Privacy Policy

Last updated: 10 September 2026

1. About InnerStead Therapy

InnerStead Therapy is an independent online psychotherapy practice operated by Aisha Abdulsalam Winningah, trading as InnerStead Therapy. For the purposes of data-protection law, Aisha Abdulsalam Winningah is the data controller and is responsible for deciding how and why your personal information is used.

Aisha is an Accredited Member of the British Association for Counselling and Psychotherapy (BACP), registration number 396422, and works in accordance with the BACP Ethical Framework, including its principles on confidentiality, professional accountability and secure record-keeping. Aisha is fully insured to practice as a sole proprietorship with UK jurisdiction and registered with Information Commisioner’s Office, UK.

You can contact InnerStead Therapy about this policy or your personal information at:

This privacy policy explains what information is collected, why it is needed, how it is protected, when it may be shared, how long it is retained and the rights available to you under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable data-protection law, as amended from time to time.

2. Who this policy applies to

This policy applies to:

  • visitors to the InnerStead Therapy website;

  • people who make an enquiry or book an initial appointment;

  • prospective, current and former therapy clients;

  • people who contact InnerStead Therapy on behalf of someone else; and

  • clients referred or funded by an Employee Assistance Programme (EAP), insurer, employer or another organisation.

InnerStead Therapy primarily provides online therapy to adults located in the United Kingdom and to eligible international clients. Therapy is not offered to clients located in the United Arab Emirates.

3. Information collected

Depending on your contact with InnerStead Therapy, the following information may be collected:

  • your name, date of birth, pronouns and contact details;

  • your address and current physical location at the time of online sessions;

  • contact details for your GP, emergency contact or another relevant professional;

  • appointment, attendance, cancellation and communication records;

  • information provided in enquiry, assessment, consent or review forms;

  • therapy notes, assessment information, agreed goals and outcome-measure scores;

  • information about your mental and physical health, medication, disability, relationships, family circumstances, cultural background, faith, sexuality or other matters relevant to therapy;

  • risk, safeguarding and safety-planning information;

  • referral information received from an EAP, insurer, healthcare professional or another referring organisation;

  • invoices, payment status and transaction references, although full payment-card details are not retained where payment is processed by an external provider;

  • emails, messages, feedback, complaints and other correspondence; and

  • limited technical information generated when you use the website, such as your IP address, device or browser information, pages visited and cookie preferences.

Therapy information will often include health information and may include other information treated as special-category data under data-protection law. This information receives additional protection.

Sessions are not audio-recorded or video-recorded unless this has been separately discussed and you have given explicit written agreement.

4. How information is obtained

Most information is provided directly by you when you:

  • visit the website;

  • submit an enquiry or contact form;

  • communicate by email, telephone or message;

  • use the online booking system;

  • complete an assessment, consent form or questionnaire;

  • attend therapy; or

  • make a payment.

Information may also be received from a referring or funding organisation, your GP, another healthcare professional or a person you have authorised. In a serious safety or safeguarding situation, relevant information may be received from emergency services or another appropriate organisation.

5. Why information is used and the lawful bases

Your information is used only where there is a clear and lawful reason. The purposes and relevant lawful bases may include:

  • Responding to enquiries and arranging therapy: taking steps at your request before entering into a contract and performing the therapy contract.

  • Assessing suitability and delivering therapy safely: performing the therapy contract and pursuing the legitimate interests of providing a safe, ethical and professionally accountable service.

  • Maintaining clinical and administrative records: performing the contract, meeting legal and professional obligations, and pursuing legitimate interests in continuity of care, service management and responding to concerns.

  • Managing appointments, payments, accounts and tax records: performing the contract and complying with legal obligations.

  • Communicating with you about your care or appointments: performing the contract and pursuing legitimate interests in effective practice administration.

  • Managing risk, safeguarding concerns or emergencies: protecting vital interests, complying with legal obligations, or acting for substantial public-interest reasons where the relevant legal conditions are met.

  • Handling complaints, insurance matters or legal claims: complying with legal obligations and establishing, exercising or defending legal claims.

  • Maintaining website security and functionality: pursuing legitimate interests in operating a secure and effective website and, where required, obtaining your consent for optional cookies.

