Data Protection & Privacy Policy

This Policy sets out how The Rooted Way Pte Ltd ("The Rooted Way", "I", "me") collects, uses, protects, and handles your personal data in accordance with Singapore's Personal Data Protection Act 2012 (PDPA). It applies to all personal data collected through this website, in the course of counselling sessions, and through any related communications.

1. What personal data I collect

To provide counselling services and manage our working relationship, I may collect:

• Contact and identity details: full name, preferred name, date of birth, age, email address, mobile number, residential address, and postal code
• Background information: gender, nationality, race, religion, highest education level, occupation, marital status, and number of children
• Referral information: how you heard about The Rooted Way and, where relevant, the name of the person or organisation who referred you
• Intake and session information: the concerns bringing you to counselling, how long you've experienced them, what you hope to achieve, relevant personal history, and anything you choose to share in sessions
• Health information: previous counselling, therapy, or psychiatric support; any mental health diagnoses; prescribed medication; and details of any GP, psychiatrist, or other healthcare provider currently involved in your care
• Safety information: current or past thoughts of suicide, self-harm, or harm to others, and anything else relevant to your safety and wellbeing
• Emergency contact details: the name, relationship, mobile number, and email address of the person you nominate
• Administrative records: session dates, mode of session, attendance, payment records, and your signed consents and declarations
• Communications: emails, WhatsApp messages, and enquiry form submissions exchanged before, during, or after our work together

Health and safety information is collected only to assess whether counselling with me is appropriate for you and to support you safely. It is held with the highest level of care.

Personal data about other people

Where you give me personal data about someone else (an emergency contact, a family member who is also a client, or the person who referred you), you confirm you have their consent to share it. I use it only for the purpose it was given.

2. Why I collect your personal data

Your personal data is used to:

• Provide counselling services and support your therapeutic goals
• Schedule and manage appointments
• Process payments and issue receipts
• Communicate with you about your sessions
• Maintain clinical records as required by professional and legal standards
• Comply with applicable Singapore laws and regulations

Some of what I collect at intake is used for specific, narrower purposes:

• Date of birth and age: to confirm you are 18 or over
• Nationality, race, and religion: to practise in a culturally responsive way. Your cultural background and beliefs shape how you understand your situation, what support feels appropriate, and what you may or may not want explored. Knowing this from the outset means I can work with it rather than assume it.
• Education, occupation, marital status, and number of children: to understand the life and work demands you are carrying, which is often directly relevant to what brings you to counselling
• Residential address and postal code: for practice records, invoicing, and to establish your location during online sessions in the event of a clinical emergency
• Referral source: to acknowledge referrers, to identify any conflict of interest or dual relationship, and to understand how people find the practice
• Whether a family member is also a client: to identify and manage any conflict of interest before your case is accepted

Most fields on the intake form are required, because each one informs how I assess whether counselling with me is appropriate for you. If you'd prefer not to answer something, tell me and we'll discuss it.

Where you confirm on your intake form that your mobile number is contactable on WhatsApp, I may use WhatsApp alongside email for scheduling and administrative matters: appointment confirmations, reminders, and changes. WhatsApp is not used for counselling content, clinical discussion, or emergencies. You can withdraw your consent to WhatsApp contact at any time by telling me, and I'll use email only.

3. Confidentiality

Everything you share in sessions is held in strict confidence. This is a cornerstone of the counselling relationship.

Your session content, clinical notes, and personal information won't be shared with anyone without your written consent — including family members, employers, or other third parties.

Limits to confidentiality

There are limited circumstances where I may be required to share information without your consent:

• Where there is a serious and credible risk of harm to you or another person
• Where there is reasonable suspicion of abuse or neglect of a child, vulnerable adult, or elderly person. I am legally required to report this under the Children and Young Persons Act (CYPA) and relevant legislation
• Where a valid court order or legal obligation requires disclosure

Where possible, I'll discuss this with you before any disclosure. My aim is always to act in your best interest while meeting my legal and ethical obligations.

Session content may occasionally be discussed with a clinical supervisor in an anonymised form, for quality assurance and professional development. Supervisors are bound by the same confidentiality obligations.

4. How I protect your personal data

I take reasonable steps to protect your personal data from unauthorised access, loss, or misuse. This includes:

• Storing records in secure, password-protected systems
• Using encrypted platforms for online sessions
• Limiting access to your data to myself and, where necessary, authorised administrative support bound by confidentiality
• Secure handling and disposal of physical records
• Keeping WhatsApp use to scheduling and administrative matters only, with message histories cleared periodically and no group chats involving clients

No method of digital transmission or storage is completely secure. If you have concerns about how we communicate, please let me know and we can discuss alternatives.

5. How long I keep your data

I retain personal data and clinical records for a minimum of 7 years from the date of your last session, in line with professional guidelines and Singapore law.

After the retention period, records are securely destroyed. Data that is no longer needed for the purpose it was collected is deleted or anonymised.

6. Online sessions

Online sessions are conducted via secure, encrypted platforms designed for confidential communications. The same confidentiality standards apply as for in-person sessions.

Please ensure you join from a private space with a secure internet connection. I'll do the same on my end.

Sessions are not recorded without your explicit written consent.

7. Transfer of data outside Singapore

Your personal data is held in Microsoft 365 and stored at rest in Microsoft's Asia Pacific region, which may include datacentres outside Singapore. Microsoft is contractually bound under its Data Protection Addendum to protect it to a standard comparable to the PDPA.

If you are paying from outside Singapore and choose to pay by card, PayPal processes that payment outside Singapore under its own privacy terms and PCI-DSS security standards. I never hold or store your card details.

Apart from these arrangements, I don't transfer your personal data outside Singapore. If it ever became necessary, I'd seek your consent first and take steps to ensure comparable protection.

8. Your rights

Under the PDPA, you have the right to:

• Access a copy of the personal data I hold about you
• Request corrections to any inaccurate information
• Withdraw your consent to the collection, use, or disclosure of your personal data

Please note: withdrawing consent may affect my ability to continue providing services to you. I'll let you know if that's the case before acting on your request.

A reasonable fee may apply for access requests, depending on complexity. I'll inform you of any fee before processing.

I'll respond to requests within 30 calendar days of receiving them. If I'm unable to do so within that timeframe, I'll notify you in writing and let you know when you can expect a response.

9. Data Protection contact

If you have questions about how your personal data is collected, used, or disclosed, or you wish to exercise any of the rights above, please contact the Data Protection Officer:

The Rooted Way Pte Ltd (UEN 202632746R)
Data Protection Officer
Email: support@therootedway.com.sg

I aim to acknowledge your request promptly, and will respond in full within 30 calendar days.

10. Changes to this policy

I may update this policy from time to time. The latest version will always be available on this website. Your continued use of The Rooted Way's services after any changes constitutes your acceptance of the updated policy.