Last updated: 9 October 2026
Data Controller
EHCPhelp is operated by Karol Slusarczyk trading as Benefits Expert, a self-employed sole trader registered with HMRC in the United Kingdom. As a sole trader, Karol Slusarczyk is the data controller for the purposes of UK GDPR.
Business address: Redditch, United Kingdom. Contact: support@ehcphelp.co.uk.
We are registered with the UK Information Commissioner's Office (ICO) under the Data Protection (Charges and Information) Regulations 2018. Our ICO registration number is ICO:00014179042. You can verify our registration on the ICO public register.
What Data We Collect
When you use our document generator, you describe your child's needs, school history, attendance and related circumstances in your own words. Your child's first name is optional: leave it blank and the documents say "my child". We deliberately never ask for your child's date of birth, home address, school name or NHS numbers - the documents use placeholders such as [DATE OF BIRTH] that you fill in yourself after download. If you purchase a pack, we also collect your email address (via Stripe) to deliver your documents.
Our free preview tool needs your email address, because we send your preview section there and keep the free preview to one per person. We collect that email so we can send you your preview section and, unless you tick "Just send my preview, no tips or offers", occasional EHCP guidance and offers. If you use the free Refusal Letter Analyser, you tick a consent box first; the letter text you paste is processed in real time and not stored, and we ask you to remove your child's name, date of birth, address and school before pasting. When a preview is generated we also receive a short internal notification containing your email address, the area of need you selected, the page you came from, your IP address and your browser, but not the text you typed about your child.
Our website also automatically captures limited technical context when you submit a form: the page you were on, the website that referred you to EHCPhelp and any tracking parameters in the URL (such as UTM tags or ad-click identifiers). This helps us understand which content and channels are useful to parents. No browser fingerprinting, no cross-site tracking.
Children's Data
EHCPhelp is used by parents and carers and by young people aged 16 to 25, and the information you enter describes a child's or young person's health, development and educational needs. We treat this with particular care:
- You confirm before generating that you are the child's parent or carer (with the agreement of whoever has parental responsibility where that is not you), the young person, someone helping the young person with their agreement, or someone acting for a young person who lacks capacity to make this decision.
- We collect the minimum identifying information: the child's first name is optional and everything else identifying (date of birth, address, school name) is never requested.
- Processing is transient: what you type is used in real time to build your documents and is not stored on our servers afterwards.
- Generated documents are sent only to the email address you provide. The email that delivers them stays in the sent folder of our business mailbox (Zoho Mail, EU data centre) so that we can resend it and deal with refunds or payment disputes. We delete it whenever you ask.
EHC Plan Content Appeal Pack and its free section F rewrite. These work from text you paste from your child's EHC plan (sections B, E, F and I), summaries of your child's reports and, for an appeal about section I, the name of the school or college you want named. EHC plans usually contain a child's full name, date of birth, address and school, so we ask you to replace your child's surname with their first name or "my child" and to leave out dates of birth, addresses and NHS numbers before pasting, and the page removes UK postcodes, email addresses and phone numbers automatically before anything is sent. This text is processed only to create your documents or your preview, in the same transient way and with the same processors as our other packs, and is not kept on our servers afterwards. The free section F rewrite needs your email address and follows the same free preview rules as the parental views preview.
Special Category Data
The health and disability information you provide about your child is special category personal data under Article 9 of the UK GDPR. We process this data under Article 9(2)(a) - explicit consent, which you give by ticking the consent box before generating your documents. Where you act for a young person who lacks capacity, or when the documents are used to appeal to the Tribunal, we also rely on Article 9(2)(f) UK GDPR (establishing, exercising or defending legal claims).
Legal bases: Article 6(1)(b) to provide the pack you bought; Article 6(1)(a) with Article 9(2)(a) for your child's information; Article 6(1)(c) for tax records.
You can withdraw consent at any time by emailing support@ehcphelp.co.uk. Withdrawal does not affect processing already carried out.
How We Process Your Data
Your data is sent over HTTPS to our generation system and used solely to produce your personalised documents. Your inputs are not retained or used for any further purpose, and we do not share them with anyone except the processors listed below.
