Last updated: 08.05.2026
Your privacy matters to us. Here's what you need to know:
✓ We only collect your name, email, postcode area, and optionally your child’s school name - nothing else about your child
✓ Schools and services only see a total number (when it's 5+) - they cannot identify individual families
✓ Your course activity and feedback remain private and anonymous
✓ You can delete all your information at any time by emailing us
✓ We never use your information for marketing or share it commercially
✓ All data is securely encrypted and professionally protected
We understand that privacy is especially important when you’re seeking support for your child. This Privacy Policy explains how we collect, use, and protect your personal information when you access the Family Horizons course, which supports parents and carers of children experiencing emotionally-based school avoidance (EBSA) or school-related anxiety.
We are committed to protecting your privacy and using your information responsibly to provide you with the best possible support.
The Family Horizons course is delivered by EdPsychEd Ltd as part of the EBSA Horizons programme, a commissioned service to your Local Authority.
Data Controller: Your commissioning Local Authority. Your Local Authority determines the purposes and means of processing your personal data and is responsible for ensuring your data is handled lawfully.
Data Processor: EdPsychEd Ltd (Company No. 12925284). We process your personal data on behalf of and under the documented instructions of your Local Authority, in accordance with a Data Processing Agreement under Article 28 of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Registered Address: 81-83A Allerton Road, Mossley Hill, Liverpool, L18 2DA
Data Protection Officer: Jenny Dutton
Contact for privacy matters: [email protected]
We only collect the minimum information necessary to provide you with the Family Horizons course, on behalf of your Local Authority:
Registration Information
• Your name (first and last name) - We need this to personalise your course experience and communicate with you appropriately
• Email address - Essential for sending you secure course access details, progress updates, and support materials. This is your main communication channel with us
• First part of your postcode (e.g., "M1", "B15") - This helps us confirm you're associated with the correct Local Authority area. We never collect or store your full address
• School your child attends (optional) - If you choose to provide this, it helps your Local Authority link up registration numbers with corresponding schools on their dashboard. This is entirely voluntary and not required for course access
• Confirmation checkbox - A simple tick to confirm you're a parent/carer in the Local Authority area
What happens if you don't provide this information?
We can only provide course access with a name and email address. The postcode confirmation helps ensure the course content is relevant to your area, but isn't technically required for course access. The school name is entirely optional.
Absolutely crucial: What we don't collect
• Nothing about your child - we never ask for or collect any personal details about your child, including their name, age, school, specific circumstances, or any information that could identify them
• No sensitive personal information about you beyond what's listed above
• No financial information - the course is provided free of charge
• No detailed personal circumstances - we don't ask about your family situation, employment, or other personal matters
Course Usage Information (Automatically Collected)
When you use the course, we automatically collect anonymous data to help improve the experience:
• Pages you visit and time spent on each section (helps us understand which resources are most valuable)
• Course progress and completion status (allows us to see if the course structure works well)
• Which resources you access most frequently (shows us what parents find most helpful)
• Technical information such as your device type and browser (ensures the course works properly for all users)
This usage data is anonymised and cannot be traced back to you individually.
Feedback (Always Optional)
• Any written feedback you choose to provide through course forms or surveys
• This is entirely voluntary - you can benefit fully from the course without providing any feedback
• All feedback is treated as anonymous unless you specifically ask us to follow up with you
Your information is processed on behalf of your Local Authority solely to:
1. Provide you with secure course access and send important course-related communications (such as password resets or course updates)
2. Track your individual progress through the course materials so you can pick up where you left off
3. Improve the course for all families by understanding which resources are most helpful (using anonymous, aggregated data)
4. Share minimal, anonymous statistics with schools and Local Authority services to demonstrate the course is being used (see detailed explanation in "Information sharing" section below)
5. Where you have optionally provided your child’s school name, link registration numbers with corresponding schools on your Local Authority’s dashboard
6. Respond to any support requests you may have about accessing or using the course
We never use your information for marketing purposes, commercial activities, or share it with companies trying to sell you products or services.
Your Local Authority, as Data Controller, determines the legal basis for processing your personal data. For parents and carers accessing Family Horizons, processing is typically based on consent under Article 6(1)(a) of the UK GDPR. You give this consent when you voluntarily register for the course.
