Sitaray – Autism & Special Needs School, Islamabad
Introduction
Sitaray (“Sitaray”, “we”, “us” or “our”) is an autism and special needs centre based in G-13, Islamabad, Pakistan, serving families across Islamabad, Rawalpindi and beyond. We provide clinical assessments, applied behaviour analysis (ABA) therapy, speech therapy, occupational therapy, early intervention, our transition school and preschool, life skills and vocational training, positive behaviour support, shadow teacher support, clinical supervision and professional training, residential accommodation, telehealth and related services.
We understand that the families we work with trust us with deeply personal information about themselves and their children. Protecting that information is central to how we operate. This Privacy Policy explains what information we collect, how we use and protect it, who we share it with, and the choices and rights available to you.
By using our website (sitaray.net), contacting us, or engaging our services, you confirm that you have read and understood this Privacy Policy.
2. Scope of this policy
This policy applies to:
- Visitors to our website, sitaray.net, including anyone who completes a contact, enquiry or assessment form, registers an account, or subscribes to our newsletter;
- Parents, caregivers, guardians and family members of children and clients who receive our services;
- Children, adolescents and adults who receive assessment, therapy, education or other services from us;
- Professionals, trainees and supervisees who take part in our clinical supervision, certification or training programmes; and
- Anyone who communicates with us by phone, email, WhatsApp, social media, or in person.
3. Legal framework
The right to privacy is protected under the Constitution of the Islamic Republic of Pakistan. We also handle personal data in line with the Prevention of Electronic Crimes Act 2016 (PECA) and other applicable Pakistani laws.
Pakistan does not yet have a single, comprehensive data-protection statute in force; a Personal Data Protection Bill is in development. We monitor these developments and aim to align our practices with the Bill once enacted. In the meantime, and because we support families based outside Pakistan, we voluntarily follow widely recognised data-protection principles: that personal data is collected fairly and for clear purposes, kept accurate and secure, used only as needed, retained no longer than necessary, and handled with respect for the rights of the people it concerns.
4. Information we collect
4.1 Information you give us directly
When you contact us, enquire about services, register an account or subscribe to updates, we may collect:
- Your name (first and last name);
- Contact details — email address, phone number and, where relevant, postal address;
- The service you are interested in and the subject and content of your message;
- Account login details if you register on our website; and
- Any other information you choose to provide in your communications with us.
4.2 Information about children and clients (sensitive information)
To assess and support a child or client, we collect more detailed information, which often includes special-category (sensitive) information. This is provided by parents, caregivers, guardians, and — with appropriate consent — by other professionals or schools. It may include:
- The child’s or client’s name, date of birth, gender and photograph;
- Developmental, medical, psychological and behavioural history, including any diagnoses such as autism spectrum disorder, developmental delay, ADHD or related conditions;
- Educational history and school information;
- Assessment results, individualised education and intervention plans (IEPs), therapy notes, progress reports, and clinical records;
- Session recordings, photographs and videos used for assessment, progress monitoring, supervision and parent reporting (see Section 9); and
- Family and emergency contact details, and information relevant to the child’s care.
We treat all health, developmental and clinical information as confidential and handle it with particular care.
4.3 Information from professionals and trainees
If you take part in our clinical supervision, RBT/IBT certification or training programmes, we collect information such as your name, contact details, qualifications, employment or training history, supervision and performance records, and certification-related documentation.
4.4 Information we collect automatically
When you visit our website, certain information is collected automatically through cookies and similar technologies, including your IP address, browser type, device information, pages visited, and how you interact with the site. Our forms use Google reCAPTCHA to prevent spam and abuse, which involves data processing by Google. See Sections 11 and 16 for more on cookies and third-party services.
5. How we use your information
We use the information we collect to:
- Respond to your enquiries and arrange consultations or appointments;
- Conduct assessments and plan, deliver and review therapy, education and other services;
- Create and update individualised plans and progress reports, and share these with parents and caregivers;
- Provide clinical supervision, training and certification to professionals and trainees;
- Coordinate care with parents, schools and other professionals, where you have consented;
- Manage your account, our website and our internal records;
- Send service-related communications and, where you have opted in, newsletters and updates;
- Improve our services, website and the quality of our care;
- Maintain the safety and wellbeing of the children and clients in our care; and
- Meet our legal, regulatory, professional and ethical obligations.
6. Consent and the basis for using your information
We rely primarily on your consent to collect and use personal information — particularly sensitive information about a child or client — which we obtain through our intake and consent processes before services begin. We also use information where it is necessary to deliver the services you have requested, to fulfil an agreement with you, to protect someone’s safety and wellbeing, or to comply with the law.
You can withdraw your consent at any time (see Section 12). Withdrawing consent will not affect anything we did lawfully before you withdrew it, and in some cases we may need to retain certain records to meet professional or legal obligations.
7. Children’s information and parental consent
Much of our work involves children and young people. We take special care with their information.
- We collect and use a child’s information only with the consent of a parent, legal guardian or authorised caregiver, except where the law requires or permits otherwise.
