This Privacy Policy explains how Pooja Shah, trading as ABA Consultant London ("we", "us", "our"), collects, uses, and protects personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who We Are
The data controller is Pooja Shah, BCBA, trading as ABA Consultant London. You can contact us at:
2. What Personal Data We Collect
We may collect the following types of personal data:
- Contact information — name, email address, phone number
- Information about your child — name, age, diagnosis, educational setting, and details about behaviour and development that you share with us
- Health and special category data — as an ABA service working with children, we may receive information about a child's health, diagnosis, or educational needs. This is treated with the highest level of care.
- Correspondence — emails, messages, and notes from consultations
- Website usage data — anonymised analytics data (see Cookies section below)
3. How We Use Your Data
We use personal data for the following purposes:
- Responding to enquiries and booking consultations
- Delivering ABA programmes, assessments, and therapy services
- Communicating progress and sharing reports with you
- Meeting our professional and legal obligations as a BCBA-certified practitioner
- Improving our services
4. Legal Basis for Processing
We process your personal data on the following legal bases:
- Contract — to fulfil our obligations when you engage our services
- Legitimate interests — to respond to enquiries and communicate with prospective clients
- Legal obligation — where required by law or professional regulation
- Explicit consent — for health and special category data relating to children, we obtain explicit consent from parents or guardians before processing
5. How We Store and Protect Your Data
Personal data is stored securely and access is restricted to Pooja Shah only. We do not use unsecured third-party storage for sensitive client information. All data is stored within the UK or the European Economic Area (EEA).
6. How Long We Keep Your Data
We retain client records for a minimum of seven years following the end of a therapeutic relationship, in line with professional guidance. Enquiry data from non-clients is deleted within 12 months if no service commences.
7. Sharing Your Data
We do not sell or share your personal data with third parties for marketing purposes. We may share data only in the following circumstances:
- With other professionals (such as speech therapists or schools) where you have given explicit consent
- Where required by law or a court order
- Where we have a safeguarding concern — in such cases we are obliged to act regardless of consent
8. Your Rights
Under UK GDPR, you have the following rights:
- Right of access — to request a copy of the data we hold about you
- Right to rectification — to request correction of inaccurate data
- Right to erasure — to request deletion, subject to legal retention requirements
- Right to restrict processing — to limit how we use your data
- Right to object — to object to processing based on legitimate interests
- Right to data portability — to receive your data in a portable format
To exercise any of these rights, please contact us at info@abaconsultantlondon.com. We will respond within one month.
9. Cookies
Our website may use cookies for analytics purposes (such as Google Analytics) to help us understand how visitors use the site. These cookies collect anonymised data only and do not identify you personally. You can disable cookies in your browser settings at any time.
10. Changes to This Policy
We may update this Privacy Policy from time to time. The date at the top of this page will reflect any changes. We encourage you to review this page periodically.
11. Complaints
If you have concerns about how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.