1. Who We Are

Therapy with Nasreen Ali is a sole-practitioner private therapy practice. The Data Controller for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 is Nasreen Ali, operating under therapywithnasreen.co.uk.

2. What Data We Collect

• Name, date of birth, address, email address, and phone number
• GP details and emergency contact information
• Information shared during sessions (clinical notes, anonymised)
• Payment records (date and amount only — no banking or card details)
• Written correspondence by email or post

3. Legal Basis for Processing

• Contract — to deliver the agreed therapeutic service
• Legitimate Interests — to maintain clinical records and continuity of care
• Legal Obligation — where disclosure is required by law
• Vital Interests — to protect life in an emergency

4. How Data Is Stored

Clinical notes are stored securely in encrypted digital format or a locked physical file. Data is never sold or shared with third parties except where legally required or where a safeguarding duty applies.

5. Retention Period

Client records are retained for a minimum of 7 years following the end of therapy, in line with BACP guidance. Where the client was under 18, records are retained until age 25. After this period, records are securely destroyed.

6. Your Rights Under UK GDPR

• Access — request a copy of data held about you
• Rectification — request correction of inaccurate data
• Erasure — request deletion (subject to retention obligations)
• Restriction — request limitation of processing
• Objection — object to processing on legitimate interests grounds
• Portability — receive your data in a portable format

To exercise any right, contact Nasreen Ali at hello@therapywithnasreen.co.uk. You may also lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.