Last updated: 4 July 2026
Data Controller
EHCPhelp is operated by Karol Slusarczyk trading as Benefits Expert, a self-employed sole trader registered with HMRC in the United Kingdom. As a sole trader, Karol Slusarczyk is the data controller for the purposes of UK GDPR.
Business address: Redditch, United Kingdom. Contact: support@ehcphelp.co.uk.
We are registered with the UK Information Commissioner's Office (ICO) under the Data Protection (Charges and Information) Regulations 2018. Our ICO registration number is ICO:00014179042. You can verify our registration on the ICO public register.
What Data We Collect
When you use our document generator, you describe your child's needs, school history, attendance and related circumstances in your own words. Your child's first name is optional: leave it blank and the documents say "my child". We deliberately never ask for your child's date of birth, home address, school name or NHS numbers - the documents use placeholders such as [DATE OF BIRTH] that you fill in yourself after download. If you purchase a pack, we also collect your email address (via Stripe) to deliver your documents.
If you choose to provide your email address in our free preview tool, we collect that email so we can send you your preview section and occasional follow-up EHCP guidance. This is entirely optional. If you use the free Refusal Letter Analyser, the letter text you paste is processed in real time and not stored; we suggest removing names before pasting. When a preview is generated we also receive a short internal notification containing your email address and the area of need you selected, but not the text you typed about your child.
Our website also automatically captures limited technical context when you submit a form: the page you were on, the website that referred you to EHCPhelp, and any tracking parameters in the URL (such as UTM tags or ad-click identifiers). This helps us understand which content and channels are useful to claimants. No browser fingerprinting, no cross-site tracking.
Children's Data
EHCPhelp is used by parents and carers, and the information you enter describes a child's health, development and educational needs. We treat this with particular care:
- You confirm before generating that you have parental responsibility for the child you describe.
- We collect the minimum identifying information: the child's first name is optional and everything else identifying (date of birth, address, school name) is never requested.
- Processing is transient: what you type is used in real time to build your documents and is not stored on our servers afterwards.
- Generated documents are sent only to the email address you provide. We keep no copy.
Special Category Data
The health and disability information you provide about your child is special category personal data under Article 9 of the UK GDPR. We process this data under Article 9(2)(a) - explicit consent, which you give by ticking the consent box before generating your documents.
You can withdraw consent at any time by emailing support@ehcphelp.co.uk. Withdrawal does not affect processing already carried out.
How We Process Your Data
Your data is sent over HTTPS to our generation system and used solely to produce your personalised documents. Your inputs are not retained or used for any further purpose, and we do not share them with anyone except the processors listed below.
Marketing Communications (Opt-In Only)
If you provided your email address in our free preview tool, we may send you occasional emails containing EHC needs assessment guidance, evidence tips and updates about our paid products. We process your email under Article 6(1)(a) of the UK GDPR - consent, which you give by entering your email address into the form (alongside the on-page notice that explains what you will receive).
We never share, sell or rent your email to anyone else. You can unsubscribe at any time by:
- Replying "unsubscribe" to any email we send you, or
- Emailing support@ehcphelp.co.uk with "unsubscribe" in the subject line.
If you have not interacted with any of our emails for 24 months, we will automatically remove your address from our list to avoid emailing inactive contacts.
Third-Party Processors
- Stripe (payment) - handles card payments; we never see card details.
- Document generation processor - a third-party service generates your personalised document text under contractual terms that require confidential handling and prohibit retention of inputs for any further use, including for training. The named provider is available on request to support@ehcphelp.co.uk.
- Zoho Mail (email) - delivers your documents and stores support correspondence.
- Vercel (hosting) - serves the website and keeps short-term request logs (typically 30 days).
- Google Analytics (optional, only with cookie consent) - usage statistics.
What We Don't Do
We do not sell your data. We do not share it with third parties for marketing. We do not use the information you enter about your child for any purpose other than producing your documents and supporting you afterwards. Email addresses you opt in to give us are used only by EHCPhelp to send you EHCP-related guidance and product updates - never passed to anyone else.
Cookies
Essential cookies keep the site working. If you choose "Accept all" on the cookie banner, Google Analytics loads. Analytics tags never load without your explicit consent. Change your preference by clearing this site's local storage.
Data Retention
Everything you enter about your child is not retained on our application servers after the documents are generated.
Generated documents are sent only to your email address - we do not BCC, archive or otherwise keep a copy on our side.
Stripe retains payment records for 7 years for UK financial regulations. Vercel request logs are typically kept for 30 days and contain no report content. Support emails you send us remain in our Zoho mailbox until you ask us to delete them.
Email addresses you opt in to give us (via the free preview) are kept until you unsubscribe, or for a maximum of 24 months from your last interaction with our emails - whichever comes first.
Your Rights Under UK GDPR
You have the right to:
- Access your personal data (Subject Access Request)
- Rectify inaccurate data
- Erase your data ("right to be forgotten")
- Restrict processing
- Port your data to another service
- Object to processing
- Withdraw consent at any time
To exercise any of these rights, email support@ehcphelp.co.uk. We will respond within one month.
Complaints
If you believe we have mishandled your data, you can complain to the Information Commissioner's Office (ICO):
Changes to This Policy
We may update this policy as the service evolves or as regulations change. Significant changes will be communicated by email to active users and announced on the homepage.