Child Activity Provider Privacy Policies in the UK

Running a kids club, holiday camp, tutoring group, sports class or after school club usually means collecting more sensitive information than an ordinary small business. You may hold a child's allergies, emergency contacts, collection permissions, behavioural notes, safeguarding concerns, payment records and photos, often across booking apps, spreadsheets, WhatsApp groups and paper forms.

Common mistakes include asking for more medical detail than you need, treating photo consent as a one-off tick box, keeping safeguarding notes in shared folders, or copying every parent into emails. A clear child activity provider privacy policy helps parents see what you collect, why you need it, who sees it and how long you keep it.

Good kids club data protection is not just a document on your website. It is a practical system for sign-ups, registers, emergencies, staff access, parent communications and deletion requests.

Privacy Checklist for Classes, Clubs and Camps

A child activity provider should be able to explain each category of parent and child data, its lawful basis, who can access it and when it will be deleted. That explanation should sit in your privacy policy and data retention policy, but the real test is whether your daily admin matches what the policy says.

For a UK provider, the core rules come from the UK GDPR and the Data Protection Act 2018. The Information Commissioner's Office expects organisations to be transparent, collect only what they need, keep data secure and respect privacy rights. These principles apply whether you run one Saturday art class or a multi-site holiday camp.

Your first step is to map the information you handle. A typical class, camp or club might collect:

• Parent or guardian names, email addresses, phone numbers and home addresses.
• Child names, dates of birth, school year, session choices and attendance records.
• Emergency contact details and authorised collection names.
• Medical information such as allergies, asthma, medication, disabilities, dietary needs or injury notes.
• Safeguarding and welfare records, including incidents, disclosures and concerns.
• Photos, videos, testimonials and social media permissions.
• Payment information, invoices, refunds and debt recovery notes.
• Staff notes about behaviour, learning needs, progress or participation.

Once you have that map, decide what parents should see before they book. A children's privacy policy UK parents can actually understand should answer plain questions: what details are compulsory, what details are optional, when information is shared, how to update it and who to contact about privacy.

For many providers, a layered approach works well. Your booking form can give a short privacy notice at the point of collection, with a fuller privacy policy available from the same page. Paper enrolment forms can include a short notice explaining where the full policy can be requested. If older children provide information directly, use age-appropriate wording, sometimes in a children's privacy policy, so they know what is happening to their details.

A practical privacy checklist for a child activity business, including care provider privacy considerations where relevant, includes:

• Privacy policy: Give parents clear information about collection, use, sharing, retention and rights.
• Data minimisation: Ask only for what you need for the service, safety, billing and compliance.
• Lawful basis: Record whether you rely on contract, legitimate interests, consent, legal obligation or another basis.
• Special category data: Treat health, disability and some welfare information as higher risk and apply extra controls.
• Photo permissions: Separate operational use, internal displays, marketing, website and social media use.
• Safeguarding access: Restrict sensitive records to trained staff who need to know.
• Suppliers: Check booking platforms, email tools, payment processors and cloud storage providers.
• Retention: Set sensible deletion periods for registers, medical notes, incident records and marketing consents.
• Security: Use strong passwords, role-based access, device controls, an information security policy and staff training.
• Parent requests: Have a process for access, correction, deletion and photo withdrawal requests.

That checklist should reflect how your business actually operates. A provider using a school hall, freelance coaches and an online booking platform will have different risks from a nursery-style holiday club with permanent premises and employed staff.

What Child and Parent Data Can You Collect?

You can collect child and parent data when it is genuinely needed to provide the activity, keep children safe, manage bookings or meet a legal requirement. The UK GDPR does not ban collecting children's data, but it does require a lawful basis and a fair, proportionate reason for each type of information.

For parent or guardian contact and payment information, the lawful basis may often be contract where the parent or guardian is the contracting customer. That can cover details needed to take bookings, issue service updates, process refunds and manage accounts.

For a child's own information, do not assume the contract basis applies merely because the parent booked the activity. Article 6(1)(b) applies where processing is necessary for a contract with the data subject, or for pre-contract steps requested by that data subject. If you want to rely on contract for a child under 18, be clear that the child is a party to the contract and has the necessary competence. In many kids club arrangements, another documented basis, such as legitimate interests, legal obligation or vital interests in an emergency, may be more appropriate for specific child data.

Some uses may rely on legitimate interests. For example, you may keep attendance records, manage waiting lists, improve class planning, handle complaints, prevent fraud or protect your business if a dispute arises. Legitimate interests should be balanced against the child's and parent's privacy expectations, especially because children receive additional protection under UK data protection law.

Consent is useful for optional activities, but it should not be used as a catch-all. If a parent has no real choice, or refusing would affect their child's ability to attend, consent may not be appropriate. Consent must be specific, informed and easy to withdraw. This is why photo marketing, optional newsletters and certain health declarations should be treated separately from the core booking terms.

