Privacy Notice

Mind Over Matter Therapy

Last updated: 19 June 2026

This privacy notice explains how I collect, use, store and protect personal information in my therapy practice. It has been updated to reflect the latest UK data law requirements under the Data (Use and Access) Act.

I am Kelly Kearley, a counsellor working in person and online. I am the data controller for personal information I collect through Mind Over Matter Therapy. This means I am responsible for deciding how your personal information is used and for keeping it safe. I am formally registered with the Information Commissioner’s Office (ICO) as a data controller under registration number C1963199.

If you have any questions about this privacy notice, or about how your information is handled, you can contact me at:

• Email: kelly@mindovermattertherapy.co.uk
• Website: www.mindovermattertherapy.co.uk

This privacy notice applies to people who contact me about therapy, current and former clients, and visitors to my website.

Information I Collect and Why I Need It

I only collect information that is necessary for providing therapy safely, ethically, and professionally.

1. Enquirers & Initial Contact

When you contact me via my website form, email, or phone, I may collect:

• Your name and contact preferences
• Your email address and phone number
• The information you choose to share in your enquiry
• Marketing information (such as where you saw my advertisement)

2. Client Registration & Therapy

If we begin working together, I collect a paper Registration Form and maintain records containing:

• Your age, address, and date of birth
• Your GP/Doctor’s details
• Relevant medical or health information (e.g., mobility, diagnoses, medications) needed to ensure your safety in an emergency
• Brief clinical notes
• Attendance, payment, and appointment information
• Correspondence between us (relevant details from email or text message exchanges are recorded onto your notes)

Special Category Data

Some of the information I collect is classed as “special category data” under UK data protection law. This includes sensitive information about your physical and mental health, relationships, identity, or history.

Lawful Basis for Using Your Information

Under the UK GDPR, I must have a valid lawful basis to process your information. I rely on the following bases under Article 6:

• Contract: Where processing is required to arrange, manage, and provide your therapy sessions.
• Legitimate Interests: Where I need to run my practice safely, respond to enquiries, maintain records for insurance, and protect both you and me.
• Legal Obligation: Where I am required by law or a court order to keep or share information.

Condition for Special Category Data

Because I process sensitive health and mental health data, I meet a separate legal condition under Article 9 of the UK GDPR:

• Article 9(2)(h): The processing is necessary for the provision of health or social care treatment, in accordance with professional rules of confidentiality.

Confidentiality and Its Limits

Therapy is confidential, but confidentiality is not absolute. I am registered with the National Counselling and Psychotherapy Society (NCPS) and adhere to high ethical standards. I will not share what you tell me unless there is a lawful, ethical, or safeguarding reason to do so.

I may need to share limited information if:

• I am required to do so by a court subpoena or legal process.
• I believe there is a serious, immediate risk of harm to you or someone else, or a safeguarding concern involving a child or vulnerable adult. In an emergency situation, the law may require me to inform the necessary authorities without your permission, though I will always aim to discuss this with you beforehand if possible.
• I consult my clinical supervisor to support safe and effective practice (your identity is protected and anonymised using a Unique ID code).

How Your Data is Stored

I use appropriate technical and physical measures to keep your information secure.

• Paper Records: Your paper data (Registration Form, brief clinical notes, and signed consent form) are stored securely in separate, locked filing cabinets. Your clinical notes are entirely anonymised using a Unique ID code and are kept completely separate from your identifying contact details.
• Digital Data: Your phone number, email address, and digital exchanges are held on my passcode-protected business mobile phone and computer email applications.
• Website Form: My website is hosted on the 20i platform and managed by Therapy Web Designs. Information submitted via my online contact form is securely encrypted via SSL/TLS and transmitted directly to my email account. 20i stores data on secure servers behind a firewall, using SSL/TLS encryption and HTTPS.

AI Tools, Transcription and Recording

I do not record, transcribe, or use any Artificial Intelligence (AI) tools to process our therapy sessions or client information.

Website Visitors and Cookies

When you visit my website, non-identifiable technical information may be collected automatically through 20i hosting, Google Analytics, and Bing Webmaster Tools. This includes traffic data, your IP address, browser type, and pages visited, which I use purely for my own business purposes to track website performance.

Cookies are used to make the site work effectively and securely. A cookie banner will appear when you visit the site, giving you the legally required notice and choice to accept or control non-essential tracking cookies through your browser settings.

Important Safety Note: Deleting Your Browser History

You may be in a situation where you do not want anyone who has access to your computer or device to know that you are looking for a counselling service. If this is important for your personal safety, you can erase your internet search history and cookies from your browser after visiting this site. Please note that I am not liable for any potential technical issues caused to your devices by altering your browser history settings.

Overseas Data Transfers

Because my website is hosted on 20i and utilises Google and Microsoft applications, some technical data or contact form traffic may be processed on secure servers located outside the UK (such as the United States). Where I or my providers transfer personal information outside the UK, it is only done where the law allows it and where strict, appropriate transfer mechanisms or standard contractual safeguards are in place.

Clinical Will

I have appointed a trusted professional colleague to act as my Clinical Executor. In the unfortunate event that I die or become seriously incapacitated and can no longer work with you, my Clinical Executor will be granted access to the minimum contact information necessary to reach you, notify you, and manage your records safely and appropriately. This person is fully bound by professional confidentiality standards.

Data Retention and Disposal

• Clinical Records: Your paper session notes, registration form, and unique ID code are kept securely for 7 years after our work ends, which is a legal requirement mandated by my professional insurance company. After this period, all paper records are securely shredded.
• Enquiry Data (Non-Clients): Enquiries that do not result in you becoming a client will be deleted from my systems within 30 days and permanently removed from the trash folder.
• Digital Communication: Your phone number and email address will be deleted from my mobile phone and computer 1 month after our therapeutic work finishes. Text messages and emails are reviewed periodically and permanently deleted within 1 month of us finishing our work together.

Your Rights over Your Personal Information

Under UK data protection law, you have rights regarding how your information is handled. These include the right to:

• Be Informed: Fulfilled via this transparency notice.
• Access: Request a copy of the personal information I hold about you, free of charge, which will be provided within one month of your request.
• Rectification: Ask me to amend or correct any inaccurate or incomplete information.
• Erasure (The Right to be Forgotten): Request that I delete your data. Please note this is not an absolute right; I cannot delete records that I am legally obliged to keep for my insurance company.
• Data Portability: Receive your data in a portable format to transfer to another party.
• Withdraw Consent: Object to or withdraw consent for processing, where consent was the specific basis used. (Please note that if you do not consent to me processing your data in line with this policy, I will likely be unable to contract to work with you for legal and insurance reasons.)

Data Protection Concerns and Complaints

If you have a concern or are unhappy with how I have handled your personal information, you have the right to make a data protection complaint directly to me.

To do so, please email me at kelly@mindovermattertherapy.co.uk, including your name, what your concern is, and what you would like me to look into. Under the 2026 data laws, I will:

1. Acknowledge your complaint within 30 days of receipt.
2. Investigate your concern and communicate the outcome to you without undue delay.

If you remain unsatisfied with my response, or if you prefer to bypass me and contact the UK regulator directly, you can lodge a complaint with the Information Commissioner’s Office (ICO):

• Website: www.ico.org.uk
• Telephone: 0303 123 1113