  • Sending newsletters or promotional communications: only where you have given separate consent or another lawful basis applies. Therapy information is not used for marketing.

For health information and other special-category data, InnerStead Therapy principally relies on the condition that processing is necessary for the provision of healthcare or treatment by a practitioner who owes a professional and legal duty of confidentiality. Where relevant, processing may also be necessary for legal claims, safeguarding or vital interests, or may be based on your explicit consent.

Where legitimate interests are relied upon, these interests include providing, administering and improving a safe and ethical therapy service, protecting information and systems, and maintaining appropriate records. These interests are balanced against your rights, expectations and the sensitive nature of therapy information.

6. If you do not provide information

You can choose what you share during therapy. However, certain information—such as identity and contact details, your location during online sessions, relevant assessment information and emergency contact arrangements—may be necessary to assess suitability, enter into the therapy agreement and provide online therapy safely.

If essential information is not provided, InnerStead Therapy may be unable to offer or continue the service.

7. Confidentiality and when information may be shared

Your therapy information is confidential. It is not sold, rented or shared for unrelated commercial purposes.

Information may be shared only when necessary, proportionate and permitted by law, including with:

  • Professional clinical supervision: aspects of the work may be discussed with a qualified supervisor to support safe and ethical practice. Identifying details are removed or minimised wherever possible, and the supervisor is bound by confidentiality.

  • Digital service providers: trusted providers supporting website hosting, secure record storage, appointment booking, email, video sessions, invoicing and payment processing. They receive only the information needed to provide their service and are expected to protect it under appropriate contractual and security arrangements.

  • A referring or funding organisation: where therapy is arranged through an EAP, insurer, employer or another organisation, limited information may be shared in accordance with the commissioning agreement. This may include attendance, appointment dates or agreed outcome information. The content of therapy sessions is not routinely shared, and the information-sharing arrangement will be explained to you.

  • Healthcare or emergency professionals: your GP, emergency contact, emergency services or another relevant professional where this is necessary to respond to a serious and immediate concern about your safety or another person’s safety.

  • Safeguarding, legal or regulatory bodies: where disclosure is required or permitted by law, a court order, safeguarding duties or professional obligations.

  • Professional advisers: an insurer, solicitor, accountant or other adviser where reasonably necessary, subject to confidentiality and data-protection obligations.

  • A nominated clinical executor: if the therapist becomes seriously ill, incapacitated or dies, a nominated professional may receive limited access to records solely to notify clients, protect continuity and close the practice safely.

Where possible and appropriate, a disclosure will be discussed with you first. There may be exceptional circumstances in which prior discussion is unsafe, impossible or legally prohibited.

8. Referrals and externally funded therapy

If an EAP, insurer, employer or other organisation refers you or funds your sessions, that organisation may also act as a separate data controller and will have its own privacy notice.

InnerStead Therapy is responsible for the information it controls. Before therapy begins, you will be informed about any routine reports or attendance information required by the referring organisation.

9. International access and transfers

InnerStead Therapy is a UK-focused online practice, and the therapist is currently based in Abu Dhabi, United Arab Emirates. This means that information relating to UK and other eligible international clients may be securely accessed by the therapist from the UAE.

Some digital service providers may also store or access information in countries outside the United Kingdom. Where UK international-transfer rules apply, InnerStead Therapy will take reasonable steps to ensure that an approved transfer mechanism and appropriate safeguards are used.

Depending on the provider and destination, these may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved contractual clauses, contractual security requirements and an appropriate transfer-risk assessment.

You may contact InnerStead Therapy for further information about the safeguards relevant to your information.

10. How information is protected

Reasonable and proportionate technical and organisational measures are used to protect personal information from accidental loss, misuse, unauthorised access, alteration or disclosure. These measures include, as appropriate:

  • access controls, strong passwords and multi-factor authentication where available;

  • secure, reputable systems for therapy administration and online communication;

  • separating or minimising identifying information in therapy notes where practicable;

  • using client initials or reference codes where appropriate;

  • limiting access to the therapist and authorised providers or professionals with a genuine need to know;

  • keeping devices and software appropriately protected and updated; and

  • securely deleting or destroying information when it is no longer required.

