Legal

Privacy Policy

Last updated: July 2026

This privacy policy explains how Isha Sheikh, trading as ISTherapy ("I", "me", "my"), collects and uses your personal information when you contact me or work with me as a client. Your privacy matters to me, and I handle your information in line with the UK GDPR, the Data Protection Act 2018, and the ethical guidance of the British Association for Counselling and Psychotherapy (BACP).

1. Who is responsible for your data

The data controller is Isha Sheikh (ISTherapy). You can reach me at hello@istherapy.co.uk.

Placeholder: ICO registration: ZAXXXXXX — registration with the Information Commissioner's Office is pending and this number will be updated once confirmed.

2. What information I collect

Enquiry details — when you use the contact form or email me: your name, email address, the reason for contact, and anything you choose to include in your message.
Client records — if we begin working together: contact details, brief session notes, and relevant information needed to provide therapy safely. Notes about your therapy are treated as special category data and handled with particular care.
Website data — this site does not use tracking or advertising cookies. Standard technical data (such as your IP address) may be processed by my hosting and security providers to keep the site running securely.

3. Why I process your data, and the lawful basis

To respond to your enquiry — lawful basis: legitimate interest (responding to someone who has contacted me).
To provide therapy — lawful basis: contract, and for health-related notes, processing for the provision of health/social care (Article 9(2)(h) UK GDPR).
To meet legal and professional obligations — lawful basis: legal obligation and legitimate interest (e.g. safeguarding, insurance, complying with my professional body).

4. How long I keep your data

Enquiries that do not become clients are kept for a short period and then deleted. Client records are retained for a period consistent with professional and insurance guidance — typically up to 7 years after therapy ends — and then securely destroyed.

5. Who else has access

I keep your data confidential and only share it where necessary. Third parties that may process limited data on my behalf include:

Web3Forms — processes contact-form submissions and delivers them to my inbox.
Amazon Web Services (S3) and Cloudflare — host and secure this website.
Google Fonts — serves the fonts used on this site.
My email provider — used to correspond with you.
My clinical supervisor — I discuss my work in supervision, but in an anonymised way that does not identify you.

I will only share identifiable information more widely where I am legally required to, or where there is a serious risk to your safety or that of others (see below).

6. Confidentiality and its limits

What you share in therapy is confidential. There are rare exceptions where I may need to share information, ideally with your knowledge:

If there is a serious risk of harm to you or another person.
Where safeguarding concerns involve a child or vulnerable adult.
Where I am required to disclose by law or a court order.

7. Your rights

Under UK GDPR you have the right to access, correct, erase, restrict, port, or object to the processing of your personal data. To exercise any of these rights, contact me at hello@istherapy.co.uk.

8. How to complain

If you have concerns about how I handle your data, please contact me first so I can put things right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or by calling 0303 123 1113.

9. Changes to this policy

I may update this policy from time to time. Any changes will be posted on this page with a revised date.