Privacy Policy
Last updated: 13 September 2026
This Privacy Policy explains how I collect, use, store and protect personal information in my private psychotherapy practice.
I take confidentiality and data protection seriously. Clinical information is handled carefully, in line with professional obligations, UK data protection law, safeguarding duties and the ethical standards expected of an ACP-registered Child and Adolescent Psychotherapist (Association of Child Psychotherapists membership no: 5727).
Who is responsible for your data?
The data controller is:
Sagal Hassan
ACP-registered Child and Adolescent Psychotherapist
Email: info@sagalhassan.co.uk
I am registered with the Information Commissioner’s Office as a data controller.
Whose information I collect
I may collect information about:
parents and carers
children, teenagers and young adults
family members where relevant to the clinical work
referrers
schools, GPs, paediatricians, psychiatrists and other professionals involved in care
people who contact me through the website, email, telephone, booking page or payment platform
What information I collect
The information I collect may include:
names, addresses, email addresses and telephone numbers
child or young person’s name, age, date of birth and school
parent or carer contact details
reason for enquiry or referral
relevant developmental, family, school, medical and mental health history
information about neurodivergence, physical health, chronic illness, persistent symptoms, anxiety, school attendance, EBSA or other concerns
GP, school or professional contact details where relevant
appointment records, clinical notes, formulations, reports and correspondence
payment and booking information
information needed to respond to complaints, safeguarding concerns, insurance matters or legal obligations
I do not collect full card details directly. Payments are processed through a third-party provider, currently Square, which may collect and process payment information in accordance with its own privacy notice.
How I collect information
I may collect information:
when you send an enquiry through the website
when you email, call or complete a booking form
when you book or pay through Square
during parent consultation, assessment or psychotherapy
through reports, forms or correspondence you choose to share
from schools, healthcare professionals or other services, where you have agreed to this or where there is a safeguarding or legal reason to do so
from clinical records created during the work
Why I use personal information
I use personal information to:
respond to enquiries
decide whether I may be able to help
arrange appointments
provide parent consultation, assessment, psychotherapy and related clinical work
produce written summaries, reports or recommendations where agreed
liaise with schools, GPs, paediatricians, psychiatrists or other professionals where helpful and agreed
keep clinical records
manage fees, invoices and payments
meet professional, legal, insurance and safeguarding obligations
respond to complaints, concerns or requests for records
review and improve the quality of my service
Lawful basis for using your information
I process personal information under the UK GDPR where there is a lawful basis to do so. This may include:
taking steps before entering into a contract or providing a service
providing clinical services agreed with you
legitimate interests in running a safe and effective private practice
complying with legal or professional obligations
protecting vital interests where there is a serious risk of harm
consent, where consent is the most appropriate basis, for example certain forms of liaison or optional communication
Some information I hold is health information or other sensitive information. This is special category data. I process this only where there is a valid condition for doing so, including the provision of health or social care, professional confidentiality, safeguarding, legal claims, explicit consent where appropriate, or substantial public interest where required.
Children and young people’s information
Children and young people have privacy rights in relation to their own information.
Where clinically appropriate, I will explain confidentiality and privacy to children and young people in a way they can understand. The level of parent involvement will depend on the child’s age, developmental stage, capacity, risk and the nature of the work.
We agree together the scope of parent involvement in the treatment plan. This does not mean that every detail of a child’s psychotherapy is shared. I balance the child’s confidentiality with parents’ responsibilities and safeguarding needs.
Clinical supervision
As part of safe and ethical practice, I discuss my clinical work in professional supervision. This helps me think carefully about the work and maintain safe practice.
Where possible, identifying information is kept to a minimum. Supervisors are also bound by professional confidentiality.
Sharing with schools and healthcare professionals
Where helpful and agreed, I may liaise with schools, GPs, paediatricians, psychiatrists, clinical nurse specialists, physiotherapists, occupational therapists or other professionals involved in your child’s care.
