Privacy & Ethics

Your privacy matters

This section explains how I collect, use, store, and protect your personal information in line with UK data protection laws (UK GDPR and the Data Protection Act 2018). 

If you’re working with me, enquiring about it, or using my website, you have the right to know how your information is handled. I’ve kept this as clear and jargon-free as possible, but if anything doesn’t make sense, you're welcome to ask.

1. Who I Am

Kit Mitchell

Providing counselling, therapy & therapeutic coaching
ICO Registration Number: ZB914027
Contact: counsellingwithkit@gmail.com

For the purposes of data protection law, I am the data controller for the personal information I collect and process. 

2. What Information I Collect

Depending on how you contact or work with me, I may collect:

• your name and contact details, such as email address and phone number;

• information you share through emails, forms, messages, texts or social media DMs;

• brief session notes;

• assessment, outcome measure and feedback form responses;

• a client register, including client ID code, contact information and session history;

• payment and invoicing information, where relevant;

• information needed to manage appointments, cancellations, safeguarding, complaints or legal/ethical responsibilities.

I only collect information that is relevant to the service I provide or to managing enquiries, appointments and professional responsibilities.

3. Special Category Data

As part of providing therapy and coaching services, I collect and process health-related information and other sensitive personal information. This is classed as special category data under the UK GDPR.

My lawful basis for processing personal data is usually:

• Article 6(1)(b) – performance of a contract, where I am providing or preparing to provide a service;

• Article 6(1)(f) – legitimate interests, where I need to manage my practice, respond to enquiries, maintain appropriate records, or improve my services;

• Article 6(1)(c) – legal obligation, where I am required to comply with the law;

• Article 6(1)(a) – consent, where I ask for clear permission, such as for marketing or optional feedback.

For special category data, my lawful basis is usually:

• Article 9(2)(h) – provision of health or social care, where I am providing counselling or therapy services;

• where relevant, another lawful condition may apply, such as explicit consent or reasons connected to legal claims or safeguarding.

This means I only handle sensitive personal information where it is necessary, appropriate and connected to the service I provide or my legal, ethical and professional responsibilities.

4. How I Collect It

I may collect information:

• through Google Forms, Microsoft Forms, emails, texts and messages;

• through website enquiries or booking/contact forms;

• through social media DMs, if you contact me there;

• during sessions, whether online or in person;

• through assessment tools, outcome measures and feedback forms;

• through payment, invoicing or administrative processes.

Please be aware that social media DMs are not the most secure or confidential way to share sensitive information. If you contact me through social media, I may suggest moving the conversation to email.

Contact forms: My website uses a Jotform contact form so that you can send an enquiry or message through the site.

If you use the contact form, the information you enter will be processed through Jotform before it reaches me. This may include your name, email address, phone number, message, and any other information you choose to include.

Please avoid including highly sensitive information in the contact form. The form is intended for initial enquiries and contact only. If we decide to work together, I will provide more appropriate ways to share further information.

Jotform is a third-party form provider. I use it to receive and manage enquiries, and I remain responsible for how I use the information you send to me.

Cookies and website information: My website is built using Google Sites and includes a Jotform contact form.

Google and Jotform may use cookies or similar technologies to help the website and contact form work, keep them secure, prevent misuse, and provide their services.

I do not currently use website analytics for my own tracking or marketing purposes. If this changes, I will update this privacy notice and, where required, provide a clear way for visitors to manage their cookie choices.

You can usually manage or disable cookies through your browser settings. You can also read more about how Google and Jotform use cookies and personal information through their own privacy and cookie information.

5. Why I Collect It (Lawful Bases)

I collect and use personal information to:

• respond to enquiries;

• assess whether my service is suitable for your needs;

• provide counselling, therapy or therapeutic coaching;

• arrange, manage and keep records of sessions;

• monitor outcomes and gather feedback;

• meet legal, ethical, safeguarding and professional responsibilities;

• manage invoices, payments, records and administration;

• communicate with you about services you have requested;

• send marketing or updates only where you have clearly opted in.

6. How I Keep It Safe

I take reasonable steps to protect your information. These include:

• paper notes stored in a locked cabinet;

• digital notes stored securely using encrypted systems where possible;

• use of two-factor authentication where available;

• password-protected devices;

• anonymised notes temporarily stored on my laptop where needed;

• encrypted backup storage;

• no audio or video recording without explicit consent.

I regularly review how information is stored and take steps to reduce unnecessary access, duplication or retention.

