Privacy Policy
Your privacy is not just a legal obligation — it is a clinical and ethical cornerstone of everything we do at FCRC. This policy explains how we protect you.
Effective Date
1 January 2026
Last Reviewed
June 2026
Governing Law
Questions about your data? Our team is available around the clock.
Confidentiality is central to who we are. Federal City Rehab Clinic (FCRC) provides treatment for addiction, mental health, and psychiatric conditions. We understand that the personal information you share with us is deeply sensitive. This Privacy Policy sets out, plainly and honestly, what information we collect, why we collect it, how we protect it, and what rights you hold over it.
Who We Are
Federal City Rehab Clinic (FCRC) is a licensed rehabilitation and psychiatric care facility certified by the Islamabad Healthcare Regulatory Authority (IHRA) and operating under the laws of the Islamic Republic of Pakistan.
For the purposes of this Privacy Policy, FCRC is the data controller — the organisation responsible for decisions about how your personal data is collected and used.
- Registered Name: Federal City Rehab Clinic (FCRC)
- Address: House No. 1, Raja Azam Town, Main Korang Road, Bani Gala, Islamabad
- Website: fcrc.pk
- Email:federalcityrehabclinic@gmail.com
- Phone: 0330 1454321
- Regulatory Authority: Islamabad Healthcare Regulatory Authority (IHRA)
Information We Collect
We collect only the information that is necessary to provide safe, effective clinical care and to operate our services responsibly.
| Category | Examples | How Collected |
|---|---|---|
| Identity & Contact | Full name, date of birth, CNIC number, address, phone number, email | Admission forms, consultation calls, website contact form |
| Medical & Clinical | Substance use history, psychiatric history, diagnoses, medications, treatment progress notes, lab results | Clinical assessments, treatment sessions, referring physicians |
| Emergency Contact | Name and contact number of a nominated family member or guardian | Admission intake process |
| Financial | Payment records, billing details (no full card numbers stored) | Billing at admission and discharge |
| Website Usage | IP address, browser type, pages visited, referral source, session duration | Automatically via cookies and analytics tools |
| Communications | Records of calls, WhatsApp messages, emails, and form submissions | Your direct contact with our team |
We do not collect sensitive data beyond what is clinically necessary, and we do not collect data from social media profiles or third-party data brokers.
How We Use Your Information
Your information is used exclusively for purposes that are directly connected to your care and our clinical operations:
- Providing medical assessment, diagnosis, detoxification, and treatment
- Developing and managing your personalised treatment plan
- Coordinating care between clinical team members within FCRC
- Processing billing and issuing payment receipts
- Contacting your nominated emergency contact in the event of a medical emergency
- Fulfilling our obligations to regulatory bodies (IHRA, ANF, UNODC) as required by Pakistani law
- Improving the quality of our clinical services through anonymised internal review
- Responding to enquiries submitted through our website or phone
- Sending appointment reminders and post-discharge follow-up communications (with your consent)
We do not use your personal information for marketing purposes without your explicit consent. We do not sell, rent, or trade your data to any third party.
Legal Basis for Processing
FCRC processes personal data on the following legal grounds, in accordance with the Prevention of Electronic Crimes Act 2016 (PECA), the Pakistan Personal Data Protection Bill (PDPB), and applicable healthcare regulations:
- Consent:For non-essential communications, follow-up care, and optional communications — obtained in writing at admission
- Contractual necessity:To deliver the clinical services you have engaged us to provide
- Legal obligation:Where disclosure is required by Pakistan law (e.g. reporting to ANF or IHRA under statutory authority)
- Vital interests:In genuine medical emergencies where sharing information is necessary to protect your life or the life of another
- Legitimate interests:Internal clinical quality review using anonymised data, fraud prevention, and operational security
Medical Confidentiality — Our Core Commitment
Nothing about you is shared without your explicit, informed consent. This is not merely a legal requirement — it is the ethical foundation on which all effective addiction and mental health treatment rests. Patients must trust their clinical team completely. We take that trust with absolute seriousness.
All clinical staff — psychiatrists, psychologists, therapists, nurses, and support workers — operate under strict professional confidentiality obligations. Access to your clinical records is restricted on a need-to-know basis within your direct care team only.
We will not confirm or deny that any individual is receiving or has received treatment at FCRC to any external party, including family members, employers, or authorities, unless you have specifically authorised us to do so in writing, or unless we are legally compelled under Pakistani law.
FCRC is a safe space. Coming here is an act of courage, and we protect that with every safeguard available to us.
