Privacy Policy

Last updated: May 2026

This Privacy Policy explains how I collect, use, store and protect personal information in my private psychotherapy practice.

I take confidentiality and data protection seriously. Clinical information is handled carefully, in line with professional obligations, UK data protection law, safeguarding duties and the ethical standards expected of an ACP-registered Child and Adolescent Psychotherapist (Association of Child Psychotherapy membership no: 5727).

Who is responsible for your data?

The data controller is:

Sagal Hassan
ACP-registered Child and Adolescent Psychotherapist
Email: info@sagalhassan.co.uk

I am registered with the Information Commissioner’s Office as a data controller.

Whose information I collect

I may collect information about:

• parents and carers

• children, teenagers and young adults

• family members where relevant to the clinical work

• referrers

• schools, GPs, paediatricians, psychiatrists and other professionals involved in care

• people who contact me through the website, email, telephone, booking page or payment platform

What information I collect

The information I collect may include:

• names, addresses, email addresses and telephone numbers

• child or young person’s name, age, date of birth and school

• parent or carer contact details

• reason for enquiry or referral

• relevant developmental, family, school, medical and mental health history

• information about neurodivergence, physical health, chronic illness, persistent symptoms, anxiety, school attendance, EBSA or other concerns

• GP, school or professional contact details where relevant

• appointment records, clinical notes, formulations, reports and correspondence

• payment and booking information

• information needed to respond to complaints, safeguarding concerns, insurance matters or legal obligations

I do not collect full card details directly. Payments are processed through a third-party provider, currently Square, which may collect and process payment information in accordance with its own privacy notice.

How I collect information

I may collect information:

• when you send an enquiry through the website

• when you email, call or complete a booking form

• when you book or pay through Square

• during parent consultation, assessment or psychotherapy

• through reports, forms or correspondence you choose to share

• from schools, healthcare professionals or other services, where you have agreed to this or where there is a safeguarding or legal reason to do so

• from clinical records created during the work

Why I use personal information

I use personal information to:

• respond to enquiries

• decide whether I may be able to help

• arrange appointments

• provide parent consultation, assessment, psychotherapy and related clinical work

• produce written summaries, reports or recommendations where agreed

• liaise with schools, GPs, paediatricians, psychiatrists or other professionals where helpful and agreed

• keep clinical records

• manage fees, invoices and payments

• meet professional, legal, insurance and safeguarding obligations

• respond to complaints, concerns or requests for records

• review and improve the quality of my service

Lawful basis for using your information

I process personal information under the UK GDPR where there is a lawful basis to do so. This may include:

• taking steps before entering into a contract or providing a service

• providing clinical services agreed with you

• legitimate interests in running a safe and effective private practice

• complying with legal or professional obligations

• protecting vital interests where there is a serious risk of harm

• consent, where consent is the most appropriate basis, for example certain forms of liaison or optional communication

Some information I hold is health information or other sensitive information. This is special category data. I process this only where there is a valid condition for doing so, including the provision of health or social care, professional confidentiality, safeguarding, legal claims, explicit consent where appropriate, or substantial public interest where required.

Children and young people’s information

Children and young people have privacy rights in relation to their own information.

Where clinically appropriate, I will explain confidentiality and privacy to children and young people in a way they can understand. The level of parent involvement will depend on the child’s age, developmental stage, capacity, risk and the nature of the work.

Parents and carers may be involved in the work, but this does not mean that every detail of a child’s psychotherapy is automatically shared. I balance the child’s confidentiality with parents’ responsibilities and safeguarding needs.

Confidentiality and when information may be shared

Clinical information is treated as confidential.

I may share information:

• with your consent, for example with a school, GP, paediatrician, psychiatrist or other professional

• when liaison is agreed as part of assessment or treatment

• in clinical supervision, using the minimum necessary identifying information

• with professional advisers, insurers, legal advisers or regulators if needed

• if there is a safeguarding concern, risk of serious harm, legal requirement, court order, or professional duty to disclose information

If I need to share information without consent because of risk or safeguarding concerns, I will usually try to discuss this with you first, unless doing so would increase risk or compromise safety.

Clinical supervision

As part of safe and ethical practice, I discuss my clinical work in professional supervision. This helps me think carefully about the work and maintain safe practice.

Where possible, identifying information is kept to a minimum. Supervisors are also bound by professional confidentiality.

Sharing with schools and healthcare professionals

Where helpful and agreed, I may liaise with schools, GPs, paediatricians, psychiatrists, clinical nurse specialists, physiotherapists, occupational therapists or other professionals involved in your child’s care.

This may be especially relevant where school attendance, EBSA, anxiety, neurodivergence, chronic illness, fatigue, pain or persistent physical symptoms are part of the picture.

I will only share information that is relevant and proportionate to the agreed purpose, unless there is a safeguarding or legal reason to share more.

Third-party systems

I may use third-party systems to support the running of the practice. These may include:

• website hosting or website forms

• email services

• secure booking and payment systems, currently Square

• calendar and appointment systems

• accounting or invoicing software

• secure storage systems

These providers may process limited personal data on my behalf or as independent controllers, depending on the service. I take reasonable steps to use providers with appropriate privacy and security arrangements.

Square payments and booking

If you book or pay through Square, Square may collect information such as your name, contact details, appointment details, payment information and transaction records.

Square processes this information in accordance with its own privacy notice and security arrangements. I do not receive your full card details.

How long I keep records

I keep records only for as long as necessary for clinical, professional, legal, safeguarding, insurance and accounting reasons.

As a general guide:

• enquiries that do not lead to an appointment may be kept for up to 12 months

• financial records are usually kept for 6 years for tax and accounting purposes

• clinical records for children and young people are usually kept until the young person reaches 25, or 26 if they were 17 when treatment ended

• records for adults or young adults may be kept for 7 years after the end of work

• records may be kept longer where there are safeguarding, complaint, legal, insurance or professional reasons to do so

When records are no longer needed, they are securely deleted or destroyed.

Security

I take reasonable steps to keep personal information secure and to protect it from loss, misuse, unauthorised access, disclosure or alteration.

This includes using secure systems, password protection, appropriate storage, professional discretion and limiting access to information.

No email, website or online system can be guaranteed completely secure, so please avoid sending highly sensitive information by email unless necessary.

Your rights

You have rights under data protection law. These may include the right to:

• be informed about how your information is used

• access your personal data

• ask for inaccurate information to be corrected

• ask for information to be erased in certain circumstances

• ask for processing to be restricted in certain circumstances

• object to certain processing

• request transfer of your information in certain circumstances

• withdraw consent where processing is based on consent

These rights may not apply in every situation, especially where clinical records, safeguarding, third-party confidentiality, legal obligations or professional duties are involved.

Requests for records

You can ask to access personal information held about you or your child. Requests will be considered carefully, taking into account confidentiality, the child or young person’s rights, clinical considerations, third-party information and legal requirements.

In some circumstances, it may not be appropriate to disclose all clinical material, particularly if doing so would affect another person’s confidentiality or would be likely to cause serious harm.

Complaints about data protection

If you have questions or concerns about how your information is handled, please contact me first so I can respond.

You also have the right to contact the Information Commissioner’s Office:

Information Commissioner’s Office
Website: ico.org.uk
Telephone: 0303 123 1113

Changes to this Privacy Policy

This Privacy Policy may be updated from time to time. The date at the top of this page shows when it was last updated.