About this Privacy Policy

This Privacy Policy explains how I collect, use, store and protect personal information when you contact me or work with me for counselling, coaching or mentoring.

I am a self-employed practitioner and Nine Keys is based in Sweden, where I live and work. I am the data controller for the personal information I collect and use in connection with my practice. I aim to collect only the information that is reasonably necessary for our work and to keep it secure.

This Privacy Policy should be read alongside my Counselling, Coaching and Mentoring Agreement.

What information I collect

I aim to collect the minimum information reasonably necessary to provide our work safely and professionally.

This may include:

• your name;
• your contact details;
• your current location, where relevant to safe online working;
• information needed to arrange appointments and payments;
• information you choose to share about yourself and the reasons you are seeking support;
• relevant information about your health or wellbeing where this is necessary for our work;
• an emergency contact, where appropriate.

You do not need to provide a full medical or psychiatric history. You are also not required to tell me anything about your diagnosis, neurodivergence, medication, relationships, sexuality, gender or other personal circumstances unless you wish to and it is relevant to our work.

If you choose to share information about your physical or mental health, this may constitute special category personal data under the GDPR and will be handled with the additional protection required by data-protection law.

Why I use your information

I use your personal information to:

• communicate with you;
• arrange and manage sessions;
• provide counselling, coaching and mentoring;
• understand the context in which you are seeking support;
• maintain appropriate professional records;
• arrange payment;
• meet my professional, legal and insurance responsibilities;
• seek professional supervision;
• respond appropriately if I have serious concerns about your safety or someone else’s safety.

I will not sell your personal information or use it for advertising.

The legal basis for processing your information

Under the General Data Protection Regulation (GDPR), I need a lawful basis for processing personal information.

Depending on the circumstances, I may rely on:

• performance of our agreement – for example, using your contact details to arrange and provide sessions;
• legal obligations – where I am required to retain or provide information by law;
• legitimate interests – where processing is reasonably necessary for the appropriate administration and professional operation of my practice and your rights do not override those interests;
• consent – where I specifically ask for your consent for a particular use of your information.

Where I process special category information, such as health information, an additional legal condition under the GDPR is required. I will only process such information where an appropriate legal basis and special category condition apply.

 Confidentiality

I will treat what you share with me as confidential.

There are limited circumstances in which I may need to share information, for example where:

• I have serious concerns about your immediate safety;
• I have serious concerns about another person’s safety;
• I am legally required to provide information;
• sharing information is necessary to respond appropriately to an emergency.

Where possible, I will discuss this with you first. I will only share information that is reasonably necessary for the situation.

Professional supervision

I receive regular professional supervision as part of my professional practice.

I may discuss aspects of my work with you with my supervisor in order to reflect on and maintain the quality and safety of my practice. I will take reasonable steps to protect your identity and will not provide my supervisor with recordings or transcripts of our sessions – as I will never record or make transcripts of our sessions.

How your information is stored

I use appropriate security measures to protect the information I hold, including password protection, device security and restricted access to my paper records. I am the only person who routinely accesses my professional records.

• Electronic records: your contract, necessary professional records and relevant correspondence may be stored electronically on my secure professional devices and accounts.
• Paper records: if I make paper notes, these are stored securely when not in use.
• Email or other means of communication: we may use email for administration and communication – or a platform of your choice such as Signal, Telegram, WhatsApp etc. These messages may remain within our respective email accounts/other electronic platform until they are deleted in accordance with my retention arrangements and the relevant provider’s systems.

Please avoid sending highly sensitive information by ordinary email unless we have agreed that this is appropriate.

Online sessions and technology

Where my services are provided remotely, we will agree which platform to use for our sessions. I may use services such as email, phone, WhatsApp, Proton Meet, Google Meet.

I recommend Proton Meet as my preferred video platform and Proton Mail as my preferred email service for confidentiality reasons.

You are welcome to chose alternative means of communication, depending on what you feel most comfortable with.

If we use WhatsApp, Signal, Telegram, Proton Meet or another third-party service, that service may process some technical information in accordance with its own privacy policy and terms. I do not control the data processing carried out by these companies. Because you are located in China, access to international online services may also vary.

Note about AI

Some clients choose to use AI-based apps or chat tools that offer emotional support or therapy-like conversations. These are separate from, and not part of, the counselling I provide.