Sharing & Disclosure
We do not share personal data with third parties except in the following limited and clearly defined circumstances:
- With your consent:Referrals to other healthcare providers, communications with family members you have named, or discharge summaries sent to your GP — only ever with your written authorisation
- Legal obligation:Where required by a valid court order, or where Pakistani law mandates disclosure to a regulatory or law enforcement authority (e.g. the Anti-Narcotics Force under the Control of Narcotic Substances Act 1997)
- Medical emergency:Where you are incapacitated and sharing information with emergency services or your nominated next-of-kin is necessary to protect your life
- Service providers:Trusted third-party technology providers who assist our operations (IT support, secure hosting, billing software) — all bound by confidentiality agreements and restricted to the minimum data necessary to perform their function
- Accreditation bodies:Anonymised, aggregated data shared with IHRA, Pakistan Psychological Association, or UNODC for accreditation and public health reporting purposes — your identity is never disclosed in this context
We will never share your data with your employer, insurers, government departments (beyond legal obligations), or any commercial third party for marketing or profiling purposes.
Data Security
FCRC employs robust physical and digital safeguards to protect your personal information against unauthorised access, accidental loss, or disclosure:
- Physical clinical records are stored in locked, access-controlled filing systems — accessible only to treating clinicians
- Electronic records are protected by access controls, password policies, and role-based permissions
- Our website uses SSL/TLS encryption (HTTPS) for all data transmitted through contact forms
- Staff receive mandatory confidentiality and data security training on joining FCRC
- All third-party service providers with data access are contractually bound to equivalent security standards
In the event of a data breach that is likely to result in risk to your rights or interests, we will notify you and the relevant regulatory authority without undue delay, in line with our legal obligations under Pakistani law.
Data Retention
We retain personal data only for as long as is necessary for the purpose for which it was collected, or as required by applicable law:
- Clinical records:Retained for a minimum of 7 years following the conclusion of treatment, in line with Pakistan Medical and Dental Council guidelines and healthcare regulations
- Financial records:Retained for 6 years from the date of transaction, as required under Pakistani tax and commercial law
- Website enquiries & communications:Retained for 24 months unless a patient relationship commences, in which case the clinical record policy applies
- Anonymised aggregated data:May be retained indefinitely for research, quality improvement, and regulatory reporting purposes
On expiry of the applicable retention period, personal data is securely destroyed or irreversibly anonymised. You may request earlier deletion where no legal obligation requires continued retention — see Your Rights below.
Your Rights Over Your Data
You have the following rights in relation to your personal data held by FCRC. To exercise any of these rights, please contact us using the details at the bottom of this page. We will respond within 30 days.
Right to Access
Request a copy of the personal data we hold about you
Right to Rectification
Correct any inaccurate or incomplete information
Right to Erasure
Request deletion where no legal obligation requires retention
Right to Restrict
Limit how we process your data in certain circumstances
Right to Object
Object to processing based on legitimate interests
Withdraw Consent
Withdraw consent for non-essential processing at any time
Please note that some rights may be limited where we are required to retain records for clinical safety, legal, or regulatory reasons. We will always explain clearly if this applies in your case.
Cookies & Website Data
The FCRC website (fcrc.pk) uses cookies and similar tracking technologies to operate the site effectively and understand how visitors use it. We use Google Tag Manager (GTM) for analytics management.
- Essential cookies:Necessary for the website to function (form submissions, session management). These cannot be disabled.
- Analytics cookies:Used to understand page visits, session duration, and user journeys in aggregate. No personal identifiers are stored. Managed via Google Analytics through GTM.
- Marketing cookies:We do not currently use targeted advertising or retargeting cookies. Should this change, we will update this policy and seek your consent.
You may manage or disable non-essential cookies at any time via your browser settings. Please note that disabling cookies may affect certain website functions. For more information about cookies, visit allaboutcookies.org.
Our website is hosted in Pakistan and operated on WordPress with Elementor. We do not transfer your website data to countries outside Pakistan unless required by the operation of analytics services (Google Analytics — governed by Google’s own privacy policy).
Children’s Privacy
FCRC provides specialised treatment for young patients, including those under the age of 18. In all cases involving a minor, written consent is obtained from a parent or legal guardian before any assessment, treatment, or data collection commences.
Where a young patient is the subject of a Youth & Adolescent Rehabilitation Programme, additional safeguarding protocols apply to the storage, access, and sharing of their clinical records. These records are held under heightened access restrictions and are not accessible to general clinical staff without specific authorisation from the treating psychiatrist.
We do not knowingly collect data from children under 18 through our website contact forms without verified parental consent.
Changes to This Policy
We may update this Privacy Policy periodically to reflect changes in our practices, clinical operations, or applicable law. When we make material changes, we will update the “Last Reviewed” date at the top of this page and, where appropriate, notify current patients directly.
We encourage you to review this page periodically. Continued use of our services following any update constitutes your acceptance of the revised policy. The current version of this policy is always available at fcrc.pk/privacy-policy.
Contact Us About Privacy
If you have any questions about this Privacy Policy, wish to exercise your rights, or have a concern about how your data has been handled, please contact us directly. We will respond within 30 days.
All privacy enquiries are treated with the same confidentiality as clinical communications. You will never be identified as having raised a privacy concern.