relevant background
Information about schooling, employment, health and any prior assessments
Responses to questionnaires and the results of standardised diagnostic tests
Notes and observations made during the assessment

Some of this is special category data — in particular, information relating to health, including a diagnosis of dyslexia, ADHD, dyspraxia or other specific learning difficulties. This data is treated with additional care and protection.

Payment

Payment is taken before your assessment. Card and bank details are handled by my payment provider; I do not store full card numbers.

3. Why I use your information, and my lawful basis

Responding to your enquiry — legitimate interests (Article 6(1)(f)), answering a request you have made.
Arranging and carrying out an assessment and writing your report — performance of a contract (Article 6(1)(b)).
Processing health and diagnostic (special category) data — your explicit consent (Article 9(2)(a)), obtained in writing before the assessment.
Meeting professional, insurance and legal obligations — legal obligation and legitimate interests (Article 6(1)(c) and (f)).

You can withdraw consent at any time by contacting me. Withdrawing consent will not affect the lawfulness of anything done beforehand, and I may need to retain certain records to meet professional or legal obligations (see Retention).

4. Children’s information

I assess children from the age of six. Where the person being assessed is under 18, I obtain consent from a parent or person with parental responsibility, and I involve the child appropriately for their age and understanding. Children’s data is held to the same high standard as all other special category data and is never used for marketing.

5. Who I share your information with

I do not sell your data, and I do not share it for marketing. I will only share your information:

With you — your completed report is provided to you (or, for a child, the parent/guardian).
With third parties you ask me to share it with, and only with your explicit consent — for example a school, university disability service (for DSA), employer, or Access to Work assessor.
With trusted service providers who process data on my behalf under written agreements — my secure email and file storage, video-call platform, and payment provider. These act as data processors and may only use your data on my instructions.
Where I am legally required to, such as a valid request from a regulator or court, or to comply with a safeguarding duty.

6. Storing your information and keeping it secure

As a home-based sole practitioner I take security seriously. Measures include encrypted, password-protected devices; reputable cloud storage with access controls; secure disposal of paper records; and physical security of any paper documents. I am the only person who routinely accesses your records.

Some providers I use (for example video calling or cloud storage) may process data outside the UK. Where that happens, I rely on providers that offer appropriate safeguards recognised under UK data protection law.

7. How long I keep your information

Enquiries that do not lead to an assessment — deleted within 12 months.
Assessment reports and supporting records — retained in line with professional good practice. For adults this is normally seven years from the date of the report. For a child, records are normally kept until their 25th birthday, reflecting the long-term value of a diagnostic report for education and DSA. You may ask me to delete your records earlier, subject to any overriding legal or professional obligation.

8. Your rights

Under UK data protection law you have the right to be informed; to request a copy of your data; to have inaccurate data corrected; to request erasure (where no overriding obligation applies); to restrict or object to certain processing; to data portability; and to withdraw consent at any time. To exercise any of these, contact me at sally@identify-potential.co.uk. I will respond within one month.

9. Cookies and the website

This website uses only the cookies necessary for it to function. If any analytics cookies are used, they are set only with your consent, and you can decline them without affecting your use of the site. The site links to external services (such as WhatsApp and Google reviews), which have their own privacy policies.

10. Complaints

If you have a concern about how I handle your data, please contact me first so I can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority, at ico.org.uk or on 0303 123 1113.

11. Changes to this policy

I may update this policy from time to time. The date at the top shows when it was last revised.