Privacy Policy
Privacy Notice
Derek Flint Therapeutic Counselling
Last updated: 27 September 2026
About this notice
Derek Flint Therapeutic Counselling is the data controller for the personal information described in this notice. This notice covers the website and the wider client relationship, including enquiries, booking, Kiku, therapy records and administration.
60 Churchill Square, Kings Hill, West Malling, Kent ME19 4YU
Email: enquiries@derekflintcounsellingandpsychotherapy.com
Telephone: 07498 857698
Information collected
Depending on your contact with the practice, information may include contact and identity details; intake, assessment and enquiry information; appointment, attendance and payment records; brief clinical notes; health, mental-health, relationship, sexual-health, addiction or other sensitive information relevant to therapy; safeguarding/risk information; communications; information from a referrer, insurer, employer, EAP, family member or other relevant third party; and website/cookie/analytics information.
Therapy often involves special-category information. Only information reasonably necessary for the purpose is collected or retained.
How information is obtained and used
Most information comes directly from you. It may also come from someone arranging or funding therapy or another authorised/relevant source.
Information may be used to respond to enquiries; arrange consultations; assess suitability and work safely; provide therapy and continuity of care; manage appointments, reminders, cancellations and payments; maintain appropriate records; communicate with you; manage safeguarding, serious-risk or legal issues; obtain supervision; administer funded therapy; meet professional, insurance, accounting, tax and legal obligations; and operate and secure the website.
Lawful basis
Information needed to arrange and provide a service is generally processed because it is necessary to take steps at your request and/or perform the agreement with you. Legitimate interests may apply to running a safe, ethical and effective practice, maintaining records, protecting the practice and clients, and responding to enquiries. Legal obligation and vital interests may also apply.
Where health or other special-category information is used for therapeutic work, additional legal protections apply, including where processing is necessary for the provision of health or social care/treatment by a professional working under duties of confidentiality. Other conditions may apply where necessary, including safeguarding, legal claims or explicit consent.
Kiku and practice-management information
Kiku is used as a practice-management system for functions such as client administration, intake information, agreements, appointments, reminders and records where applicable. Derek Flint Therapeutic Counselling remains responsible for deciding what client information is needed and why it is used.
Clinical notes, retention and communications
Brief clinical notes are kept to support continuity of care and professional practice and are not intended to be a transcript of sessions. Unless there is a reason to retain information longer, client records are normally retained for six years after therapy ends. Where a client is under 18, records are normally retained for six years after their 18th birthday. Financial records may be retained for periods required by tax/accounting law.
Routine emails, texts, WhatsApp messages and similar correspondence are usually deleted within one month unless there is a legitimate reason to retain them.
Supervision and sharing
Clinical work is discussed in regular professional supervision. Wherever practicable, information is anonymised or minimised so clients are not identified. Supervision is confidential, subject to legal, safeguarding and ethical responsibilities.
​I am an accredited member of the National Counselling and Psychotherapy Society (NCPS). You can read its Code of Ethics on the NCPS website.
Therapy is ordinarily confidential. Information may be shared where you request or consent to it; limited information is necessary to administer funded therapy; there is a safeguarding concern or serious risk; disclosure is required by law; necessary for legal claims; or ethically justified following careful professional consideration. Wherever possible, this will be discussed with you first and disclosure limited to what is necessary and proportionate.
QuickBooks and financial records may contain payer/client names where reasonably necessary for bookkeeping, invoicing, reconciliation and statutory financial records. Clinical notes or therapy content are not stored in accounting records.
AI and digital tools
Digital tools may be used to support administration, website/content work and professional thinking. Artificial intelligence may also be used as a supplementary thinking or drafting aid.
AI is not used to make clinical, safeguarding or other significant decisions about you. There is no solely automated clinical decision-making or profiling.
Identifiable clinical information is not deliberately entered into general-purpose AI systems. Where AI is used for professional reflection or to develop general therapeutic material, information is anonymised or minimised so it does not include names, contact details, addresses, workplaces, dates of birth, family names, client communications, session notes or distinctive identifying combinations.
The therapist or practice remains responsible for professional judgement, clinical decisions and the accuracy and appropriateness of material produced with digital or AI assistance. Clinical supervision remains the appropriate professional forum for ethical, clinical and risk decisions.
Service providers and international processing
Reputable third-party services may be used for website hosting, forms, email, practice administration, accounting, communications, analytics and other necessary business functions. These providers may act as processors on behalf of the relevant practice.
Some technology providers operate internationally or use infrastructure outside the UK. Where personal information is transferred or made accessible outside the UK, appropriate arrangements are used as required by UK data protection law, which may include UK adequacy regulations or approved contractual safeguards.
Personal information is not sold.
Keeping information secure
Reasonable technical and organisational measures are used to protect personal information. No electronic system can be guaranteed to be completely secure.
If a personal data breach occurs, it will be assessed promptly. The Information Commissioner's Office (ICO) will be notified where the law requires this, normally within 72 hours of becoming aware of a reportable breach where feasible. If a breach is likely to create a high risk to your rights and freedoms, you will also be informed without undue delay.
Your data protection rights
Depending on the circumstances and lawful basis, you may have rights to access personal information held about you; correct inaccurate information; request erasure or restriction in some circumstances; object to certain uses; receive certain information in a portable format where applicable; and withdraw consent where consent is the lawful basis.
These rights are not absolute. Some information may need to be retained or processed despite a request, for example where there is a legal, regulatory, safeguarding, insurance or legal-claims reason.
You also have the right to complain to the Information Commissioner's Office (ICO). Information is available at ico.org.uk.
Website, cookies and analytics
The website is hosted using Wix. Website forms collect information you choose to submit. Cookies and similar technologies may be used for security, functionality and analytics. Where consent is required for non-essential cookies, choices can be managed through the website's cookie controls and Cookie Policy.
Changes to this notice
This notice may be updated when information handling, legal requirements or professional requirements change. The current version will be published on the website.