Health information needs particular care because it is special category data. Allergies, medication, disabilities, additional support needs, seizure plans and some behavioural information may fall into this higher-risk category. You still need an Article 6 lawful basis, such as legitimate interests, legal obligation, contract where it genuinely applies, or vital interests in an emergency, plus a separate condition under Article 9 of the UK GDPR. For many private child activity providers, explicit consent from the parent or guardian is commonly used for routine health information, while vital interests may apply in a genuine emergency where someone cannot consent.

Avoid collecting broad medical history if all you need is practical safety information.

A useful question might be: does your child have any allergies, medical conditions, medication requirements, disabilities or support needs we need to know about to run the session safely?

A less helpful question is: provide full medical history. The first is purpose-led; the second is usually excessive.

Age also matters. If you offer online services directly to children, the UK GDPR has specific rules around children's consent for information society services, with the UK age set at 13. Many physical activity providers deal mainly with parents as the contracting party, but online portals, apps, digital learning content and messaging tools can bring extra considerations.

Your booking flow should distinguish between required and optional fields. Required fields might include parent contact details, child name, age group, emergency contact and essential medical needs. Optional fields might include marketing preferences, photos for promotional use or additional notes that are not necessary for attendance.

A strong after school club privacy policy also explains where information comes from. Most data may come from parents, but you might also receive information from schools, local authorities, social workers, coaches, venues or other parents. If you collect information from third parties, parents should generally be told unless doing so would create a safeguarding risk or another lawful reason applies.

Do not forget staff and volunteer data. While this article focuses on children and parents, your club may also handle DBS check information, references, emergency contacts, training records and safeguarding training evidence. Those records need their own access controls and retention rules.

Emergency Contacts, Medical Notes and Safeguarding Records

Emergency, medical and safeguarding data should be collected for safety, shared only with people who need it and kept in a way that staff can access during an incident without exposing it unnecessarily. These records are often the most sensitive part of a child activity provider's data handling.

Emergency contact information is usually essential. If a parent is unreachable after an injury, late collection or venue closure, staff need a reliable second contact. Your form should ask for the contact's name, relationship to the child and phone number. It is sensible to tell parents that they must have the emergency contact's permission to share their details with you.

Authorised collection information also has a safety function. Many providers ask parents to list named adults who may collect a child, and sometimes a password or PIN for unexpected collection arrangements. Keep this information current, visible to the right staff during sign-out and protected from casual view. A printed register left on a table may be convenient, but it can expose names, contact numbers and family arrangements to other parents.

Medical notes need a careful balance between access and confidentiality. Coaches and session leaders may need to know that a child carries an inhaler, has a nut allergy or may need extra support during transitions. They usually do not need broad family medical history or every detail of a diagnosis. Use practical summaries for session staff and keep fuller records, if needed, in a restricted location.

Medication handling creates a further recordkeeping point. If you administer medication, record what was given, when, by whom and under whose authority. Store those records securely and align them with your health and safety and safeguarding policies. Where a provider operates in a regulated childcare context, sector-specific rules may also apply.

Safeguarding records are different from ordinary incident notes. A safeguarding concern might include a disclosure, unexplained injury, worrying behaviour, allegation, neglect concern or contact from a statutory agency. These records can contain highly sensitive information about a child and family members. They should be factual, dated, restricted and handled by a designated safeguarding lead or appropriately trained senior person.

A practical safeguarding data process should cover:

• Who records a concern and what details they should include.
• Where the record is stored and who can access it.
• How concerns are escalated internally.
• When information may be shared with a school, local authority, police, health professional or safeguarding body.
• How staff avoid discussing concerns in open spaces, group chats or casual emails.
• How records are retained when a child leaves the club.

The UK GDPR allows personal data to be shared where necessary for safeguarding, child protection and vital interests, but staff should not share more than is needed. In practice, that means giving the relevant professional the information required to protect the child, not forwarding entire files unless there is a clear reason.

Incident reports also deserve structure. A bumped head form, behaviour incident, injury log or parent complaint may be needed for safety, insurance or internal review. Keep reports factual and avoid unnecessary opinions. If a coach writes that a child was difficult, that may be less useful and more privacy-invasive than recording the specific behaviour observed, what action was taken and what was communicated to the parent.

Retention periods should reflect risk and purpose. Attendance registers may be needed for a period after the session for safeguarding, billing, complaints and insurance queries. Medical notes should usually be updated regularly and removed when no longer relevant. Safeguarding records may need longer retention depending on the nature of the concern and your safeguarding policy. Set a written retention schedule instead of relying on staff memory.

One common mistake is keeping old camp spreadsheets forever because deletion feels risky. Long-term storage can create its own risk, especially if files contain historic medical details and emergency contacts. A better approach is to keep what you need for defined reasons, archive restricted records where needed and delete routine data when its purpose has passed.

Photos, Videos and Parent Communications

Photos, videos and parent messages should be managed through clear permissions, careful audience choices, secure channels and a CCTV privacy policy if cameras are used. They are often where privacy issues become visible to families, even when the underlying risk is lower than a medical or safeguarding record.

Photos can be used for different purposes, and each purpose may need a different approach. A photo on a private parent update app is not the same as a photo on your public Instagram page. A video used for staff training is not the same as an advertisement for next year's summer camp.

