Legal

Privacy Policy

Last updated: 30 June 2026

This policy explains how Dr Aditi Sharma (“Mood in Mind”) collects, uses and protects your personal data. Dr Aditi Sharma is the data controller for the information you provide, registered with the Information Commissioner’s Office (ICO), registration number ZB551876.

Information I collect

  • Contact details you provide via the enquiry form (name, email, phone).
  • Information you share during consultation and therapy, including health and mental health information (special category data under UK GDPR).
  • Payment and invoicing records.
  • Limited technical data when you visit this website (see thecookie policy).

How I use your information

  • To respond to your enquiry and arrange consultations.
  • To provide therapy and keep clinical records (a professional and legal requirement).
  • To manage invoicing and payments.
  • To send the “Thinking About Therapy?” email series, if you have opted in (you can unsubscribe at any time).

Lawful basis

For general personal data, I rely on contractual necessity and legitimate interests. For health and mental health information (special category data), the lawful basis is the provision of health care under Article 9(2)(h) UK GDPR, supported by Schedule 1 of the Data Protection Act 2018. Where you have opted in to email communications, the basis is your consent.

How long I keep your data

Clinical records are kept for a minimum of seven years from the date of last contact (or, where the client was under 18, until their 25th birthday), in line with professional guidance from the BPS and HCPC. Contact enquiries that do not result in therapy are deleted after six months. You may request earlier deletion in certain circumstances (see your rights below).

Storing & sharing

Your data is stored securely. I do not sell your data. It may be shared only in limited circumstances: where there is a serious risk of harm to you or others; where required by law or a court order; or with a clinical supervisor (who is bound by the same duty of confidentiality) for professional oversight purposes. In the event of a personal data breach I will notify affected individuals and the ICO as required by law.

Third-party services

Some services used by this practice involve data being processed outside the UK, including in the United States. Where this occurs, transfers are made under the UK’s international data transfer mechanisms (such as adequacy decisions or standard contractual clauses):

  • Google Fonts - fonts are loaded from Google’s servers; your browser’s IP address is logged by Google. SeeGoogle’s privacy policy.
  • Brevo (Sendinblue SAS) - contact form enquiries and the “Thinking About Therapy?” email series are delivered via Brevo, an email platform operating under a data processing agreement.
  • WriteUpp - clinical records, appointments, invoicing and online video sessions are managed via WriteUpp, a UK-based practice management platform. WriteUpp operates under a data processing agreement and is designed for healthcare providers. SeeWriteUpp’s privacy policy.

Your rights

Under UK GDPR you have the following rights regarding your personal data:

  • Access - to request a copy of the data I hold about you.
  • Rectification - to ask me to correct inaccurate data.
  • Erasure - to request deletion of your data (subject to legal retention requirements).
  • Restriction - to ask me to limit how I use your data.
  • Portability - to receive your data in a structured, machine-readable format.
  • Objection - to object to processing based on legitimate interests.
  • Withdraw consent - where processing is based on your consent (e.g. the “Thinking About Therapy?” email series), you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact me. If you are dissatisfied with how your data has been handled, you may complain to theInformation Commissioner’s Office (ICO)at ico.org.uk or by calling 0303 123 1113.