Skip to main content

{{ root_page.title }}

Privacy notice for Health Visiting and School Nursing Service


This privacy notice explains what types of personal data we may hold about you, how we collect it, how we use and who we may share information with. We are required to give you this information under data protection law.

Who we are

Achieving for Children is a community interest company created in 2014 by the Royal Borough of Kingston upon Thames and London Borough of Richmond to provide children’s services. In August 2017 the Royal Borough of Windsor and Maidenhead became co-owner of Achieving for Children.

Achieving for Children delivers children’s services and the local authority statutory responsibilities relating to children aged up to 25 years across the boroughs of Kingston, Richmond and Windsor and Maidenhead. Achieving for Children is registered as a controller with the Information Commissioner’s Office (ICO), Registration number ZA045069, and is committed to being transparent about how it collects and uses that data and to meeting its data protection obligations.

Achieving for Children’s Health Visiting Team is part of the 0-19 public health nursing service for residents in the Royal Borough of Windsor and Maidenhead. The team consists of specialist practitioners (health visitors), community nursery nurses and administrators. The community based service works alongside other professional services including General Practitioners, child development services, acute hospital and maternity services, children’s centres, early years and voluntary organisations to provide the best possible start in life for each child. In addition to the universal provision to all clients, the service also supports first-time parents and families with children who have complex needs. Health Visitors are registered nurses or midwives with a postgraduate qualification in public health and are the professional lead for the prevention and early intervention public health programme called the Healthy Child Programme for the age group of 0-5 years.

Achieving for Children’s School Nursing Team look after the health and wellbeing of children attending a state-maintained, academy, free school and private schools in the Royal Borough of Windsor and Maidenhead. The team consists of specialist practitioners (School Nurses), community staff nurses, school health screeners and administrators. School Nurses are also registered nurses with a postgraduate qualification in public health and are the professional lead for the Healthy Child Programme for the age group 5-19 years. The School Nursing Team provides confidential advice and support to children, young people and their families.

Personal data we collect

  • Name, address, email address, telephone numbers and emergency contact details
  • NHS number
  • Gender, ethnicity and religion
  • Family members, associated people and support networks
  • General Practitioner
  • Birth place and birth details
  • Birth registration
  • Physical, emotional and sexual health, weight, length or height and appearance of child and young person, as well as their activity
  • Vision and hearing at school screening
  • Observation of care provided by parents / carers
  • Nutritional information (e.g. infant feeding, weaning foods given, diet)
  • Emotional interaction between parents / carers and their children
  • Developmental milestones (using evidence and PHE approved tools)
  • Antenatal care history
  • Employment status of parents or carers / financial status (e.g. benefits accessed)
  • Housing and condition of home
  • Immunisation history (mother and child)
  • Early years attendance / school / home schooling for over 5’s
  • Past and current hospital attendance or admissions
  • Past and current medical and mental health history for child, young person and parents / carers
  • Past and current social care involvement for child, young person and parents / carers
  • Substance use in children, young person and parents / carers (e.g. smoking, alcohol, recreational drugs)
  • History of family bereavement
  • Engagement with services offered to the family

How we use your personal data

We use the personal information we collect from you about your child and your family for a range of purposes which include:

  • working in partnership with you to provide high quality health care
  • providing information and guidance to support parenting and helping families make healthy choices
  • identifying health needs and risk factors and agreeing a plan with the family to address any identified needs
  • conducting an investigation in response to a complaint or police enquiry
  • performance monitoring to help us assess the quality and standards of our services
  • improving our services

Lawful basis for processing your personal data

In all cases we will comply with the provisions and exemptions of General Data Protection Regulation (GDPR) and Data Protection Act 2018 when processing your personal and confidential information.

  • Article 6 (1)(a) – you have given us clear consent to process your personal data for specific purpose
  • Article 6(1)(c) – processing is necessary for comply with a legal obligation
  • Article 6(1)(d) – vital interests
  • Article 6(1)(e) – processing is necessary to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law

Lawful basis for processing special categories of personal data, we rely upon:

  • Article 9(2)(a) – explicit consent
  • Article 9(2)(h) – health or social care
  • Article 9(3) – the personal data is processed by a health professional as defined under section 204 (DPA)

Data Protection Act 2018(DPA): Schedule 1, (Special categories of personal data), Part 1 (Conditions relating to Health or Social Care)

This condition is met if the processing is for the provision of health care or treatment.