No internet-based service can be guaranteed to be completely secure. If a personal-data breach occurs, it will be assessed and reported to the Information Commissioner’s Office and affected individuals where the law requires this.

11. How long information is kept

Information is retained only for as long as reasonably necessary for the purpose for which it was collected and to meet professional, insurance, tax, safeguarding and legal responsibilities.

The usual retention periods are:

  • Enquiries that do not proceed to therapy: up to 12 months after the last meaningful contact.

  • Clinical records for adult clients: seven years after the therapeutic relationship ends.

  • Financial, invoice and transaction records: normally six years after the end of the relevant financial or accounting period.

  • Complaints, safeguarding matters or legal claims: for as long as reasonably necessary to manage the matter and meet applicable legal, regulatory or insurance requirements.

  • Routine administrative communications: deleted when no longer needed, unless they form part of the clinical, financial or complaint record.

  • Website and cookie information: for the periods described in the website’s cookie settings or by the relevant provider, and no longer than necessary for the stated purpose.

Information may be retained for longer where there is a lawful, safeguarding, insurance or professional reason. At the end of the relevant period, information will be securely deleted, destroyed or irreversibly anonymised.

12. Your data-protection rights

Depending on the circumstances and lawful basis, you may have the right to:

  • ask whether your personal information is being processed and request a copy;

  • ask for inaccurate or incomplete information to be corrected;

  • request deletion of your information;

  • request restriction of processing;

  • object to certain uses of your information;

  • receive information you provided in a portable format, where the legal conditions apply;

  • withdraw consent at any time where consent is the lawful basis; and

  • complain to the Information Commissioner’s Office.

These rights are not absolute. For example, information may need to be retained where it is necessary for healthcare purposes, legal claims, safeguarding, tax, insurance or another overriding lawful reason. A request may also need to be limited where disclosure would adversely affect another person’s rights or reveal confidential third-party information.

InnerStead Therapy may ask for information to confirm your identity before responding. Requests will normally be handled without charge and within the period required by data-protection law.

Your right to object

You have the right to object to processing based on legitimate interests. If you object, the information will no longer be processed for that purpose unless there are compelling legitimate grounds to continue or the processing is required for the establishment, exercise or defence of legal claims.

To exercise any of your rights, email aisha@innersteadtherapy.com.

13. Automated decision-making and digital tools

InnerStead Therapy does not use solely automated decision-making or profiling to decide whether you are suitable for therapy, assess clinical risk or determine your therapeutic care.

Any digital tool used to support administration or drafting remains subject to human oversight and does not replace the therapist’s professional judgement.

14. Marketing communications

Therapy and clinical information will not be used for marketing.

If InnerStead Therapy offers a newsletter or sends promotional information, this will be managed separately from therapy records. You can unsubscribe or withdraw consent at any time by using the unsubscribe option provided or emailing aisha@innersteadtherapy.com.

15. Website cookies and third-party links

The website may use cookies or similar technologies that are strictly necessary for security, navigation, booking functions and remembering your privacy choices.

Where optional analytics, embedded-content or marketing cookies are used, they will not be activated until you have made a choice through the cookie-consent mechanism, unless the law provides an exemption.

You can change your cookie choices through the website’s cookie settings, where available, or through your browser settings. Rejecting optional cookies should not prevent access to the main website content, although some third-party features may function differently.

The website may link to external services, including the online booking system. Those services operate under their own privacy and cookie notices. InnerStead Therapy is not responsible for the privacy practices of unrelated third-party websites.

16. Changes to this policy

This policy may be updated when the service, technology, professional requirements or data-protection law changes. The current version and revision date will be published on the InnerStead Therapy website.

Material changes affecting current clients will be communicated where appropriate.

17. Questions and complaints

If you have a question, concern or complaint about how your information is handled, please contact:

Aisha Abdulsalam Winningah
InnerStead Therapy
Email: aisha@innersteadtherapy.com
Website: www.innersteadtherapy.com

You also have the right to complain to the UK Information Commissioner’s Office. Information about raising a data-protection complaint is available at www.ico.org.uk.

InnerStead Therapy would welcome the opportunity to address your concern first, but you are not required to contact the practice before approaching the Information Commissioner’s Office.