1. Who I Am and How to Contact Me
This website is operated by Reem Alani trading as Therapy with Reem. I operate as the Data Controller for my private therapy practice. I am registered with the Information Commissioner’s Office (ICO) under registration number ZC228957.
To protect client privacy, maintain clinical confidentiality, and ensure strict data security, my practice communications are structured to separate administrative data from clinical treatment:
Non-Clinical & Administrative Communication: I am contactable via the enquiry form on my website, directly via email at
contact@therapywithreem.co.uk, or via my administrative voicemail line provided through a secure virtual telecom network (Vyke). This telecom line is used strictly for billing references and automated account validation. It is not answered live and does not accept clinical updates. You are welcome to use email or website forms for general, non-clinical, administrative, booking or data-rights enquiries.
Clinical & Sensitive Communication: Because standard email and SMS are not secure or encrypted mediums for transmitting sensitive health data, they must not be used for clinical matters. All clinical information, therapeutic logs, session content, and sensitive health updates are handled exclusively within the secure, GDPR-compliant environment of Konfidens, via a secure messaging portal.
Please note: I do not provide crisis support. In the event of a mental health emergency, please contact NHS 111 (option 2), 999, or your local crisis team.
2. Why I Collect Your Data (Lawful Bases)
Under the UK General Data Protection Regulation (UK GDPR), I must have a valid legal reason to process your information. I collect data across two categories:
Personal Data (Name, contact details, scheduling, billing): This is processed under the lawful basis of Contract (to fulfil our agreement to provide therapy) and Legitimate Interests (to manage a secure and efficient business).
Special Category Data (Clinical notes, health history, psychological assessments): Because mental health data is highly sensitive, I process this under Article 6(1)(b) (Performance of a Contract) combined with Article 9(2)(h) of the UK GDPR (the provision of health or social care treatment) and Schedule 1 of the Data Protection Act 2018.
3. What Information I Collect
I only collect information necessary to provide safe and effective psychological therapy. This includes:
Information you provide: Your name, contact details, and initial admin queries sent via my website enquiry form or email. GP details, emergency contact info, and medical histories uploaded securely to the Konfidens portal.
Clinical records: Clinical assessment data, including standardised psychometric questionnaires and symptoms trackers via the secure Konfidens portal. Brief, factual session notes, treatment plans, and assessments recorded after our appointments on the secure Konfidens portal.
Digital data: Automatic timestamps, device identifiers, and booking data generated when you interact with my secure practice management platform (Konfidens) or our payment processor (Stripe) during your card verification setup.
4. Third-Party Data Processors
To operate this mental health practice securely and maintain strict clinical confidentiality, I use trusted external software providers to process your personal data. These companies act as formal Data Processing Addenda (DPA) and are legally bound to UK GDPR compliance standards.
I process initial enquiry contact data under the lawful basis of Legitimate Interests, allowing me to communicate with you regarding booking a consultation.
Website Hosting (Canva): Thirs website is hosted securely by Canva. Any basic administrative contact data you input onto the site is routed safety through their secure infrastructure.
Enquiry Routing (Jotform): When you submit your contact details through the enquiry form, Jotform securely captures and encrypts this
transmission. This data is routed directly to my secure business administration email inbox.
Email Infrastructure (Namecheap Private Email): My administrative email inbox securely receives your initial scheduling request and contact details. To practice data minimisation, once an enquiry is received, your name and contact details are manually migrated into our secure clinical records platform (Konfidens). The original notification emails and any associated data are then permanently purges and deleted from my active mail server, local devices and trash folders.
Clinic Management (Konfidens): All official client files, calendar bookings, secure session notes, signed treatment contract and data are stored exclusively within Konfidens, an encrypted, medical-grade clinical platform. To ensure total confidentiality, all ongoing communication following an initial enquiry must take place exclusively through Konfidens’ secure client portal rather than standard email. If an enquiry does not result in us entering a formal therapeutic relationships, your profile, contact details, and any associated messages will be permanently deleted from the Konfidens system within 30 days.
Payment Processing (Stripe): I utilise Stripe, a secure, GDPR-compliant digital payment handler, to process financial transactions. Stripe adheres to strict banking encryption and PCI-DSS compliance standards to protect your stored card tokens. All payment details are collected directly by Stripe via a secure link so that I never see, handle or store your raw card information.
Social Media Platforms (Meta/Instagram): I maintain an Instagram profile for information and marketing purposes. To strictly protect client confidentiality and comply with UK GDPR data privacy laws, all inbound messaging (DMs) on my social media accounts is permanent deactivated. Please note that when you visit or interact with my social media profile, the platform provider (Meta) acts as a data controller and may track your user data via cookies and analytics. This data processing is governed entirely by Instagram’s own privacy policy, and I hold no liability for their data handling. All formal therapeutic enquiries must be submitted exclusively through the secure, encrypted booking portal (Konfidens) accessible via my website enquiry page. I do not permit the disclosure of sensitive personal data or clinical histories within the public comment sections of my social media profiles. Any public comments containing sensitive personal, medical, or crisis-related data will be hidden or deleted as soon as reasonably practicable upon review to protect user privacy and safety. I hold no liability for information publicly disclosed by users on these platforms.