These articles under the GDPR and the DPA 2018 are supported by the following specific legislation:

  • Children’s Act 1989 and 2004
  • Health and Social Care Act 2012
  • Public Health Control of Disease Act 1984
  • Health Protection (Notifications) Regulations 2010
  • Working Together to Safeguarding Children 2018

Who we share your personal information with

We will only share information where it is appropriate and legal to do so. Where this is necessary, we are required to comply with all aspects of the Data Protection Act 2018.
Depending on the individual circumstances of each situation, we may have to share this information with other teams within Achieving for Children to fulfil other duties and powers to support our work.

Some of the organisations we share information with include:

  • Public Health England
  • NHS Digital (Community Services Data Set (embedded in Paris); National Child Measurement Programme)
  • NHS Child Health Information Service (CHIS) for South, Central and West Commissioning Support Unit
  • NHS and Private Maternity Units
  • Berkshire Healthcare Foundation Trust (BHFT): Children in Care (CiC); Children’s and Young People’s Integrated Therapies (CYPIT); Children and Adolescent Mental Health Services (CAMHS); Perinatal Mental Health (PIMH); Common Point of Entry for Adults (CPE)
  • NHS and Private General Practitioners
  • Schools within RBWM and outside of the borough
  • Special Schools
  • Acute Sector NHS and Private Hospitals
  • Social Care Organisations outside of RBWM
  • County Court and Lawyers when judicial review in place
  • Child Death Overview Panel (CDOP)
  • Thames Valley Police (TVP)
  • Solutions4Health Smoking Cessation
  • Local charitable organisations for donations: Foodshare; Baby Bank; The Link Foundation; Spoore Merry and Rixman Maidenhead, Lions Club; Rotary Club
  • Local charities for support: Family Friends Charity; DASH Charity (Domestic Abuse); Stillbirth & Neonatal Death Society (SANDS); Maidenhead Listening Group (for Postnatal Depression); Daisy’s Dream (Child Bereavement Support); Berkshire Autism Society, Parenting Special Children; Continence Advisory Service

How long will we keep your information

We only keep your personal data for as long as is required by law and in accordance with our retention schedule.

Keeping your personal information secure

We have appropriate security measures in place to prevent personal information from being accidentally lost or used or accessed in an unauthorised way. We limit access to your personal information to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.

Achieving for Children’s email service has been configured to Government Digital Service and we encrypt and authenticate email in transit using Transport Layer Security (TLS) and Domain-based Message Authentication, Reporting and Conformance (DMARC). We will ensure that when we send emails containing your personal information they are sent using appropriate security measures to encrypt the data in transit. This may involve the use of a third party encryption tool where appropriate.

We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

Your rights and access to information

Under data protection legislation you have the right to request access to the information that we hold about you. To request a copy of your data, please read the Individual Rights Requests page and then submit your request using your preferred method of contact.

You also have the right to:

  • object to processing of personal data that is likely to cause, or is causing, damage or distress
  • have inaccurate personal data rectified, blocked, erased or destroyed
  • prevent processing for the purpose of direct marketing object to decisions being taken by automated means
  • In certain circumstances have inaccurate personal data rectified, blocked, erased or destroyed; and
  • a right to seek redress, either through the ICO, or through the courts

The National Data Opt Out

This is the service that allows patients to opt out of their confidential patient information being used for research and planning. To find out more or to register your choice to opt out, visit

If you have any questions or concerns about the way we process personal data, or would like to discuss anything in this privacy notice, please contact our Data Protection Officer: [email protected]

If you want to make a complaint about how we handle your personal data, we ask that you give our Data Protection Officer the opportunity to respond in the first instance but you are not obliged to do this. You can make a complaint directly to the Information Commissioner’s Office at