Privacy Policy

Last updated: 20 October 2026

​

​

Who we are

​

Compass Behavioural Consulting is run by Erin Moorad, a Board Certified Behaviour Analyst based in Edinburgh, Scotland. In this policy, "we", "us" and "our" mean Compass Behavioural Consulting.

​

We are the controller of your personal information. This means we decide how it is used and we are responsible for keeping it safe under UK data protection law (the UK GDPR and the Data Protection Act 2018).

​

• Email: emoorad@compassaba.com

• Phone: 07584 636299

• Post: 50 Baberton Crescent, Edinburgh EH14 5BP

• Legal status: Erin Moorad, sole trader, trading as Compass Behavioural Consulting

​

We are a small practice and are not required to appoint a Data Protection Officer. Erin Moorad is responsible for data protection, and you can contact her directly with any question about this policy.

​

What information we collect

​

We collect only what we need to provide our services, and most of it comes directly from you.

​

• People who download a free resource or join our mailing list: first name, email address, which resource you signed up for, and whether you open or click our emails. This comes from you, through a signup form on our website or landing pages.

• People who contact us: name, contact details, and anything you tell us in your message, by email, phone, social media or our website.

• Clients (parents, carers and young people): names, contact details, the child's date of birth and school, family background, and information about the child's development, behaviour, learning, wellbeing, diagnoses and progress. This comes from you, our assessments and sessions, and (only with your permission) schools and other professionals.

• Schools and other professionals we work with: name, role, workplace and contact details, from you or the client who introduced us.

• Anyone who pays us: billing name and address, invoices and payment records, and bank details if you give them to us for refunds.

​

Information about a person's health, development or diagnoses is special category data. The law gives it extra protection, and we treat it with particular care (see the next section).

​

We do not use your information for automated decision-making or profiling, and we never sell it.

​

How we use your information and why we are allowed to

​

The law requires us to have a valid reason, called a lawful basis, for each use of your information.

​

• Sending a free resource you asked for, and occasional emails with tips, resources and news about our services: consent. You can unsubscribe at any time using the link in every email.

• Replying to your enquiry: legitimate interests (responding to people who contact us).

• Assessing, planning and delivering coaching, parent coaching and group sessions, and training and supervising the people who support your child: contract (providing the services you have agreed to).

• Working with your child's school or other professionals: contract, and only with your written permission (a release of information form).

• Invoicing, taking payments, refunds and keeping accounts: contract and legal obligation (tax and accounting law).

• Recovering unpaid fees or defending a legal claim: legitimate interests, and for special category data, the establishment or defence of legal claims.

• Acting on a safeguarding concern: legal obligation or vital interests, and for special category data, the safeguarding of children and individuals at risk.

​

Health and development information. We use special category data only to provide and plan your services. Our condition for this is your explicit consent, which we ask for in writing at the start of our work together. You can withdraw it at any time, although we may then be unable to continue some services.

​

We may also share information without consent where the law allows, for example to protect a child or adult at risk of serious harm, or where the law requires it.

​

Children's information

​

Most of our work is with children and young people, so we take extra care with their information. We usually collect it from a parent or carer, and we keep only what helps us support the child.

​

In Scotland, a young person aged 12 or over is normally treated as mature enough to understand and use their own data protection rights. Where a young person is old enough, we will involve them in decisions about their information and explain things in language they can understand. A parent or carer can usually act on behalf of a younger child.

​

Our mailing list is for adults. We do not knowingly add children to it.

​

Who we share your information with

​

We keep client information confidential. We share it only:

​

• with schools, therapists and other professionals involved in your child's support, when you have given written permission

• with a home therapist or support worker you have engaged and whom we train or supervise, so they can follow the agreed programme

• in anonymised form for professional supervision, which is a standard requirement for behaviour analysts

• where the law requires or allows it, such as a safeguarding concern, a court order or a request from the police

• in court papers if we take legal action over unpaid fees, though the content of our sessions stays confidential

​

Service providers. We use a small number of trusted companies to run the practice. They act only on our instructions and must keep your information secure.

​

• Google Workspace: business email, calendar and document storage

• Zoho Books: invoicing and accounts

• Wix: our website and its contact forms

• MailerLite: our mailing list and the emails that deliver free resources

• Zoom: video calls for online sessions

​

Some of these providers store data outside the UK, including in the EU and the USA. When that happens, your information is protected by UK adequacy regulations (the UK government has confirmed the country's protections are adequate) or by approved contract terms such as the UK International Data Transfer Agreement.

​

How long we keep your information

​

We keep information only as long as we need it, then delete or securely destroy it.

​

• Mailing list details: until you unsubscribe. We may also remove people who have not opened our emails for 2 years.

• Enquiries that do not lead to working together: 12 months.

• Client records, including assessments, programmes and progress notes: 7 years after our work together ends.

• Invoices and financial records: 7 years after the end of the financial year they relate to.

• Bank details given for refunds: until the refund is paid, then deleted.

​

We may keep information for longer if it is needed for a legal claim or a safeguarding matter.

​

Your rights

​

You have the right to:

​

• access the information we hold about you and get a copy

• correct information that is wrong or incomplete

• delete your information, where we no longer have a reason to keep it

• restrict how we use your information in some circumstances

• object to us using your information on the basis of legitimate interests, and to stop marketing emails at any time

• move information you gave us to another provider, where it is held on the basis of consent or contract

• withdraw your consent at any time, where consent is our lawful basis

​

To use any of these rights, email emoorad@compassaba.com or call 07584 636299. There is usually no charge. We may ask you to confirm your identity, or that you are allowed to act on someone else's behalf. We will reply within one month. If your request is complex, this can be extended by up to two further months, and we will tell you why.

​

How to complain

​

If you are unhappy with how we have handled your information, please tell us first, by email, phone, post or any other way that suits you. We will acknowledge your complaint within 30 days, look into it promptly, keep you updated, and tell you the outcome.

​

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator:

​

• Website: ico.org.uk/make-a-complaint

• Helpline: 0303 123 1113

​

Cookies

​

Our website uses cookies. Our Cookie Policy explains what they do and how to manage them.

​

Keeping your information safe

​

We protect your information with password-protected and two-factor-secured accounts, encrypted devices, and services that meet recognised security standards. Only Erin Moorad, and anyone working under her instruction, can access client records. Paper records are kept locked away and shredded when no longer needed.

​

Changes to this policy

​

We will update this policy when our practices or the law change, and we will post the new version on this page.