Marketing Communications
If you gave your email address in our free preview tool, or bought a pack, we may send you occasional emails containing EHC needs assessment guidance, evidence tips and offers about our own products, sent through Zoho Campaigns. We rely on the soft opt-in under regulation 22(3) of the Privacy and Electronic Communications Regulations 2003, with Article 6(1)(f) UK GDPR (legitimate interests). It covers preview users and buyers who did not opt out: you can say no when you give your address (the "Just send my preview, no tips or offers" box on the preview, or "No thanks" at checkout). Every marketing email has an unsubscribe link.
We never share, sell or rent your email to anyone else. You can unsubscribe at any time by:
- Replying "unsubscribe" to any email we send you, or
- Emailing support@ehcphelp.co.uk with "unsubscribe" in the subject line.
If you have not interacted with any of our emails for 24 months, we will automatically remove your address from our list to avoid emailing inactive contacts.
Third-Party Processors
- Stripe (payment) - handles card payments; we never see card details.
- Document generation processor - a third-party service generates your personalised document text under contractual terms that require confidential handling. It does not use your inputs for training and deletes them within 30 days, longer only where needed to investigate misuse. The named provider is available on request to support@ehcphelp.co.uk.
- Zoho Mail (email) - delivers your documents and stores support correspondence.
- Zoho Campaigns (email newsletters) - holds the email addresses on our guidance and offers lists.
- Google Fonts - serves the fonts the pages use, so your browser connects to Google when a page loads.
- Vercel (hosting) - serves the website and keeps short-term request logs (typically 30 days).
- Upstash (database, through Vercel): holds the coded forms and counts used to keep the free preview to one per person, for 30 days at most.
- Google Analytics (optional, only with cookie consent) - usage statistics.
International transfers: some of our processors (payment, hosting, document generation and analytics) are based in the USA. Transfers rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified, or on the UK International Data Transfer Addendum in the provider's data processing terms.
What We Don't Do
We do not sell your data. We do not share it with third parties for marketing. We do not use the information you enter about your child for any purpose other than producing your documents and supporting you afterwards. Email addresses you opt in to give us are used only by EHCPhelp to send you EHCP-related guidance and product updates - never passed to anyone else.
Cookies
Essential cookies keep the site working. One of them, ehcp_fd, is set when you get your free preview: a random code with no personal details in it, signed so that it cannot be altered, which lets us limit how many free previews one browser can get. It is sent only to our own servers, cannot be read by the page and expires after 30 days. If you choose "Accept all" on the cookie banner, Google Analytics loads. Analytics tags never load without your explicit consent. You can change your choice at any time with the "Cookie settings" link at the bottom of every page, which removes the analytics cookies and shows the banner again. Analytics records the page address without the order reference.
Data Retention
Everything you enter about your child is not retained on our application servers after the documents are generated.
To keep the free preview to one per person, we keep coded forms (keyed hashes, which cannot be read back) of your email address and the area of need you chose, of your internet connection's IP address, of the random code in your browser's free preview cookie and, if your email address is not with a large email provider, of the part after the @ sign, with the time of your free preview and a count. Nothing you typed about your child is kept with them, and they are deleted automatically after 30 days at most.
In your browser: your answers and your pack are saved in this browser so you can come back. The pack is deleted after 24 hours and your answers after 7 days or when you clear them. On a shared device, use the "Clear my answers from this device" link on the form.
Generated documents are sent only to your email address and we do not BCC them anywhere. The sent email itself, which contains your documents or your free preview, remains in our business mailbox for as long as it is needed for support, refunds and payment disputes. Email support@ehcphelp.co.uk at any time and we will delete it.
Stripe retains payment records for 7 years for UK financial regulations. Vercel request logs are typically kept for 30 days and contain no document content. Support emails you send us remain in our Zoho mailbox until you ask us to delete them.
Email addresses you opt in to give us (via the free preview) are kept until you unsubscribe, or for a maximum of 24 months from your last interaction with our emails - whichever comes first.
Your Rights Under UK GDPR
You have the right to:
- Access your personal data (Subject Access Request)
- Rectify inaccurate data
- Erase your data ("right to be forgotten")
- Restrict processing
- Port your data to another service
- Object to processing
- Withdraw consent at any time
To exercise any of these rights, email support@ehcphelp.co.uk. We will respond within one month.
Complaints
If you believe we have mishandled your data, you can complain to the Information Commissioner's Office (ICO):
Changes to This Policy
We may update this policy as the service evolves or as regulations change. Significant changes will be communicated by email to active users and announced on the homepage.