Therapy in Kenya

Privacy Policy

1. Background

Last updated: 1 July 2026

1.1 This notice (Privacy Notice) tells you how I look after your personal data when you visit my website (Website) or when you enquire about, book, or attend counselling sessions with me, and where you are another type of contact, such as a supplier or service provider to my practice.

1.2 This notice sets out what information I collect about you, what I use it for and whom I share it with. It also explains your rights under data protection law and what to do if you have any concerns about your personal data.

1.3 I may sometimes need to update this Privacy Notice to reflect changes to the way my counselling service is provided or to comply with new practices or legal requirements. You should check this Privacy Notice regularly to see whether any changes have occurred.

2. Who I am and other important information

2.1 This Website and counselling practice are operated by Moffat Kago (trading as [PRACTICE LEGAL NAME]), based at [PRACTICE ADDRESS] (I, me or my).

2.2 For all visitors to the Website and for clients who book counselling sessions with me, I am the controller of your information, which means I decide what information is collected and how it is used.

2.3 I handle your personal data in line with the Kenya Data Protection Act, 2019 and, where applicable, the requirements of the Office of the Data Protection Commissioner (ODPC). Where you contact me from another country, additional local data protection laws may also apply.

3. Contact details

3.1 If you have any questions about this Privacy Notice or the way that I use your information, please get in touch using the following details:

Contact: Moffat Kago, [CONTACT EMAIL]

4. The information I collect about you

4.1 Personal data means any information which does (or could be used to) identify a living person. I have grouped together the types of personal data that I collect, and where I receive it from, below.

4.2 Type of personal data:

  • Identity Data: your first and last name or title.
  • Contact Data: your email address, telephone number and postal address.
  • Session Data: information you share before and during counselling, including the reasons you are seeking support and the notes I keep about your sessions.
  • Health Data: where you choose to share it, information about your mental and physical health that is relevant to your counselling. This is treated as sensitive personal data and given extra protection.
  • Technical Data: internet protocol (IP) address, browser type and version, time zone setting and general location, operating system and platform on the devices you use to access my Website or online systems.
  • Usage Data: information about how you use the Website.
  • Financial Data: limited details needed to take payment for your sessions.
  • Marketing and Communication Data: your preferences in receiving updates from me and your communication preferences.

4.3 Please note that I do not collect or store your full payment card details. You provide these directly to the payment processor, who processes payments on my behalf. I only receive information about the timing and amount of your payment.

5. How I use your information

5.1 I am required to identify a legal justification (a lawful basis) for collecting and using your personal data. The bases most relevant to my practice are where I use your personal data to:

  • perform my counselling agreement with you, or take steps at your request before entering into it;
  • comply with a legal or regulatory obligation that I have;
  • pursue my legitimate interests as an individual counselling practice, but only where those interests are not outweighed by your other rights and freedoms; and
  • do something for which you have given your consent.

5.2 Because counselling involves sensitive health data, I generally rely on your explicit consent, and on the basis that processing is necessary for the provision of health or social care, to collect and use that information.

5.3 If I intend to use your personal data for a new reason that is not covered here, I will update this Privacy Notice and, where required, ask for your consent.

5.4 Where I need to collect your personal data to provide counselling and you do not provide it, I may not be able to offer you sessions.

5.5 I may anonymise the personal data I collect (so it can no longer identify you) and combine it with other anonymous information to help me understand and improve my service. Data protection law does not restrict the use of this aggregated data.

6. Who I share your information with

6.1 I keep what you share in counselling confidential. I share, or may share, your personal data only where necessary, with:

  • My supervisor and any professional bodies I belong to, in line with ethical practice, usually in anonymised form.
  • Service providers who help me run my practice (for example, booking, payment, video-call and email providers), who may only access the information they need and are bound by confidentiality and data protection obligations.
  • Emergency, medical or safeguarding services, where I reasonably believe there is a serious risk of harm to you or another person.

6.2 If I am asked to provide personal data in response to a court order or legal request, I will consider my confidentiality obligations and the impact on your rights, and seek advice where appropriate, before disclosing any information.

7. Where your information is located or transferred to

7.1 I store your personal data using secure systems provided by my service providers. Some of these providers may store data outside Kenya.

7.2 Where your personal data is transferred outside Kenya, I take steps to ensure it continues to receive an adequate level of protection, for example through appropriate contractual safeguards with the provider.

8. How I keep your information safe

8.1 I have put in place security measures to prevent your personal data from being accidentally or unlawfully lost, used or accessed by those who do not have permission. These measures include:

  • access controls and user authentication
  • keeping session notes securely and separately from identifying details where practical
  • using reputable, security-conscious service providers
  • limiting access to your information to those who need it
  • regular review of my security practices

8.2 If an incident affects your personal data, I will assess it and, where required by law, notify the relevant regulator and keep you informed.

8.3 If you notice any unusual activity relating to your account, booking, or use of the Website, please contact me at [CONTACT EMAIL].

9. How long I keep your information

9.1 I only retain your personal data for as long as necessary to fulfil the purposes I collected it for, including to meet any legal, accounting, ethical or reporting requirements.

9.2 To decide how long to keep personal data, I consider its nature and sensitivity, the potential risk of harm from unauthorised use or disclosure, the purposes for which I process it, and any applicable legal or professional requirements.

9.3 I keep counselling records for the period recommended by my professional body after the end of our working relationship, after which they are securely deleted or destroyed.

9.4 If you have asked for information from me or subscribed to updates, I keep your details until you ask me to stop contacting you.

10. Your legal rights

10.1 You have specific legal rights in relation to your personal data.

10.2 I may decline to act on a request where I have been unable to confirm your identity, or where I consider the request to be unfounded or excessive. Usually there is no cost for exercising your rights, but I may charge a reasonable fee in those limited circumstances, and I will always explain my decision.

10.3 I will respond to your request without undue delay and within the period required by law. If your request is complex I may need more time, in which case I will let you know and explain why.

10.4 If you wish to make any of the requests listed below, you can reach me at [CONTACT EMAIL].

  • Access: you can ask whether I hold personal data about you and request a copy of it, along with information about how I use it.
  • Correction: you can ask me to correct personal data that is inaccurate or incomplete.
  • Deletion: you can ask me to delete your personal data where there is no good reason for me to continue holding it. Where I am required to keep it, for example to meet professional or legal obligations, I will explain this to you.
  • Restriction: you can ask me to temporarily limit how I use your personal data.
  • Objection: you can object to me using your personal data. Where I have compelling legitimate grounds to continue, I will explain this to you.
  • Portability: you can ask me to provide an electronic copy of certain personal data to you or another organisation.
  • Complaints: if you are unhappy with how I handle your personal data, you can complain to the Office of the Data Protection Commissioner, but I hope you will contact me first so I can try to resolve your concerns.

11. When I send you messages

11.1 If you have consented to receiving updates from me, you can opt out at any time via the link in my messages or by contacting me.

11.2 Opting out of updates will not affect the messages I need to send you to arrange your sessions or to meet a legal or professional obligation.