Last updated: 20/10/2026

This notice explains what information I collect about you, why I collect it, how I look after it, and the choices you have. I have tried to keep it in plain English. If anything is unclear, please ask me.

I am registered with the British Association for Counselling and Psychotherapists, and I am the ‘data controller’ for the information described in this notice, which means I am responsible for looking after it.

You can contact me about anything in this notice at: contact@saadmaliktherapy.co.uk.

I am registered with the Information Commissioner’s Office (ICO), registration number: ZB505712.

What information I collect

Depending on how we work together, I may hold:

• Your contact details (name, date of birth, email address, phone number, GP contact details, and emergency contact details)

• Information you share with me in sessions on my session notes

• Information from your initial enquiry or assessment

• Payment and invoicing records

• Basic technical information if you use my website, such as cookies and analytics data

Why I collect it, and the legal basis

I use your information to provide therapy to you, to keep the records that safe and ethical practice requires, to manage appointments and payments, and to meet my legal and insurance obligations.

UK data protection law requires me to have a lawful basis for this. In most cases that is the agreement between us (through our therapy contract), my legitimate interest in running my practice responsibly, or a legal obligation.

Some of what you share with me is information about your health. The law treats this as "special category data" and requires an extra condition to use it. I rely on the condition that covers the provision of health and care by a professional who owes a duty of confidentiality. Where I need your consent for something specific, I will ask for it clearly and you can withdraw it at any time.

Digital tools and AI

I use the following digital tools to run my practice: zoom: a video platform for online sessions.

No client information is entered into AI tools.

Who I share it with

What you share with me stays confidential, with a small number of exceptions that are standard in therapy. I discuss my work in clinical supervision, without details that identify you. I may need to share information if the law requires it, or if I believe you or someone else is at serious risk of harm. Wherever possible I would talk to you first. A trusted holds secure instructions so clients can be contacted if I am suddenly unable to practice. My accountant sees invoicing records, which contain minimal personal information.

I never sell your information, and I never share it for marketing.

How long I keep it

The client’s personal information and process notes will be stored securely for the duration of the therapeutic work undertaken and up to three years thereafter, in line with the Data Protection Act 2018, BACP Professional Conduct Procedure, when they will be destroyed. Payment records are kept for five years, as tax law requires.

How I keep it safe

Session notes are stored in a password protected spreadsheet. My devices are password-protected and backed up securely. I send emails via outlook, and I avoid sending any sensitive detail by email, where possible.

Your rights

You have rights over your information, including the right to ask for a copy of it, to have mistakes corrected, to ask me to delete it, to object to or restrict how I use it, and to withdraw any consent you have given. Some of these rights have limits, for example where I am required to keep records, but if you ask I will always explain what I can do.

To use any of these rights, contact me at contact@saadmaliktherapy.co.uk. I will respond within one month.

Complaints

If you are unhappy with how I have handled your information, please tell me first and I will do my best to put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

Changes to this notice

I review this notice at least once a year and whenever I change how my practice handles information. The date at the top tells you when it was last updated.