How to make a data protection complaint

If you think Neotree has not handled your personal data properly, you can tell us. This page explains how, what we'll do, and what happens if you're not happy with our answer.

This applies to anyone whose personal data Neotree handles: parents and family members of children we have records for, healthcare workers, donors, employees, and anyone else who has been in touch with us.

What you can complain about

Any concern about how we handle your personal data, including:

• We used your data in a way you didn't expect.
• We're keeping your data when we shouldn't be.
• We won't give you access to your own data, or have given you the wrong data.
• We shared your data with somebody who shouldn't have it.
• Our systems weren't secure enough and your data was exposed.
• We aren't being clear about what we do with your data.

If your concern is about something else, such as the clinical care you received, please use the relevant complaints route at the hospital or other service involved. If you aren't sure whether your concern is about data protection or something else, write to us anyway and we'll help you work it out.

How to make a complaint

You can contact us in any of these ways:

• Email: complaints@neotree.org
• Post: Data Protection Officer, Neotree (Charity no. 1186748), 1 Blossom Yard, Fourth Floor, London E1 6RS, United Kingdom
• Through any member of Neotree staff. If you tell anyone working for Neotree, or a clinician using the Neotree system, that you want to make a complaint, they will pass it on to us.

You don't need to use a specific form or specific words. You don't need to send us evidence or prove who you are unless we can't otherwise be confident we're talking to the right person.

If somebody else is making a complaint on your behalf, we'll ask them for evidence that you have authorised them before we discuss your data with them.

What we'll do

When we receive your complaint:

• We'll confirm we've received it within five working days, and give you a reference number.
• We'll start looking into it the same day, not when we send the acknowledgement.
• We'll keep you informed about what we're doing.
• We'll write to you with our answer once we've finished.
• We'll tell you who else you can complain to if you're not satisfied with our answer.

How long it will take

We aim to give you a final answer within one month of the day we receive your complaint. If your complaint is more complex and we need longer, we'll write to you before the month is up to explain and to give you a realistic expected date. The longest we'll take is three months.

If we can answer you within five working days, we'll combine the acknowledgement and the answer into a single reply.

If you're not satisfied

If you're unhappy with our answer, you have two options.

• Ask us to look at it again. Reply to our outcome letter. Someone not previously involved will review.
• Take your complaint to the regulator. Which regulator depends on where your data is held:

You can go to a regulator at any time. You don't have to wait for our answer.

How we handle your data while we investigate

We'll only use your personal data for what's needed to handle your complaint and to demonstrate, if asked, that we handled it properly. We keep complaint records for six years from closure, then delete them or keep them in non-identifying summary form.

You can read more about how we look after your data generally in our privacy notice.

Children and young people

If you are a parent or guardian making a complaint about your child's data, please tell us in your message. We may ask you to confirm your relationship before we share information about the complaint with you.

If you are a young person making a complaint about your own data, we'll take it seriously and reply in plain language. Tell us if there is anything we can do to make the process easier for you.

Anonymous complaints

You can make a complaint anonymously. We'll look into it as far as we can. If you'd like a reply but don't want to give us your name, you can give us a contact channel that doesn't identify you, such as a temporary email address.

More information

The full policy that sits behind this page is available as a PDF.

Last reviewed: 19 June 2026.