AI tools do not know you as a person over time, do not hold a duty of care, and cannot reliably recognise risk or crisis. They may sound confident even when they are inaccurate. Anything you share with them may be stored or used in ways that fall outside our confidentiality and my control.

I retain full professional responsibility for the care I provide. My decisions are made through professional judgement and ethical training, and are not handed to AI systems. If you use AI tools for personal support, you are warmly encouraged to bring this into our work, so we can reflect together on how it may be affecting you. This is an invitation, never a judgement.

No recording or transcription

I do not record our sessions. I do not:

• make audio or video recordings;
• create transcripts;
• use automated transcription;
• use AI meeting notes;
• use AI to analyse our sessions;
• keep recordings or transcripts of our work.

There will therefore be no recording or transcript of our sessions retained by me. I may make brief professional notes on paper, where necessary, for my practice, supervision, professional responsibilities or safety.

International data processing

I live and work in Sweden, and provide our sessions from Sweden. 

If you are located outside of the EU-EEA, where I use technology or service providers that process personal information outside the EU/EEA, the requirements of the GDPR concerning international transfers may apply.

Where applicable, I will use an appropriate legal mechanism for such transfers, such as an adequacy decision or appropriate safeguards such as the European Commission’s Standard Contractual Clauses. I will also consider whether additional safeguards are necessary.

The GDPR places specific requirements on transfers of personal information outside the EU/EEA. Some third-party providers may have their own international processing arrangements, which are outside my direct control.

Working with clients outside Sweden

I may provide remote services to clients who are physically located outside Sweden. If you are located outside Sweden, I may need to know your current country or location because this can be relevant to:

• safe online working;
• emergency arrangements;
• professional insurance;
• applicable regulatory requirements;
• international data processing.

Wherever you are based when we start our work together, if you move to another country or are temporarily located somewhere different for a significant period while we are working together, please let me know.

How long I keep your information

I keep personal information only for as long as reasonably necessary.

I currently retain relevant professional records for up to seven years after the end of our work together, unless a different period is required by applicable professional, legal, insurance or accounting requirements. After the relevant retention period, information will be securely deleted or destroyed.

Session recordings and transcripts are not retained because I do not make them.

Your rights

Under applicable data-protection law, you may have rights including:

• to know what personal information I hold about you;
• to request access to your information;
• to ask me to correct inaccurate information;
• in certain circumstances, to ask me to delete information;
• in certain circumstances, to ask me to restrict how your information is used;
• to object to certain uses of your information;
• to withdraw consent where I am relying on your consent as the legal basis for a particular use.

These rights are subject to certain legal exceptions.

GDPR requires data controllers to provide clear information about how personal information is processed and about the individual’s rights. If you would like to exercise one of these rights, please contact me at: [email protected].

Data breaches

I take reasonable steps to protect your personal information. If I become aware of a personal-data breach, I will assess what has happened and take appropriate steps to contain and address it. Where applicable law requires notification to a supervisory authority or to you, I will make the necessary notification within the required timeframe.

Questions, concerns or complaints

If you have any questions about how I use or protect your personal information, please contact me directly:

• Nina Shah – Nine Keys / [email protected]

If you are unhappy with how I have handled your personal information, please contact me first so that I can try to resolve your concern. You may also have the right to complain to the relevant data-protection supervisory authority. As I am based in Sweden, the Swedish Authority for Privacy Protection (IMY) is the relevant Swedish supervisory authority for data protection. If you are based in the UK, you can consider contacting the ICO as I am registered with them for UK client work.

Agreement

By proceeding with counselling, coaching or mentoring, you confirm that you have been given access to this Privacy Policy and have had an opportunity to ask questions about how your personal information will be handled.

Please note

When you read through your contract and my GDPR policy, please ask me anything you are not sure about. Agreeing to the contract confirms that you agree to the terms of this GDPR statement and to the terms of the contract.

Disclaimer

This document outlines what I have done to ensure the confidentiality of your data and personal information, according to legal requirements. However, it is important to be aware that I do not have control over external software, apps or service providers, including those that you use. As such, it is important that you are happy with the services you use at your end. In addition, there are sometimes rare and unforeseen data breaches over which I have no control, such as hacking incidents.