Your photo permission process should separate common uses, such as:

• Photos taken for internal records, attendance confirmation or incident investigation.
• Photos shared privately with the child's parent or guardian.
• Group photos shared with parents of children in the same session.
• Images used on a private club noticeboard or end-of-term presentation.
• Images used on your website, brochures, paid adverts or public social media.
• Videos used for coaching feedback, training or marketing.

For public marketing, consent is usually the safest route. Give parents enough detail to decide, including where images may appear, whether names will be used and how they can withdraw consent. Do not bundle photo marketing consent into your general terms and conditions. A parent should be able to say no to public photos without losing the booking.

Withdrawal of photo consent can be tricky once material has already been printed, shared or posted. Your policy should explain what you can reasonably remove going forward and any limits for materials already circulated. For digital channels, keep a record of consent status and act quickly when a withdrawal request is received.

Group photos need extra care because one child's parent may consent while another does not. Staff should have a practical system, such as session lists showing photo permissions, coloured wristbands used discreetly, or a pre-photo check by the activity lead. Avoid systems that embarrass or single out children.

Parent communications create another set of privacy risks. Email updates, SMS reminders, WhatsApp groups, class apps and newsletter platforms can all disclose personal information if used casually. Copying parents into a group email rather than using blind copy can reveal email addresses. Posting medical updates in a group chat can disclose health information. Sharing collection changes in a volunteer chat can reveal family arrangements.

Choose channels based on sensitivity. Routine reminders about kit, timings or venue changes can go through your usual messaging tool. Individual medical, behavioural, safeguarding, payment or complaint matters should go directly to the relevant parent or guardian through a more private channel.

Marketing messages may trigger additional rules under the Privacy and Electronic Communications Regulations. If you send promotional emails or texts about future camps, discounts or new classes, make sure your sign-up process records the right consent or other lawful route for direct marketing, and make it easy to opt out.

Suppliers matter here too. Booking platforms, payment processors, email providers, cloud storage tools and parent communication apps may process personal data on your behalf. You should know where data is stored, what security measures apply, whether data may be transferred outside the UK, and whether there is a suitable contract in place. For a small provider, this can be as simple as keeping a supplier list and reviewing privacy and security settings before launch.

Security does not need to be complicated, but it must be deliberate. Use individual staff logins rather than shared passwords, remove access when staff leave, enable multi-factor authentication where possible, lock devices used at sessions and avoid storing sensitive data on personal phones. If freelance instructors need session information, give them only what they need for that session.

Staff training is often the difference between a good policy and good practice. Everyone who handles children or parent data should know what to do if a parent asks for a copy of records, a phone is lost, an email goes to the wrong person, or a safeguarding note is received. Some personal data breaches must be reported to the ICO, and serious incidents may also require communication with affected individuals. A simple incident log and escalation process helps you respond promptly.

FAQs

Do I Need a Privacy Policy for a Small Kids Club?

Yes, if you collect personal data from parents, children, staff or volunteers, you should provide clear privacy information. A small club does not need legalistic wording, but it does need to explain what data is collected, why it is used, who it is shared with, how long it is kept and what rights people have.

Can I Collect Children's Medical Information on My Booking Form?

Yes, where the information is needed to run the activity safely. Ask targeted questions about allergies, medication, disabilities and support needs rather than requesting full medical history. Treat health information as special category data and keep access limited to staff who need it.

Can Parents Ask Me to Delete Their Child's Data?

Parents can ask for deletion, but you may not always have to delete everything immediately. You may need to keep some records for safeguarding, legal, insurance, accounting or complaint-handling reasons. Your response should explain what will be deleted, what must be kept and why.

Do I Need Consent to Use Photos of Children?

For public marketing, website images and social media, clear parental consent is usually the safest approach. Internal operational photos may have a different basis, but you should still tell parents what you do and avoid using images in ways they would not reasonably expect.

What Should an After School Club Privacy Policy Include?

An after school club privacy policy should cover parent and child contact details, emergency contacts, medical information, attendance records, safeguarding notes, photos, payment data, parent communications, suppliers, retention periods and privacy rights.

Key Takeaways

• A child activity provider privacy policy should match real operations, including booking forms, registers, photos, emergency processes and parent communications.
• Medical notes, disabilities, allergies and safeguarding records need tighter access controls because they can involve special category or highly sensitive information.
• Photo permissions should be separated by use, especially for public marketing, website content and social media.
• Emergency contacts and collection permissions are legitimate safety tools, but they should be kept accurate, secure and visible only to staff who need them.
• Booking platforms, messaging apps, payment providers and freelance instructors should be included in your data protection process.
• Retention rules help you avoid keeping old camp spreadsheets, medical forms and incident records for longer than necessary.

If you run classes, camps or clubs for children and need help with your privacy policy, booking terms, photo consent wording or data handling processes, Sprintlaw UK's legal team can help. Contact us on 08081347754 or team@sprintlaw.co.uk for a free, no-obligations chat.