Who I am
The Forest Within Counselling is an independent counselling practice operated by Disha Mankani, who is the data controller for the personal information described in this notice. You can contact me about your data and privacy rights at [email protected].
Information I may collect
When you make an enquiry, I may receive your name, email address, the type of enquiry and any message you choose to send. If we arrange an introductory call or begin counselling, I may also collect information needed to arrange and provide sessions, including relevant identity, appointment, payment and clinical details. Counselling information can include sensitive information about mental health and other aspects of your life. Please keep your first website enquiry brief; you do not need to describe your medical history.
Why I use your information
I use enquiry details to respond to your message, arrange an introductory call and help us decide whether counselling together is appropriate. If you become a client, I may use relevant information to provide and document counselling, make appointments, manage payments, practise safely, receive clinical supervision, respond to concerns and meet professional, safeguarding and legal obligations. I do not use enquiry details for marketing mailing lists.
Lawful basis for processing
For enquiries and counselling arrangements, my primary lawful basis under UK GDPR Article 6(1)(b) is taking steps you request before entering a contract or performing our contract. Legal obligation (Article 6(1)(c)) or legitimate interests (Article 6(1)(f)) may apply to specific professional, administrative or complaints activities. When processing special-category health information as part of counselling, the relevant Article 9 condition is Article 9(2)(h), for provision of health care or treatment subject to an applicable duty of confidentiality. Other lawful conditions may apply to safeguarding or legal claims. I review the legal basis and any relevant additional conditions as my services and systems change.
Confidentiality and sharing
Counselling conversations and records are treated confidentially. Identifying information is not routinely shared. I may discuss therapeutic work in clinical supervision using anonymised or minimised information. Information may be shared with relevant healthcare, emergency or safeguarding services where you agree, or where there is another lawful and ethical justification, such as a serious risk of harm or a legal requirement. Other recipients may include professional insurers, regulators or legal advisers where necessary. I aim to share only what is relevant.
Services used to handle data
The Forest Within website and the enquiry form are hosted by Cloudflare. A Cloudflare Pages Function processes your enquiry, Cloudflare Turnstile helps prevent automated spam, and Cloudflare D1 stores the name, email address, enquiry type and optional message you submit. I access these enquiries through my private Cloudflare account. Cloudflare processes website and security data in providing these services. If you contact me directly by email, messages are handled by Microsoft 365 and the email services involved. Any other counselling, scheduling, record-keeping and payment services will be explained when relevant.
How long I keep information
Enquiries that do not lead to counselling are generally kept for up to six months from the last meaningful contact, subject to safeguarding, legal or professional obligations. The Cloudflare enquiry database requires regular deletion checks as part of that retention process. Consultation or screening information may be kept for up to twelve months when counselling does not begin, and adult counselling records are normally kept for seven years after the final session, subject to applicable legal and professional requirements. Financial records are retained for the statutory periods that apply. These periods are reviewed against actual practice and relevant requirements.
Your data-protection rights
Depending on the circumstances, you may be able to request access to your personal information, ask for inaccuracies to be corrected, ask for erasure, restrict certain uses of the data, object to particular processing or request portability. Not every right applies in every situation, particularly where professional records must be retained. To exercise a right, contact the practice using the contact details above.
Website, forms and cookies
The website has a custom enquiry form. Submissions are processed by Cloudflare Pages Functions and stored in a private Cloudflare D1 database. Cloudflare Turnstile checks submissions for automated misuse and may process technical information required for fraud prevention and security. This website does not intentionally set advertising or analytics cookies. Cloudflare processes technical connection and security information to operate and protect the website. If additional booking tools or analytics are enabled later, this notice will be updated.
Questions or complaints
If you are concerned about how your information is handled, please contact me using the practice contact details above so I can respond. You may also complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint/.
Updates
This notice was updated on 1 November 2026. I review it whenever my services, suppliers or processing practices change.