Privacy Policy

Think Forward Health is a psychotherapy practice run by Dr Nikita Amin, who is the data controller for your personal data. Address: [Practice postal address]. Email: [contact email]. We are registered with the Information Commissioner's Office (ICO) under number [ICO registration number].

Identity and contact data: name, email, phone number, address, date of birth.

Special category data: information about your physical and mental health shared during consultations and therapy, which may include details about sexuality, religion, ethnicity or relationships where relevant to your care.

Booking data: appointment times and information you enter when booking through Calendly.

Payment data: records of payments and invoices (card details are handled by our payment provider and not stored by us).

Technical data: limited information such as IP address and browser type when you visit this website.

GP and emergency contact details, where you choose to provide them.

Contract (Article 6(1)(b) UK GDPR): to arrange and provide therapy you have requested.

Legal obligation (Article 6(1)(c)): to keep financial records and meet professional and regulatory duties.

Legitimate interests (Article 6(1)(f)): to run and improve our practice and website securely.

For health data we rely on Article 9(2)(h) UK GDPR and Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018 (health or social care purposes), as the data is processed by a registered health professional under a duty of confidentiality. In rare circumstances we may rely on Article 9(2)(c) (vital interests) or substantial public interest conditions such as safeguarding.

Everything you share in therapy is confidential, in line with HCPC and UKCP codes of ethics. Session notes are kept brief, factual and secure.

We may need to share information without your consent where there is a serious risk of harm to you or others, a safeguarding concern about a child or vulnerable adult, a court order, or a legal requirement (for example under the Terrorism Act 2000 or Proceeds of Crime Act 2002). Wherever possible and safe, we will discuss this with you first.

As required by our professional bodies, we attend clinical supervision. Cases may be discussed anonymously, without identifying information.

Calendly (appointment scheduling), our email and secure video providers, our payment provider, our accountant, and our IT/website host. These act as processors under written agreements.

Your GP or emergency services only where described above or with your consent.

Some providers may process data outside the UK. Where they do, we rely on UK adequacy regulations or the International Data Transfer Agreement / UK Addendum to protect your data.

We never sell your data or use it for marketing without your consent.

Clinical records are kept for 7 years after therapy ends (or until age 25 for clients who were under 18), in line with professional guidance, then securely destroyed.

Financial records are kept for 6 years to meet HMRC requirements.

Enquiries that do not lead to therapy are deleted within 12 months.

You have the right to be informed, to access your data, to rectification, to erasure, to restrict processing, to data portability, and to object. Some rights are limited for clinical records we are legally or professionally required to keep.

To make a request, email us. We will respond within one month, free of charge in most cases.

If you are unhappy with how we handle your data, you can complain to the ICO at ico.org.uk or on 0303 123 1113. We would appreciate the chance to resolve your concern first.

We use encrypted devices and accounts, strong passwords with two-factor authentication, and locked storage for any paper notes. Online sessions use end-to-end encrypted platforms where available.