Talk to us

Two things to confirm before this is final. This policy names The Project Hope as the organisation responsible for your information. Whether the centre is a registered entity, and under what legal name — the policy should name the registered entity if there is one. A dedicated address for data requests, e.g. privacy@yourdomain, rather than a personal inbox.

The short version

  • The website collects a name, a way to contact you, and whatever you choose to write in your own words. Nothing else.
  • We never ask for a diagnosis or medical records through this website, and you should not send them here.
  • We do not sell anything to anyone, ever, and there is no advertising or tracking on this site.
  • You can ask us to delete everything we hold about you, at any time, without giving a reason.

What we collect, and why

From the website forms

When you use a form on this site, we receive what you typed: your name, your phone number, your email if you gave one, your area or city if you gave one, which services you are asking about, and anything you wrote in the free-text box. We use it for one purpose — to reply to you.

The lawful basis is your consent. Every form has a consent box, it is never ticked for you, and the form will not send without it.

What the forms deliberately do not ask

There is no field on this website for a diagnosis, a medical history, a report, a medication, or an assessment score. That is a design decision, not an oversight. Under Pakistan’s data protection framework, health and psychological information is sensitive personal data, and a child’s requires verified parental consent — which a web form cannot honestly obtain.

If you have reports, bring them to an appointment. We will look at them with you.

If you have a portal account

Families, trainees and volunteers who are already working with the centre may be given a portal sign-in. There is no password — we email a one-time link. Where a portal is in use it may hold plans and reports written by us, a record of sessions and what was worked on, fees and what has been paid, training progress and materials, or volunteer hours.

You are shown your own records and nobody else’s. This is enforced by the database itself rather than by the page you are looking at, so a mistake in the website cannot expose another family’s information.

Your sign-in ends when you close the browser tab. On a shared or family computer, that matters.

What we do not do

  • No advertising, no advertising networks, no tracking pixels, no analytics that follow you.
  • Nothing is sold, rented or shared for marketing. There is nobody we would sell it to.
  • We do not use your information to train anything.
  • We do not contact you about anything you did not ask about.

Who can see it

Inside the centre, only the people who need it to do their work. A therapist sees the children they work with. Administrative staff see what they need to arrange appointments and fees.

Outside the centre, nobody — with three exceptions, all ordinary:

  • Our hosting and database provider stores the data on our behalf. They do not use it for anything of their own.
  • Where you ask us to. For example, writing to a school, or sharing a report with another clinician. We ask first, every time.
  • Where the law requires it, or where somebody is at risk of serious harm. Safeguarding overrides confidentiality, and we would tell you unless telling you would increase the risk.

How long we keep it

An enquiry that goes nowhere
12 months, then deleted. If you contacted us and never became a client, there is no reason to keep you on file.
Registration details
12 months from your last contact with us, if you did not go on to use the service.
Clinical and educational records for a child
Kept while we are working with you, then retention period for clinical records — take professional advice; practice elsewhere is commonly until the child reaches 25, or 8 years after the last contact for adults.
Training records
Kept for as long as a certification body may need them to verify your hours, then deleted. confirm the IBAO's requirement
Volunteer records
24 months after your last session, so we can write you a reference.
Anything you asked us to delete
Deleted, and not recovered from backups beyond the normal backup cycle.

A retention period that nobody enforces is a fiction. These are reviewed on a set date each year and anything past its period is deleted then. who runs that review, and when

Your rights, and how to use them

You can ask us to:

  • Show you everything we hold about you or your child. We will give you a copy.
  • Correct anything that is wrong. Including our own notes.
  • Delete it. You do not have to give a reason. Where we are legally required to keep something, we will tell you exactly what and why.
  • Stop us contacting you. Immediately, and permanently.
  • Withdraw consent you gave earlier, without it affecting anything that was lawful before you withdrew it.

Ask by calling or messaging +92 302 5252 556, or by emailing mfarooqeazamawan@gmail.com. We will confirm within 7 days and complete it within 30 days. There is no charge.

We will check you are who you say you are before handing over records — that protects you, not us.

If something goes wrong

A data breach means information going somewhere it should not have. We would rather tell you about one than have you find out some other way.

We investigate
Immediately, and contain it first — revoke access, rotate keys, take the affected part offline if that is what it takes.
We tell you
Within 72 hours of becoming aware, if there is any real risk to you: what happened, what was involved, what we have done, and what you should do.
We tell the authority
Where the law requires notification, within the period the law sets.
We write it down
Every incident is recorded, whether or not it was reportable, along with what we changed so it does not happen again.
Who is responsible
the named person accountable for data protection at the centre

Children

Almost everyone we work with is a child, and children cannot consent to this themselves. A parent or legal guardian does, and we ask for that consent in person rather than through a tick box on a website.

Older children and teenagers are told, in language they can follow, what is written down about them and who sees it. If a young person asks us not to share something with their parents, we will tell them honestly whether we can honour that, before they tell us.

How the site itself behaves

  • No tracking cookies. The site sets no cookies for advertising or analytics. A portal sign-in is held in your browser tab and disappears when you close it.
  • Two third parties load on some pages: Google Fonts serves one typeface, and the contact page embeds a Google map. Both are Google services and both see your IP address. Everything else is served from our own site.
  • Forms send straight to our database over an encrypted connection. They do not pass through any third-party form service.

Complaints

Tell us first — we would rather fix it. If we do not put it right, you are entitled to complain to the relevant data protection authority in Pakistan. name the authority and its contact route once the framework is in force

Last reviewed September 2026. If we change anything material, we will say so here and tell anyone it affects. set a date each year to review this page