Privacy Policy

1. About this privacy notice

This Privacy Notice explains how RM Integrative (“I”, “me”, “my”) collects, uses, stores and protects personal information when you visit my website, contact me, enquire about or receive my services, participate in research or educational activity, or otherwise interact with my professional practice.

I am the data controller for personal data I process in connection with my independent practice, except where another organisation is the controller for a particular service or activity.

This notice covers my work as a psychotherapist/counsellor, researcher, and educator. Particular research projects, courses, groups, or events may have additional privacy information where appropriate.

2. My details

Data controller: Rebecca Moughtin/RM Integrative

Trading name: RM Counselling UK

Professional role: Psychotherapist/Counsellor/Researcher/Educator

Business email: rmcounsellinguk@gmail.com

Business address: 100A South Road, Waterloo, L22 0ND

Website:

ICO registration: Registered with the ICO. Registration number: ZB892341

Professional registration: British Association for Counselling and Psychotherapy (BACP) registered

Insurance: Professionally insured, including appropriate professional indemnity cover, through Holistic Insurance

DBS: DSB checked

3. What personal information I collect

Identity and contact information, including your name, email address, telephone number and correspondence address.

Enquiry and appointment information, including the service you are interested in, preferred appointment times and practical arrangements.

Therapy and wellbeing information, including information you choose to share about mental or physical health, relationships, circumstances, history, experiences, risks, needs and goals. Some of this is special category health data.

Professional records, including relevant notes, correspondence, attendance information, invoices and records necessary to provide and manage services.

Information relating to safeguarding, risk or emergency situations where relevant.

Payment and financial administration information, such as transaction and invoice records. I do not intend to store full payment-card details myself where a third-party provider processes payment.

Technical information about website use, including IP address, device/browser information and cookie information where collected.

Information you provide through contact forms, mailing lists, events, groups, downloads, or other professional activities.

Research or educational information where you voluntarily participate in research, teaching, training, or evaluation. Project-specific information will be provided where required.

I aim to collect only information that is adequate, relevant, and necessary for the purpose for which it is used.

4. How I collect information

Directly from you when you contact me, complete a form, book, attend therapy, make a payment, email me or speak with me.
Through professional or organisational referrals where relevant and lawful.
From third parties where necessary and lawful, for example in safeguarding or professional referral circumstances.
Automatically through my website or digital services where cookies or similar technologies are used.

5. Why I collect information

To respond to enquiries and communicate with you.
To arrange, provide and manage psychotherapy/counselling and related services.
To understand your needs and provide an appropriate, safe, and professional service.
To maintain appropriate professional records.
To manage appointments, cancellations, attendance, fees, invoices, and payments.
To communicate between sessions where this forms part of the agreed way of working.
To manage safeguarding, risk, and emergency situations where necessary.
To obtain professional supervision and consultation, using anonymised/minimised information wherever reasonably possible.
To meet legal, regulatory, insurance, and professional obligations.
To deal with complaints, disputes, claims, or legal matters.
To maintain the security and functionality of my website, systems, and records.
To improve my services, professional practice, and educational materials.
To undertake or contribute to research or educational activity where appropriate and lawful.
To send optional professional information, events, or resources where I have an appropriate lawful basis.

6. Lawful bases for processing

Under UK data protection law, I need a lawful basis for processing personal data and, for special category data such as health information, an additional condition under Article 9 UK GDPR.

Contract — where processing is necessary to enter into or perform an agreement with you.
Legal obligation — where processing is required to comply with law or regulation.
Legitimate interests — where processing is necessary for legitimate interests pursued by me or another party and those interests are not overridden by your rights and interests.
Consent — where I specifically rely on consent, for example, for certain optional communications, research participation or non-essential cookies. Consent can be withdrawn at any time.
Vital interests — where processing is necessary to protect someone's life or other vital interests and the legal requirements are met.

For health and other special category information processed in providing psychotherapy/counselling or related care, I will rely on the applicable Article 9 condition and relevant UK law. The precise condition depends on the circumstances.

Research processing can require a different legal basis depending on the project, whether data are identifiable, who is conducting the research and the research design. Therapeutic consent does not automatically amount to consent for research.

7. Confidentiality and its limits

Confidentiality is central to my therapeutic work. I normally keep information you share with me confidential and will not disclose it without an appropriate legal, ethical or professional basis.

There are foreseeable limits to confidentiality. Information may need to be disclosed where, for example:

I believe there is a serious and significant risk of harm to you or another person and disclosure is necessary to help protect someone.
There is a safeguarding concern involving a child or vulnerable person.
I am legally required or authorised to disclose information.
Disclosure is necessary to comply with a court order or other legal process.
Information needs to be shared appropriately for professional supervision, consultation, insurance, legal advice or another professional purpose, subject to confidentiality, data protection and the circumstances of the case.
You ask me to share information with another professional or organisation and an appropriate lawful basis exists.

Where practicable and safe, I will discuss a proposed disclosure with you before making it. There may be circumstances where I cannot do so.

My practice is informed by BACP ethical standards and applicable data protection law. I am professionally insured and DBS checked.

