Privacy Notice

This notice explains what you share when you fill in the intake form, why it is asked for, where it goes, and how long it stays. This is not an ordinary contact form. It asks about the most private parts of your life, and you have a right to know what you are entrusting them to. Please read it before you fill the form in.

1. Who the data controller is

The controller is Onour Impram, acting as an individual, and the clinical work is carried out by the same person. Onour Impram LTD is currently being incorporated in the United Kingdom for this service. Once incorporation completes, that company becomes the controller, its registration number and registered address will be published on this page, and this section will be re-dated. Only the legal form of the controller changes: who sees your data, where it sits, and how long it stays all stay the same.

For any question, request, or complaint about this notice, write directly to [email protected].

2. What is collected

The intake form collects four kinds of information.

Identity and contact details. Your name, age, gender, marital status, email address, phone number, where you live, and anything else that identifies you and lets me reach you.

The context of your request. Why you are getting in touch, where you are in your life right now, your work and study situation, your close relationships, and whether you have had counselling or therapy before.

Health information. Your mental and physical health history, medication, diagnoses, and any history of self-harm or suicide attempts.

Your spiritual orientation. One question asks you to say a little about your spiritual practice, if you have one. I ask it clinically, because the place where a person makes meaning is often the place that holds them when things get hard. I am not assessing what you believe, only trying to understand what helps you.

Those last two groups are what data protection law treats as a special category: health data and data revealing religious or philosophical beliefs carry the same stronger protection. For your health information you will see its own tick box on the form. I do not bundle permissions into a single box, because consent that is bundled is not really consent.

The question about spiritual orientation does not yet have a tick box of its own. You do not have to answer it.Even though the form marks it as required, you can simply write “prefer not to say” and move on. It will not affect your request in any way, and I will not read anything into it.

What you tell me about others. The form asks about your family: who they are, and whether there is chronic illness in the family. Those answers carry information about other people. I hold them only as your account of them, as part of the clinical picture. I do not contact the people you mention, I do not open a separate record about them, and I do not use this information anywhere outside your own file.

3. Why I ask for it

I process this information for five things: to consider your request and decide with you whether an intake conversation makes sense; to prepare for that conversation, so you are not made to answer the same questions again from scratch; to refer you on if somewhere else would serve you better; to act on your safety if I see an immediate and serious risk to life; and to handle scheduling and correspondence.

This data is never used for marketing, never added to any list, never sold, never turned into research or teaching material, and never used as training data for AI tools.

4. Legal basis

The basis for processing is your explicit consent — and it has two layers, because the law keeps them apart. For ordinary information such as your name, your contact details and the context of your request, a single consent is enough. Your health information and your spiritual orientation count as special category data; for those the law requires a separate consent, given separately. The second layer is not folded into the first, which is why the form does not gather everything under one checkbox. Consent is voluntary: you may decline. But consent covering health information is necessary for the form to be completed, because without it I cannot responsibly assess whether an intake conversation is right for you.

One thing I should be honest about: consent really is a precondition of the form, so calling it voluntary does not by itself make it free. Let me say plainly what declining costs you. The only consequence is that that form is not completed. Nothing else follows: no record of you is kept, you are not flagged anywhere, and applying later does not become harder. And the form is not the only route — you can write to me directly by email or WhatsApp and we can talk about how to proceed. Consent is the door to the form, not the door to talking to me.

You can withdraw consent at any time, without giving a reason. One line to the address above is enough. Withdrawal does not make earlier processing unlawful, but it stops everything from that point on.

5. Who sees it, and where it goes

Only I see your responses. There is no secretary, no assistant, no team, no third person.

The form itself runs on Google Forms, which makes Google LLC a data processor holding this information on my behalf, and your responses may sit on servers outside the UK and Europe. Google is not permitted to use this data for its own purposes.

Replies are handled over email. The address you see belongs to my own domain. A message sent to it passes through Cloudflare's email routing service and lands in a Google Gmail mailbox; a reply going out to you is sent through an email delivery service called Brevo. So Cloudflare carries what comes in, Google stores it, Brevo carries what goes out, and all three act as data processors on my behalf.

Depending on what you prefer, I may also reply over WhatsApp or by phone. If you choose WhatsApp, the content of your messages is end-to-end encrypted: while a message is in transit, nobody — WhatsApp included — can read it. The messages do, however, remain on both phones afterwards, and the security of a device or its cloud backup is a separate question. Your phone number and the record of who messaged whom and when also reach Meta Platforms, which owns WhatsApp. If you would rather avoid that, we can keep everything to email. One sentence from you is enough.

Some of your data may rest on servers governed by a legal regime other than the one where you live. You consent to that transfer separately on the form.