5. How I Store and Protect Your Data
To maintain maximum data security, I do not transmit or store clinical information over unencrypted email or in physical paper files. All your personal data, intake forms, clinical notes, and ongoing communications are handled securely within Konfidens, a GDPR-compliant, end-to-end encrypted practice management platform designed specifically for healthcare professionals.
If I access the Konfidens platform via a mobile device, that device is secured with biometric locks (FaceID) and strong passwords, ensuring no third parties can access your files.
6. Confidentiality and Sharing Boundaries
Your information is treated with strict professional confidentiality. However, in accordance with the ethical standards of the British Association for Behavioural and Cognitive Psychotherapies (BABCP) and UK statutory law, there are explicit limits to this confidentiality:
Clinical Supervision: I regularly review my casework with a qualified clinical supervisor to maintain high professional standards. Your identity is always kept completely anonymous during these consultations.
Safeguarding and Professional Duties: I have a professional and ethical duty to break confidentiality without your consent if I have reason to believe that a child, young person, or vulnerable adult is at risk of abuse, neglect, or harm, or if there is an immediate, severe risk of harm or threat to your life or the life of another person. Anywhere safe and clinically appropriate, I will discuss this with you before sharing data with
Local Authority Social Services, your GP, or emergency services.
Statutory Legal Obligations: In accordance with UK law, I am legally mandated to disclose information without your consent to the relevant
authorities if I become aware of acts of terrorism, money laundering, or drug trafficking.
Court Orders: If a court of law issues a formal legal order requiring the disclosure of therapy notes or records, I am legally obliged to comply.
7. Data Retention (How Long I Keep Your Data)
I do not hold your information indefinitely. To comply with professional indemnity insurance requirements and clinical best practices, your full clinical record and personal data will be held securely within Konfidens for a period of 7 years following the conclusion of your therapy. Once this retention period expires, all digital files will be permanently and securely deleted from the platform.
8. Your Statutory Rights
Under UK data protection law, you possess several rights regarding your data:
The Right to Rectification: You can request that I correct any inaccurate or incomplete personal information at any time.
The Right to Restriction: You can ask me to restrict how I use your data under specific circumstances.
The Right to Erasure: You have the right to request that I delete your personal data. This right applies fully to non-clinical data. However, this right is not absolute for clinical health records. My legal and insurance obligations to retain medical records for 7 years will override requests to erase clinical notes.
9. Your Right of Access (Subject Access Request Policy)
You have a legal right to request a complete copy of the personal data and clinical notes I hold about you at any time. My internal procedure for fulfilling a Subject Access Request (SAR) adheres strictly to ICO guidelines:
How to Request: You do not need to fill out a legal form or use specific terminology. A verbal request made during a session, or an informal text message or secure message inside Konfidens asking to see your logs, is fully valid.
Verification: To prevent a data breach, I must securely verify your identity (or verify explicit legal authorization/Power of Attorney if a solicitor requests it on your behalf) before compiling any files.
Timeline and Cost: Once your identity is verified, your records will be provided completely free of charge within one calendar month.
Third-Party Redactions: To protect the privacy rights of others, any information within your logs that identifies a third party (such as a relative, family member, or colleague) will be permanently redacted (blacked out) before delivery.
Psychometric Data Included: Because I use standardised clinical metrics to monitor your progress, any completed outcome measures or
symptoms questionnaires (such as the PHQ-9, GAD-7, OCI, SPIN, or other clinical questionnaires) and their corresponding scores form a
permanent part of your clinical record and will be included in your data packet.
Clinical Exemptions (Serious Harm Test): Under Schedule 3, Part 2 of the Data Protection Act 2018, health professionals may withhold specific portions of clinical notes if disclosing them is formally assessed as highly likely to cause serious harm to your physical or mental health, or the health of another person. I will consult my clinical supervisor before applying this rare legal exemption.
Secure Delivery: To maintain security, your clinical data will not be sent via email. It will be issued securely via Konfidens.
10. Questions or Complaints
If you have any questions or concerns about how your data is handled, please contact me via my administrative email or through Konfidens secure messaging so we can resolve the matter. Please remember that email is not secure for clinical updates and must only be used for administrative questions. If you remain unsatisfied with my response, you have the statutory right to lodge a formal complaint with the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint.
11. Cookie Notice
This website only uses essential cookies that are technically necessary for the site to function properly and to secure and process your enquiry form submissions. We do not use intrusive third-party tracking, advertising, or marketing cookies. By continuing to use this site, you agree to these essential cookies.
12. Website Terms of Use
No Medical or Psychological Advice: The content on this website is for informational and promotional purposes only. Reading this website or submitting an enquiry form does not establish a formal therapist-client relationship. If you are experiencing a mental health emergency, please contact 999 or the Samaritans on 116 123.
Intellectual Property: All text, branding, and content on this website are the property of [Your Full Real Name] / Therapy with [Your Name] and may not be reproduced without written permission.
Limitation of Liability: While we endeavour to keep this website accurate and online, we are not responsible for any temporary downtime or external links that may break.