This may be especially relevant where school attendance, EBSA, anxiety, neurodivergence, chronic illness, fatigue, pain or persistent physical symptoms are part of the picture.
I will only share information that is relevant and proportionate to the agreed purpose, unless there is a safeguarding or legal reason to share more.
Third-party systems
I may use third-party systems to support the running of the practice. These may include:
website hosting or website forms
email services
secure booking and payment systems, currently Square
calendar and appointment systems
accounting or invoicing software
secure storage systems
These providers may process limited personal data on my behalf or as independent controllers, depending on the service. I take reasonable steps to use providers with appropriate privacy and security arrangements.
Square payments and booking
If you book or pay through Square, Square may collect information such as your name, contact details, appointment details, payment information and transaction records.
Square processes this information in accordance with its own privacy notice and security arrangements. I do not receive your full card details.
Website analytics and external services
This website uses Framer’s built-in, cookieless analytics to understand page visits and clicks on Parent Consultation booking links. These statistics help me improve the website. A booking-link click records interest in the booking page; it does not show that an appointment or payment has been completed.
Google Analytics is optional and loads only after you select Accept analytics. It uses cookies to count broad page categories and clicks on booking links. This setup does not send health-topic page addresses, search terms, form contents or booking details to Google Analytics. Advertising personalization, Google signals and automatic form tracking are disabled. Google also processes technical information needed to provide Analytics; its privacy policy explains how it handles that information.
Your analytics choice is stored in this browser for 180 days. If you accept, Google Analytics cookies are set for up to 180 days. You can choose Cookie settings at the bottom left of any page to change your choice. Rejecting analytics stops future Google Analytics collection and removes its cookies from this website; the page refreshes if Analytics was already running. The website remains available if you reject analytics. Read Google’s privacy policy.
The Psychotherapy Assessment and Psychotherapy appointments pages include a read-only Google Calendar of available weekly psychotherapy times. Loading this calendar connects to Google, which processes technical information under its own privacy and cookie policies. No patient appointments or personal appointment details are displayed. If you follow a link to Square or another external website, that service’s own privacy and cookie policies apply. Booking details are handled separately from these website statistics.
How long I keep records
I keep records only for as long as necessary for clinical, professional, legal, safeguarding, insurance and accounting reasons.
As a general guide:
enquiries that do not lead to an appointment may be kept for up to 12 months
financial records are usually kept for 6 years for tax and accounting purposes
clinical records for children and young people are usually kept until the young person reaches 25, or 26 if they were 17 when treatment ended
records for adults or young adults may be kept for 7 years after the end of work
records may be kept longer where there are safeguarding, complaint, legal, insurance or professional reasons to do so
When records are no longer needed, they are securely deleted or destroyed.
Security
I take reasonable steps to keep personal information secure and to protect it from loss, misuse, unauthorised access, disclosure or alteration.
This includes using secure systems, password protection, appropriate storage, professional discretion and limiting access to information.
No email, website or online system can be guaranteed completely secure, so please avoid sending highly sensitive information by email unless necessary.
Your rights
You have rights under data protection law. These may include the right to:
be informed about how your information is used
access your personal data
ask for inaccurate information to be corrected
ask for information to be erased in certain circumstances
ask for processing to be restricted in certain circumstances
object to certain processing
request transfer of your information in certain circumstances
withdraw consent where processing is based on consent
These rights may not apply in every situation, especially where clinical records, safeguarding, third-party confidentiality, legal obligations or professional duties are involved.
Requests for records
You can ask to access personal information held about you or your child. Requests will be considered carefully, taking into account confidentiality, the child or young person’s rights, clinical considerations, third-party information and legal requirements.
In some circumstances, it may not be appropriate to disclose all clinical material, particularly if doing so would affect another person’s confidentiality or would be likely to cause serious harm.
Complaints about data protection
Changes to this Privacy Policy
This Privacy Policy may be updated from time to time. The date at the top of this page shows when it was last updated.