Kim Man Counselling Your Clarity in Mind

Privacy Notice

Confidentiality is at the heart of counselling. This notice explains what personal information I collect, why I need it, how I keep it safe, and the rights you have over it.

Who I am

I’m Kim Man, a BACP-accredited counsellor trading as Kim Man Counselling. I’m responsible for your personal information (the “data controller” under UK data protection law).

What information I collect

When you get in touch. Your name, email address, phone number if you give it, and anything you write in your message. Please keep first messages brief. There’s no need to share details about what’s brought you here until we speak.

If we work together. Your contact details, date of birth, [GP details and an emergency contact], and brief notes from our sessions. Session notes can include information about your health and wellbeing, which the law treats as “special category” information and protects more strongly.

If you’re seen through Bupa. Your Bupa membership number and authorisation details, so I can arrange and claim for sessions.

Couples counselling. Information about both partners, recorded in a way that respects each person’s confidentiality.

Clinical supervision. Supervisees’ contact details and brief notes. Information about a supervisee’s clients is discussed without names or identifying details.

I work with adults (18 and over), so I don’t knowingly collect information about children as clients.

Why I use it and the legal basis

  • To reply to your enquiry and arrange a first session. This is a step you’ve asked me to take before we agree to work together.
  • To provide counselling or supervision, and to take payment. This is needed for our agreement to work together (a contract).
  • To keep clinical records. This is in my legitimate interests and is required by my professional body (BACP) and my insurer. Health information in session notes is processed for the purpose of providing health care, under a duty of confidentiality.
  • To keep you or others safe. In rare cases, where there is a serious risk of harm, or where the law requires it.

I never use your information for marketing, and I never sell it.

How I store it and how long I keep it

  • Emails are kept in an encrypted Proton Mail account, protected by a strong password and two-step login.
  • Session notes are [kept in a locked cabinet / in an encrypted practice-management system], separate from your contact details where possible.
  • Online sessions take place on [video platform, e.g. Zoom or Microsoft Teams]. Sessions are never recorded.

How long I keep information:

  • Enquiries that don’t lead to sessions: deleted within [6 months].
  • Client and supervision records: kept for [7 years] after our last session, as advised by my insurer and professional body, then securely destroyed.
  • Payment records: kept for 6 years, as HMRC requires.

When I may share it

What you tell me stays confidential. I will only share information:

  • With your agreement, for example with your GP if you ask me to.
  • In clinical supervision, which all BACP counsellors must have. I discuss my work with my supervisor without using your name or details that could identify you.
  • With Bupa, if your sessions are funded through them, limited to what’s needed to authorise and claim for sessions.
  • Where there is a serious risk of harm to you or someone else, or where the law requires it, such as a court order, safeguarding, or terrorism. Where possible, I will talk to you first.

I also use a few trusted services that handle information on my behalf, under data protection agreements:

  • Proton (email), based in Switzerland, which the UK recognises as having equivalent data protection.
  • Cloudflare (website hosting), based in the US. Any transfers are protected by the UK–US Data Bridge or UK-approved contract terms.
  • [Video platform and any notes or booking software]

This website

This website doesn’t use cookies, analytics or tracking, and it doesn’t have any forms. Fonts are stored on the site itself, so no information is sent to font providers.

Like all websites, the hosting service (Cloudflare) briefly processes technical information such as your IP address, so it can deliver the pages and protect the site from attacks. I don’t use this to identify you.

Links to other sites, such as BACP, Bupa or Counselling Directory, are covered by those sites’ own privacy policies.

Your rights

You have the right to:

  • ask for a copy of the information I hold about you
  • ask me to correct anything that’s wrong
  • ask me to delete your information, although I may need to keep clinical records for the time described above
  • ask me to limit how I use your information, or object to it
  • withdraw your agreement at any time, where I rely on it

To make a request, email me at kimman@proton.me. I’ll reply within one month, and there’s no charge.

If you’re unhappy with how I’ve handled your information, please tell me so I can try to put it right. You can also complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.

Last updated: [date]