What this means in practice:
• You choose to register — nobody is required to
• Your consent is recorded with a timestamp when you register
• You can withdraw your consent at any time by contacting us at [email protected] or your Local Authority
• If you withdraw consent, your account will be deleted within 30 days
• Withdrawing consent does not affect the lawfulness of any processing carried out before withdrawal
Important:
You can withdraw your consent at any time. If you do, your data will be deleted and you will no longer be able to access the course. You can register again in future if you change your mind.
We believe parents deserve complete honesty about data sharing. Here's exactly what different people and organisations can see:
Schools and Local Authority Services - What They Can See
The only information shared is:
• A single number - the total count of parents/carers who have registered (e.g., "23 families have accessed Family Horizons")
• This number is only displayed when it reaches 5 or higher - below this threshold, it shows "<5" to prevent any possibility of identifying individual families
• Anonymous, aggregated usage statistics such as: the most accessed resources, average time spent per session, and completion rates for modules
What schools and services absolutely cannot see:
• Your name, email address, or any way to identify you
• Whether your family specifically has or hasn't accessed the course
• Your individual progress through the course or course completion status
• How much time you've spent on specific topics
• Any feedback or comments you provide
• Your postcode information
• When you last accessed the course
Family Horizons keeps all parent/carer details completely private from schools and Local Authority services.
Real example:
If you’re worried that your child’s school might know you’ve accessed the course - they cannot know this. They only see something like “18 families in our area have accessed Family Horizons” with no way to identify which families these are.
We work with carefully selected, professional companies that help us deliver the course securely. These are authorised by your Local Authority under the Data Processing Agreement:
• GoHighLevel (HighLevel Inc.): Platform hosting, workflows, data storage, and email delivery. Hosted in the United States (Google Cloud Platform / Amazon Web Services). DPF certified; Standard Contractual Clauses with UK Addendum; DPA executed.
• Make.com (Celonis SE): Dashboard aggregation and automation orchestration. Hosted in the EU (Czech Republic). SOC 2 Type 2 certified; GDPR compliant.
• Zapier Inc.: Automation orchestration. Hosted in the United States (AWS). SOC 2 Type 2 certified; DPA executed. Data transits through Zapier but is not stored beyond execution logs (retained 30 days).
• Cloudflare Inc.: Website security, DDoS protection, and performance optimisation. Data processed at the nearest edge location globally. Standard Contractual Clauses in place; DPA available.
• Notion Labs Inc.: Internal task management and project coordination. Hosted in the United States (AWS). DPF certified (including UK Extension); SOC 2 Type 2; ISO 27001; DPA executed.
• Google LLC (Analytics): Course usage analytics with IP anonymisation; no user IDs. DPF certified; cookie consent obtained.
These companies are bound by strict legal contracts to protect your data, can only use your information to provide their specific service, cannot use your data for their own purposes, and are regularly audited to ensure they meet security standards. Your Local Authority is notified of any intended changes to this list at least 30 days in advance.
Data We Never Share
• Individual personal details - your name, email, or personal circumstances
• Information about your child - we don't collect this, so we can't share it
• Your specific course activity - what you've looked at, when, or for how long
• Commercial sharing - we never sell or share data with marketing companies
• Unrelated purposes - your data stays within the support context only
Some of your data is processed in the United States or globally through our technical service providers. The following safeguards are in place:
• HighLevel Inc. (GoHighLevel) is certified under the EU–US Data Privacy Framework, with the UK Extension providing equivalent protection for UK–US transfers. Standard Contractual Clauses (EU 2021 SCCs) adopted for UK use with the ICO’s UK Transfer Addendum are also in place.
• Zapier Inc. is SOC 2 Type 2 certified with a DPA executed. Data transits through Zapier but is not stored beyond execution logs (retained 30 days).
• Notion Labs Inc. is certified under the EU–US Data Privacy Framework (including the UK Extension), with SCCs in place and a DPA executed.
• Cloudflare Inc. has Standard Contractual Clauses in place and a DPA available.
• Data is encrypted in transit (TLS) and at rest across all sub-processors.
EdPsychEd Ltd will not transfer personal data to any country outside the UK without appropriate safeguards in place in accordance with the Data Protection Legislation.
If you have concerns about international transfers, contact us at [email protected] before registering.