- Our website is intended for parents, caregivers and professionals, not for use by children. We do not knowingly collect information directly from children through the website.
- A parent or guardian may request access to, correction of, or deletion of their child’s information, subject to the limits in Sections 10 and 12.
- Where we believe a child may be at risk of harm, we may be required to act, including sharing information with appropriate authorities, in the child’s best interests.
8. Confidentiality of clinical and health information
Clinical, developmental and health information is kept confidential and is accessed only by the members of our team who need it to assess, deliver or supervise a child’s or client’s care — for example, the assigned therapists, the supervising Board Certified Behaviour Analyst (BCBA), and relevant clinical and administrative staff. Our team and trainees are bound by confidentiality and professional ethics obligations. We do not disclose clinical information to anyone outside Sitaray without consent, except where disclosure is necessary to protect safety or is required by law.
9. Photographs, video and recordings
As part of assessment, therapy and progress monitoring we may take photographs and video recordings of sessions. These are used internally to plan and review care, support clinical supervision, and share progress with parents and caregivers (for example, in monthly reports).
We will only use a child’s or client’s image on our website, social media or in marketing materials with the separate, explicit consent of a parent or guardian. This consent is optional, is separate from consent to receive services, and can be withdrawn at any time. If you withdraw consent, we will stop future use of the image, though copies already published by third parties or in printed materials may not always be retrievable.
10. How we share your information
We do not sell your personal information. We share it only as described below:
- Within our team: with the therapists, supervisors and staff involved in delivering or supporting your care.
- Schools and other professionals: where you consent — for example, when our shadow teachers coordinate with a mainstream school, or when we liaise with another treating professional — we share only what is relevant.
- Service providers: trusted third parties who help us operate, such as our website host, IT and communications providers, and form/anti-spam tools. They may process data only on our instructions and are required to keep it secure.
- Legal and safeguarding: where required by law, by a court or regulator, or where necessary to protect the safety and wellbeing of a child, client or other person.
- Business changes: if Sitaray reorganises, merges or transfers part of its operations, information may be transferred as part of that process, subject to this policy.
11. Third-party services and links
Our website uses and links to third-party services that have their own privacy policies, including Google (reCAPTCHA, and any maps or analytics we use), Meta Platforms (Instagram and Facebook), YouTube, and WhatsApp for enquiries. When you interact with these services, your information is handled under their respective privacy policies. We encourage you to review them. We are not responsible for the privacy practices of external websites linked from ours.
12. Telehealth and international transfers
We offer telehealth and online support to families within Pakistan and overseas. Online sessions are delivered using third-party video and communication platforms, which may process and store data on servers outside Pakistan. Where information is transferred internationally — for example, when we support a family living abroad, or when our website tools store data overseas — we take reasonable steps to ensure it remains protected to a standard consistent with this policy. By using our telehealth or online services, you consent to your information being processed in this way.
13. How long we keep your information
We keep personal information only for as long as necessary for the purposes set out in this policy and to meet our professional, ethical and legal obligations. Clinical and assessment records are generally retained for the period required by professional standards after a child or client stops receiving services. Website enquiry data is kept for a reasonable period to respond to and follow up on your request. When information is no longer needed, we securely delete or anonymise it.
14. How we protect your information
We use appropriate organisational and technical measures to protect personal information against loss, misuse, unauthorised access and disclosure. These include restricting access to authorised team members on a need-to-know basis, confidentiality obligations, secure storage of physical and electronic records, and reasonable safeguards on our website and systems. While we work hard to protect your information, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.
15. Your rights and choices
Subject to applicable law and our professional obligations, you may:
- Request access to the personal information we hold about you or your child;
- Ask us to correct information that is inaccurate or incomplete;
- Request deletion of information, where we are not required to keep it;
- Withdraw consent you have given, including consent to use a child’s image;
- Opt out of marketing communications at any time; and
- Raise a concern or complaint about how we handle your information.
To exercise any of these, please contact us using the details in Section 18. We may need to verify your identity before acting on a request, and we will respond within a reasonable time.
16. Cookies
Our website uses cookies and similar technologies to help the site function, remember your preferences, and understand how the site is used. You can control or disable cookies through your browser settings, although some parts of the site may not work properly if you do. Cookies set by third-party tools (such as Google reCAPTCHA, embedded YouTube videos, or social media) are governed by those providers’ policies.
17. Marketing communications
If you subscribe to our newsletter or opt in to updates, we may send you helpful resources, news and information about our services. Every marketing email includes a way to unsubscribe, and you can ask us to stop at any time by contacting us. We will still send you essential service-related messages where needed (for example, appointment information).
18. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our services, technology, or the law. We will post the updated version on this page with a revised “Last updated” date. Where changes are significant, we will take reasonable steps to let you know.
19. How to contact us
If you have any questions, requests or concerns about this Privacy Policy or how we handle your information, please contact us:
- Sitaray
- House 39, Street 486, G-13/1, Islamabad, Pakistan
- Phone: +92 51 8313299
- Email: admin@sitaray.net
Last updated: [21/06/2026] Effective date: [21/06/2026]