8. Supervision and professional support

I use professional supervision and may seek appropriate consultation. This is part of safe and ethical practice. I take care to minimise identifying information and use anonymised information wherever reasonably possible. Identifiable information is handled confidentially and only where there is an appropriate lawful and professional basis.

9. Records and security

I keep records that are appropriate, accurate, relevant, and necessary for the services I provide. Records may include contact details, correspondence, appointments, relevant session notes, professional records, payment information,and information relevant to safeguarding or risk.

I use reasonable technical and organisational measures to protect information against loss, misuse, unauthorised access, alteration, or disclosure. These may include password protection, access controls, secure devices, secure cloud/practice-management systems, encryption where available, backups, and secure disposal.

No electronic system is completely risk-free. I take reasonable steps to reduce risk and will respond appropriately to a personal data breach.

10. Email, telephone, and messaging

I may use email, telephone and, where agreed, other messaging methods for appointments and aspects of our work. Please avoid sending highly sensitive information by ordinary email or text unless we have agreed that method is appropriate.

Relevant professional communications may form part of my records.

11. Online therapy and digital platforms

Where services are delivered online, I may use third-party platforms. The platform used will be identified in my working arrangements or relevant privacy information where appropriate.

Some providers may process or store data outside the UK. Where international transfers occur, I will use an applicable lawful transfer mechanism or safeguard required by UK data protection law.

Please do not record sessions unless this has been discussed with me in advance and an appropriate arrangement has been agreed.

12. Who I may share information with

Professional supervisors or consultants.

Relevant healthcare or other professionals where you have requested/authorised contact or disclosure is otherwise lawful and necessary.

Professional insurers, legal or regulatory advisers, or relevant authorities where necessary.

Payment providers, booking systems, practice-management systems, email providers, cloud storage providers, website hosts and other technology suppliers processing information on my behalf.

Government, regulatory, law-enforcement, safeguarding or judicial bodies where disclosure is legally required or authorised.

Researchers, educators or research organisations only where the relevant legal, ethical and professional requirements are met.

I do not sell your personal information and do not routinely share identifiable therapy information for marketing purposes.

13. Research and educational activity

Alongside therapeutic practice, I undertake or contribute to research, writing, teaching and educational activity relating to psychotherapy, consciousness, spirituality, transpersonal psychology, integration and related areas.

I will not use identifiable client information in research, teaching, presentations, publications, or case studies merely because I obtained it during therapy. I will use thoroughly anonymised information wherever possible or obtain appropriate permission/consent and ensure the proposed use has an appropriate lawful, ethical, and professional basis.

Where you participate specifically as a research participant or learner, I will provide additional information about the project or activity, including what information is collected, why, how it will be used, retention, and access.

14. Marketing and optional communications

If I send newsletters, professional updates, event information or other optional communications, I will do so only where I have an appropriate lawful basis. You can unsubscribe at any time using the method provided or by contacting me.

15. Cookies and similar technologies

My website may use cookies or similar technologies. Some may be strictly necessary. Other technologies, such as analytics or advertising technologies, may require consent before they are used.

Where consent is required, you will be given an appropriate choice about non-essential cookies and will be able to change preferences where the website provides a cookie settings tool.

16. How long I keep information

I retain personal information only for as long as necessary for the purposes for which it is processed, taking account of legal, professional, insurance, safeguarding, accounting and other requirements.

All adult client notes are kept for 7 years, and children's notes are kept up until their 26th birthday, unless 7 years is longer.

When information is no longer required, I securely delete, destroy or anonymise it as appropriate.

17. Your rights

To be informed about how your information is used.
To request access to personal information I hold about you.
To ask for inaccurate or incomplete information to be corrected.
To request erasure in certain circumstances.
To request restriction of processing in certain circumstances.
To object to certain processing, including some processing based on legitimate interests.
To data portability where the right applies.
To withdraw consent where I rely on consent.
These rights are not absolute and may be subject to legal exemptions or limitations. Therapy and other professional records may be subject to specific considerations.
To exercise a right or ask a question, contact me using the details in section 2. I may need to verify your identity before responding.

18. Complaints about data protection

Please contact me first if you are concerned about how I have handled your personal information so that I can try to resolve the matter.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent supervisory authority for data protection. ICO: https://ico.org.uk/ Telephone: 0303 123 1113.

19. Data breaches

If I become aware of a personal data breach, I will assess it and take appropriate action under applicable data protection law. Where notification to the ICO or affected individuals is legally required, I will make the required notification within the applicable timescale.

20. Automated decision making

I do not use solely automated decision-making or profiling that produces legal or similarly significant effects on clients or website users.

21. Children and young people

Where I work with children or young people, I apply additional safeguards appropriate to their age, circumstances and the service. Relevant consent and contracting arrangements will be discussed with the young person and, where appropriate, a parent, guardian or other person with parental responsibility.

22. Changes to this privacy notice

I may update this Privacy Notice to reflect changes in my practice, services, technology, legal requirements or professional guidance. The latest version will be published on my website and will show the date it was last updated.

23. Contact

Rebecca Moughtin / RM Counselling

rmcounsellinguk@gmail.com

100a South Road, L22 0ND

[INSERT WEBSITE URL]

Document control:

Version 2.0

Date created 5 October 2026

Last reviewed 19 October 2026

Next review 19 October 2027