You have complete control over your personal information:
Your key rights
• Access your data - Request a copy of all information we hold about you
• Correct your data - Ask us to fix any inaccurate information
• Delete your data - Request immediate removal of all your information (you'll lose course access)
• Restrict processing - Ask us to stop using your data temporarily
• Data portability - Get your data in a format you can use elsewhere
• Object to processing - Ask us to stop using your data entirely
Your Local Authority, as Data Controller, is responsible for responding to requests to exercise your rights. EdPsychEd Ltd will assist your Local Authority in fulfilling these requests. You may contact either party to make a request.
How to use these rights
Email us at [email protected] with:
• Your name and email address
• What you'd like us to do
• Any questions you have
Our promise: We'll respond within one month (usually much faster), never charge you, and explain everything clearly. We'll never make you feel difficult for asking.
Your personal information is protected using professional-grade security measures:
• Encryption - All data is encrypted when sent and stored, making it unreadable if intercepted
• Secure hosting - Your data is stored on professional, monitored servers (AWS/Google Cloud)
• Dedicated sub-accounts - Your Local Authority’s data is logically segregated from other authorities
• Access controls - Only essential staff can access personal data, with two-factor authentication required
• Quarterly access reviews - Permissions are reviewed regularly to ensure they remain appropriate
• Staff training - All team members complete annual security and data protection training
Full details of our technical and organisational security measures are set out in the Data Processing Agreement between EdPsychEd Ltd and your Local Authority.
We keep your personal information for the duration of the Family Horizons programme and for a maximum of 3 years afterwards. This allows us to:
• Support longitudinal impact evaluation across annual cohorts
• Maintain continuity if your Local Authority renews the programme
• Meet audit and accountability requirements
Your Local Authority may request earlier deletion at any time. You can also request deletion at any time - we’ll usually complete this within 30 days, and you can register again in future if you change your mind.
After the retention period (or when you request deletion), we securely delete all your personal information. Only fully anonymised statistics from which no individual can be identified may remain (e.g., “X families completed the course” with no way to identify who).
We use a few essential cookies to make the course work and help us improve it:
• Login and progress cookies - Keep you logged in and track where you are in the course
• Security cookies - Protect your account from unauthorised access
• Google Analytics - Anonymous data about how the course is used (helps us improve it)
You can control cookies through your browser settings, but disabling them may prevent the course from working properly. We don't use marketing cookies or track you for advertising.
The Family Horizons course is designed for adults (parents and carers) only. We do not collect any information from or about children under 18. Registration requires access to an adult email account and the course content is written specifically for adult understanding.
If you have concerns about your child accessing course materials, how you share course information with your child is entirely your decision as their parent/carer.
EdPsychEd Ltd has procedures to address suspected personal data breaches:
1. Detection and reporting
2. Containment and recovery
3. Risk assessment
4. Notification to your Local Authority (as Data Controller) without undue delay, and in any event within 72 hours
5. Evaluation and response
Your Local Authority, as Data Controller, is responsible for determining whether notification to the ICO or affected individuals is required. EdPsychEd Ltd will cooperate fully with your Local Authority in the investigation, mitigation, and remediation of any breach.
We may occasionally update this privacy policy to reflect changes in our practices or legal requirements. If we make significant changes, we will notify you by email and update the "last updated" date at the top of this policy.
If you have any questions about how we handle your personal information, please contact us:
Email: [email protected]
Subject line: Privacy Query - Family Horizons
We aim to respond to all privacy queries within 48 hours during working days.
You may also contact your Local Authority’s Data Protection Officer directly. Your Local Authority, as Data Controller, is ultimately responsible for the processing of your personal data.
If you're not satisfied with our response, you can complain to the UK's data protection authority:
Information Commissioner's Office (ICO)
Website: ico.org.uk
Telephone: 0303 123 1113
We understand that seeking support for anxiety related to school can be challenging.
We are committed to:
• Using your information only to provide support - never for marketing or commercial purposes
• Protecting your privacy - schools and services cannot identify individual families
• Complete transparency - we explain what we do with your information in plain English
• Respecting your choices - you can delete your data or object to processing at any time
• Professional security - your data is protected using banking-level security measures
Thank you for trusting us with your information. We're here to support you and your family.
EdPsychEd Ltd
Company Number: 12925284
Registered in England and Wales
Registered Address: 81-83A Allerton Road, Mossley Hill, Liverpool, L18 2DA