Privacy

Privacy notice

Last updated 30 June 2026

This notice explains how I look after your personal information when you contact AttuneSpace, book a first conversation, or work with me in therapy. It also explains your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

I take this seriously. The moment you get in touch about therapy, you are trusting me with sensitive information about your health and your life, and I want to be clear and honest about how it is handled.

Who I am

AttuneSpace is the private practice of Sumukh Nijhawan, MBACP, Psychotherapist and Counsellor. For the purposes of data protection law, I am the data controller, which means I decide how and why your information is used.

I hold full professional indemnity insurance through Balens, and all of my clinical work is undertaken in regular supervision, as required by my professional bodies.

The information I collect

Depending on how far we work together, I may hold:

  • Contact and enquiry details: your name, email address, phone number, and anything you choose to tell me when you first get in touch.
  • Booking details: the date and time of your first conversation or sessions, arranged through my online booking system (Calendly).
  • Health and therapy information (special category data): the things we discuss in our work, brief and securely held session notes, and any relevant history you share. This is sensitive personal data and is treated with particular care.
  • Payment information: records that a payment has been made. I do not store your card details.

Notes, and my use of AI

To keep accurate records, I sometimes use a secure tool that uses artificial intelligence to help transcribe sessions and draft my notes. Where I do this, a recording or transcript of the session is processed by that tool on my behalf, under a written data processing agreement, and is not used to train public AI models. I keep this to what is necessary, delete recordings once my notes are written, and I will tell you if I plan to use it in our work. You can ask me not to use it at any time, and that will not affect your care in any way.

How I use your information, and my lawful bases

Under UK GDPR I must have a lawful basis for using your information. Mine are:

  • To respond to your enquiry: your consent, or my legitimate interest in replying to someone who has contacted me (Article 6(1)(a) and 6(1)(f)).
  • To arrange and provide therapy: to perform our agreement to work together (Article 6(1)(b)).
  • To keep clinical records: because I provide therapy and am bound by a professional duty of confidentiality, I rely on the provision of health care condition (Article 9(2)(h), with the associated condition in the Data Protection Act 2018). Where it is more appropriate, for example with an initial enquiry, I rely on your explicit consent (Article 9(2)(a)).
  • To meet legal and safeguarding duties: where the law requires it, or to protect someone's vital interests (Article 6(1)(c), 6(1)(d) and, for health information, Article 9(2)(c)).

Confidentiality, and its limits

What you bring to therapy is confidential. There are a small number of situations where I may need to share limited information without your consent, and I would always try to talk with you about it first wherever it is safe to do so:

  • If there is a serious and immediate risk to your life or safety, or to someone else's.
  • To protect a child or an adult at risk of harm.
  • Where I am required to by law, such as a court order, or certain legal duties relating to acts of terrorism.

I also discuss my work in clinical supervision, which is a professional requirement that helps me work safely and well. I keep this anonymous wherever possible, and my supervisor is bound by the same duty of confidentiality.

Who else may see your information

I keep the number of people and services involved to a minimum. Where I do use trusted providers, they act on my instructions and are bound to protect your information:

  • My online booking system (Calendly) to schedule your first conversation and sessions.
  • My email and website hosting providers, including Netlify, which hosts this website.
  • Google Meet, the video platform used for online sessions.
  • A secure AI notetaking and transcription tool, where I use one, to help me record and write up sessions (see Notes, and my use of AI, above).
  • My accountant, for limited financial records, where applicable.
  • My clinical supervisor, and, only if a complaint or claim arose, my professional bodies or insurer (Balens).

I do not sell your information, and I do not use it for advertising.

Information held outside the UK

Some of the providers I use, such as Calendly and the AI transcription tool, are based outside the UK. Where your information is processed in another country, I rely on providers that protect it to a standard recognised under UK data protection law, for example through approved safeguards such as the International Data Transfer Agreement or an adequacy decision.

How long I keep it

If you make an enquiry but we do not go on to work together, I delete your details within a short period unless you ask me to stay in touch.

If we work together, I keep your clinical records for 7 years after our last session, in line with guidance from my professional bodies and insurer. After that, records are securely deleted or destroyed. Where records relate to someone under 18, they are kept until their 25th birthday, in line with the same guidance.

How I keep it safe

I store information securely, using password protection and encryption where appropriate, and I keep identifying details separate from session notes wherever I can. Only I have routine access to your records.

Your rights

Under UK GDPR you have the right to:

  • ask for a copy of the information I hold about you;
  • ask me to correct anything that is inaccurate;
  • ask me to delete your information, where there is no overriding reason to keep it;
  • ask me to restrict or object to how I use it;
  • withdraw your consent at any time, where I am relying on consent;
  • ask to receive your information in a portable form, where that applies.

To exercise any of these, please email me at sumukh@attunespace.co.uk. I will respond within one month.

Cookies and this website

This website does not use advertising or tracking cookies. It loads fonts from Google Fonts and a professional verification badge from Psychology Today, which means your browser contacts those services to display them. If you open the booking system, Calendly may set cookies needed for it to work. Your booking and therapy information is only collected when you choose to get in touch.

Making a complaint

If you are unhappy with how I have handled your information, please tell me first so I can put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.

Changes to this notice

I may update this notice from time to time. The date at the top shows when it was last revised.