7. Sharing Your Data

I do not sell your personal information.

Your information is kept confidential unless:

• you give explicit consent for me to share it;

• there is a serious risk of harm to you or someone else;

• there is a safeguarding concern;

• I am required to share information by law or court order;

• disclosure is necessary in connection with legal or professional responsibilities;

• I need to discuss my work in professional supervision, in which case identifying details are kept to a minimum wherever possible.

Some tools I use, such as Google, Microsoft and OneDrive, may process data on servers outside the UK. Where this happens, I use providers that apply legally recognised safeguards, such as Standard Contractual Clauses or other approved transfer mechanisms, to help protect your information under UK data protection law.

Because this is a therapy and coaching service, even basic information such as your name, email address, phone number, or appointment details may be sensitive. For example, this information could reveal that you have contacted or worked with a therapeutic service. I take this into account when deciding how information is stored, shared, protected, and when assessing any possible data protection concern or breach. 

8. Retention & Deletion

I keep client records securely for 7 years after the end of the service.

After this point:

• paper records are securely shredded;

• digital files are securely deleted;

• any remaining administrative records are reviewed and deleted where they are no longer needed.

In some circumstances, I may need to keep information for longer, for example where there is an ongoing complaint, legal matter, safeguarding issue or professional requirement.

9. Your Rights

Under data protection law, you have rights over your personal information. These may include the right to:

• access the personal information I hold about you;

• ask for inaccurate information to be corrected;

• ask for information to be deleted in certain circumstances;

• restrict or object to certain types of processing;

• withdraw consent, where consent is the lawful basis being used;

• ask for your information to be transferred, where applicable;

• complain about how your information is handled.

Some rights are not absolute, and there may be circumstances where I am legally or professionally required to keep certain information.

10. Questions, concerns or complaints about your personal information

If you have any questions, concerns or complaints about how I collect, use, store or share your personal information, please contact me at: counsellingwithkit@gmail.com

You do not need to use formal wording or refer to data protection law. If you are unhappy with how your personal information has been handled, I will treat this as a data protection concern or complaint. 

I will acknowledge data protection complaints within 30 days of receiving them, and respond as soon as reasonably possible after looking into the concern. I may need to ask you for more information so I can understand and respond properly.

If you are unhappy with my response, or if you would prefer to raise the matter externally, you have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection. 

Website: ico.org.uk/make-a-complaint, 

Phone on 0303 123 1113 or by post at:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

11. Updates to this privacy notice

I may update this privacy notice from time to time to reflect changes in my practice, services, systems or legal requirements.

This Privacy Notice was last updated: June 2026

• I’m an Accredited Registrant with National Counselling & Psychotherapy Society (NCPS) and an individual member of the British Association for Counselling and Psychotherapy (BACP).

• I am ICO registered (ZB914027) and comply with UK GDPR and data protection laws. You can read my full Privacy Policy in the section above.

• I am fully insured for my work as a counsellor, therapist and coach.

• I am qualified and hold a BSc (hons) in Counselling & Psychotherapy. I continue to undertake relevant CPD (continuing professional development).

• I am proud to be part of the Safe Space Alliance, a global and collaborative network that visibly supports LGBTQI+ communities and helps people identify affirming, inclusive spaces.

Technology is changing the landscape of many professions, including the mental health and wellbeing fields.  

I approach AI with curiosity, critical thinking, and an ethical lens.

• I do not use AI to generate therapeutic advice.

• I never record sessions for the purpose of AI-assisted note-taking or transcription.

• Any notes I take are done manually and stored securely, in line with my Privacy Policy (detailed above).

I remain open and non-judgmental about how clients choose to use AI or assistive tools in their own lives. If it’s meaningful to you, I welcome those conversations, while keeping the therapeutic space human and private. 

I am actively involved in ongoing CPD and contribute to discussions about ethics and regulation in this evolving area..

If I ever use AI in client work…

I will only consider using AI in client work (eg. scheduling tools, admin automation) if the following conditions are met:

1. I will provide full transparency about the tool, its use, and its limitations.

2. Clients will be asked for informed, opt-in consent (not passive opt-out).

3. Any data processed by AI will be anonymised and kept secure.

4. The AI system used will align with ethical and legal standards (GDPR, BACP guidelines, etc).

5. It will never replace or interfere with the core human relationship in therapy.

Human connection, safety, privacy, and your autonomy come first. Always.