How I collect and use personal information through this website, when you get in touch, and in the course of providing psychotherapy.
01 Who I am
This website is owned and operated by Sacha Khan, a psychotherapist registered with the UK Council for Psychotherapy (UKCP), practising at Dover House Road, Putney (SW15), and the Chelsea Natural Health Clinic, and online.
For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018), I am the data controller for the personal information described in this policy.
02 What this policy covers
This policy explains how I collect and use personal information through this website, including when you contact me or make an enquiry.
If you become a client, the personal and health information involved in your therapy is handled separately and in more detail. That is covered in Section 09 and in the confidentiality and data terms I provide to clients directly.
03 The information I collect
Information you give me. When you contact me through the form on this site, by email, or by phone, I collect the details you choose to provide. This usually includes your name, email address, telephone number, your preferred way of being contacted, and the content of your message.
Please avoid including detailed personal or health information in a first message. A short note about what you are looking for is all that is needed at the enquiry stage.
Information collected automatically. When you visit the site, limited technical information may be recorded by the hosting provider, such as your IP address, device and browser type, and the pages you view. This is used to keep the site secure and running.
04 Cookies and analytics
This site does not use analytics, advertising, or tracking cookies. Any cookies set are strictly necessary for the website or the contact form to function. You can control cookies through your browser settings.
05 Why I use your information, and my lawful basis
- To respond to your enquiry and answer your questions.
- To arrange an initial consultation or appointment, if you would like one.
- To keep a record of our correspondence.
My lawful bases for this, under the UK GDPR, are legitimate interests (responding to people who contact me about my services) and, where relevant, steps taken at your request before entering into a contract for therapy.
If your message includes information about your health or wellbeing, that is “special category” data. Where you choose to share it with me in order to ask about therapy, I rely on your explicit consent, given by sending the message, and on the basis of providing health care. You can withdraw that consent and ask me to delete the information at any time.
06 Who I share it with
I do not sell your information, and I do not share it for marketing. I use a small number of trusted service providers to run the website and respond to enquiries, and they process information only on my instructions - currently Vercel (website hosting), Formspree (contact-form handling), and Microsoft (Outlook / Hotmail email).
I may also disclose information where I am required to by law, or where necessary to protect the safety of an individual.
Some of these providers are based outside the UK. Where that is the case, appropriate safeguards are in place to protect your information, as required by UK data protection law.
07 How long I keep it
I keep enquiry information only for as long as needed. If we do not go on to work together, I delete enquiry correspondence after 6 months. If you become a client, clinical records are kept in line with the retention period set out in Section 09.
08 How I keep it secure
I take appropriate measures to keep your information secure and to prevent unauthorised access. Any paper records are held in locked, secure storage; electronic information is kept on password-protected devices and accounts; and I am the only person with access to it.
09 Clinical and client information
As a psychotherapist I hold confidential records relating to clients, which may include health and other special category information (for example session notes and relevant background).
- Lawful basis: I process this information on the basis of your explicit consent and for the provision of health care and treatment.
- Confidentiality: all sessions are conducted in strictest confidence, and confidentiality is maintained unless you give consent for it to be broken, or I believe you are at risk of seriously harming yourself or others.
- Retention of client records: I keep client records for 5 years, in line with UKCP guidance, after which they are securely destroyed.
- Your rights as a client: the rights set out in Section 10 also apply, subject to any legal or professional limits.
10 Your rights
Under UK data protection law you have the right to ask for a copy of the information I hold about you, to have it corrected or deleted, to restrict or object to how I use it, to receive it in a portable format, and to withdraw consent where I rely on it. To exercise any of these, contact me using the details in Section 01. I will respond within one calendar month.
11 Complaints
If you have a concern about how your information has been handled, please contact me first so I can try to put it right. You also have the right to complain to the Information Commissioner’s Office (ICO):
12 Changes to this policy
I may update this policy from time to time. The current version is always available on this page.