The Project Hope is a registered organisation with centres in Islamabad and Rawalpindi, Pakistan, and it is registered under that same name. It is the organisation itself that holds your information and answers for it. There is no parent body above it. Where other companies are involved in storing or delivering it, they are named further down this page.
The short version
- The website collects a name, a way to contact you, and whatever you choose to write in your own words. Nothing else.
- We never ask for a diagnosis or medical records through this website, and you should not send them here.
- We do not sell anything to anyone, ever, and there is no advertising or tracking on this site.
- You can ask us to delete everything we hold about you, at any time, without giving a reason.
What we collect, and why
From the website forms
When you use a form on this site, we receive what you typed: your name, your phone number, your email if you gave one, your area or city if you gave one, which services you are asking about, and anything you wrote in the free-text box. We use it for one purpose: to reply to you.
The lawful basis is your consent. Every form has a consent box, it is never ticked for you, and the form will not send without it.
What the forms deliberately do not ask
There is no field on this website for a diagnosis, a medical history, a report, a medication, or an assessment score. That is a design decision, not an oversight. Under Pakistan’s data protection framework, health and psychological information is sensitive personal data, and a child’s requires verified parental consent, which a web form cannot honestly obtain.
If you have reports, bring them to an appointment. We will look at them with you.
If you have a portal account
Families, trainees and volunteers who are already working with the centre may be given a portal sign-in. There is no password: we email a one-time link. Where a portal is in use it may hold plans and reports written by us, a record of sessions and what was worked on, fees and what has been paid, training progress and materials, or volunteer hours.
You are shown your own records and nobody else’s. This is enforced by the database itself rather than by the page you are looking at, so a mistake in the website cannot expose another family’s information.
Your sign-in ends when you close the browser tab. On a shared or family computer, that matters.
What we do not do
- No advertising, no advertising networks, no tracking pixels, and no analytics that follow you from site to site.
- Nothing is sold, rented or shared for marketing. There is nobody we would sell it to.
- We do not use your information to train anything.
- We do not contact you about anything you did not ask about.
Who can see it
Inside the centre, only the people who need it to do their work. A therapist sees the children they work with. Administrative staff see what they need to arrange appointments and fees.
Outside the centre, nobody, with three exceptions, all ordinary:
- Our hosting and database provider stores the data on our behalf. They do not use it for anything of their own.
- Where you ask us to. For example, writing to a school, or sharing a report with another clinician. We ask first, every time.
- Where the law requires it, or where somebody is at risk of serious harm. Safeguarding overrides confidentiality, and we would tell you unless telling you would increase the risk.
How long we keep it
- An enquiry that goes nowhere
- 12 months, then deleted. If you contacted us and never became a client, there is no reason to keep you on file.
- Registration details
- 12 months from your last contact with us, if you did not go on to use the service.
- Clinical and educational records for a child
- Kept while we are working with you, then until the child reaches 25, or deleted sooner, at any point, if you ask us to.
- Training records
- Kept for as long as IBAO may need them to verify your hours, then deleted.
- Volunteer records
- 24 months after your last session, so we can write you a reference.
- Anything you asked us to delete
- Deleted, and not recovered from backups beyond the normal backup cycle.
A retention period that nobody enforces is a fiction. The person responsible for record-keeping at the centre reviews them each September, and anything past its period is deleted then.
Your rights, and how to use them
You can ask us to:
- Show you everything we hold about you or your child. We will give you a copy.
- Correct anything that is wrong. Including our own notes.
- Delete it. You do not have to give a reason. Where we are legally required to keep something, we will tell you exactly what and why.
- Stop us contacting you. Immediately, and permanently.
- Withdraw consent you gave earlier, without it affecting anything that was lawful before you withdrew it.
Ask by calling or messaging +92 302 5252 556, or by emailing info@morewithhope.com. We will confirm within 7 days and complete it within 30 days. There is no charge.
We will check you are who you say you are before handing over records. That protects you, not us.
If something goes wrong
A data breach means information going somewhere it should not have. We would rather tell you about one than have you find out some other way.
- We investigate
- Immediately, and contain it first: revoke access, rotate keys, take the affected part offline if that is what it takes.
- We tell you
- Within 72 hours of becoming aware, if there is any real risk to you: what happened, what was involved, what we have done, and what you should do.
- We tell the authority
- Where the law requires notification, within the period the law sets.
- We write it down
- Every incident is recorded, whether or not it was reportable, along with what we changed so it does not happen again.
- Who is responsible
- The person responsible for record-keeping at the centre. This website stores no clinical or sensitive information; paper records are held at the centres themselves. Write to info@morewithhope.com and it reaches them.
Children
Almost everyone we work with is a child, and children cannot consent to this themselves. A parent or legal guardian does, and we ask for that consent in person rather than through a tick box on a website.
Older children and teenagers are told, in language they can follow, what is written down about them and who sees it. If a young person asks us not to share something with their parents, we will tell them honestly whether we can honour that, before they tell us.
How the site itself behaves
- No tracking cookies. The site sets no cookies for advertising or analytics, and neither does the visit counter below. A portal sign-in is held in your browser tab and disappears when you close it.
- Visit counts. We use GoatCounter to count how many people visit each page, which site sent them, and their browser, screen size and country. It sets no cookies and stores nothing on your device. Your IP address and browser details are never saved; they are held in memory for up to eight hours so a return visit is not counted twice, then discarded. What we see is totals, never a record of any one person. The portal and staff sign-in pages are not counted.
- One other third party: the Find us page can show Google maps of our two centres. They do not load until you press “Show the map”, so nothing reaches Google unless you ask for it; once you do, Google sees your IP address. Everything else, the typeface included, is served from our own site.
- Forms send straight to our database over an encrypted connection. They do not pass through any third-party form service.
Complaints
Tell us first: we would rather fix it. Pakistan has no data protection law in force yet: the Personal Data Protection Bill is still before Parliament, so there is no regulator to escalate to. We would rather say that plainly than point you at an authority that does not exist. When one is established we will name it here, and you will not lose any right by having come to us first.
Last reviewed September 2026, and reviewed again each September. If we change anything material, we will say so here and tell anyone it affects.