I would rather not make that sentence sound more certain than it is, because I do not know which country either. Google does not tell me which data centre actually holds your responses, and there is no setting I can choose or monitor. So when I say "may be transferred abroad", I cannot name a country — and saying I do not know is better than pretending I do. What I do know: the basis for the transfer is your consent, the processor is Google, and when you withdraw consent I delete the data. If you need a guarantee about a specific jurisdiction, write to me before filling in the form; I would rather you decided knowing what I cannot promise.

6. How long it is kept

If counselling begins: your intake form responses become part of your clinical file, together with the handwritten notes I take during sessions. Clinical files are kept for as long as professional ethics and the law I work under require.

If counselling does not begin: your responses stay in the form. They are not deleted automatically after some period. I am writing that plainly here, because the one promise a document like this must never make is the one it will not keep.

If you want it deleted:write to me. If counselling has not begun, I delete your responses. If it has, I may be required to retain part of the clinical file; in that case I will tell you exactly what can be deleted and what has to stay, and why. The promise here is not "I delete everything immediately" — it is that I will not hide from you what exists.

7. The limits of confidentiality

Everything you share is held in confidence, within professional ethics and the law. That sentence has two separate limits, and they should not be mistaken for one another.

The first is my judgement.If I see an immediate and serious risk to life, your own or someone else's, safety comes first and I take the minimum necessary step. I am writing it here so that it is never a surprise.

The second is not left to my judgement. If a court or a competent authority acting under law requests information — or where the law requires a report, for instance when the safety of a child is at stake — my professional ethics alone cannot answer that request. Its exact scope depends on the law of the country you are in, and I cannot give an exhaustive list in this text; saying that I cannot is more honest than pretending I can. In the same way, if counselling has begun I may be required to retain part of the clinical file — that is the situation described in section 6.

Two things hold at both limits: what is shared stays limited to the minimum necessary, and I tell you first in every case where I am not legally prevented from doing so.

This site and this form are not an emergency service. If you do not feel safe, contact the emergency services where you are.

8. Your rights

You have the right to know whether your data is being processed, to receive a copy of it, to have it corrected if it is wrong or incomplete, to have it erased, to have processing restricted, to receive your data in a portable form, to object to processing, and to withdraw consent you have given. There is one route for all of them: write to the address above. I will respond within one month at the latest. Where to complain is set out in section 13.

This list has a limit, and I would rather not hide it from you: which data protection regime applies to you depends on where you are, and the regimes do not define these rights identically — some are drawn wider in one regime and narrower in another. So I would rather you read the list above not as "the law grants you these" but as my undertaking: whichever regime applies, I act on this list rather than on the narrower one. The month, likewise, is not the maximum some statute allows me — it is the ceiling I set for myself.

9. Cookies and measurement

This site sets no tracking cookies, runs no third-party tracking scripts, and collects no visit statistics. The only cookie it sets is functional: NEXT_LOCALE, which records the language you chose. It does not identify you, it does not record what you do, and it is not used for any measurement or advertising.

Beyond that, the one exception is the Google Forms frame embedded on the intake page. What happens inside that frame is governed by Google's own rules, and its own cookies may be used there. The form is not a separate address but a frame inside that page, and it only loads once you scroll towards it — if you open the page and stay at the top, no request reaches Google at all. Everywhere else on this site, no cookie is set on your device other than the language cookie above.

10. Security

The record I keep about you consists of two things: your intake form responses and the handwritten notes I take during sessions. I use no other record, database, or client management system. The handwritten notes are not held anywhere connected to the internet; the form responses sit on Google's servers, and only I have access to them. Even so, no system is ever completely secure.

11. Age

If you are under 18, you can get in touch with the knowledge and consent of a parent or legal guardian, and the counselling itself proceeds within that consent. Please talk to your family before filling in the form: without that consent I cannot process information about you, which is a legal boundary as much as it is part of how I work.

12. Automated decisions and profiling

No automated decisions are made about you and no profiling is carried out. A human being, meaning me, reads your form. There is no AI system on this site that talks to you, processes your data, or generates replies to you. If that ever changes, this notice changes first.

13. Where you can complain

If you are not satisfied with my response, you may complain to the data protection authority in your country. In Türkiye that is the Personal Data Protection Authority (KVKK Kurumu). In the European Union, it is the supervisory authority of your own country. Once the company is incorporated, the United Kingdom supervisory authority, the Information Commissioner's Office (ICO), will also be available to you.

This notice is written in GDPR form and is intended to meet the disclosure duty under KVKK as well if you are in Türkiye. I am not claiming that the list in section 8 reproduces any one statute article-for-article — the regimes do not draw the same boundaries, and deciding which right belongs to which regime is a lawyer's call, not mine. What I can commit to is simpler: where more than one regime could apply, I follow whichever gives you more protection, and in every case I act on the list in section 8.

Let me say this plainly: this notice has not been reviewed by a lawyer. I have tried to describe my actual practice as honestly as I can, but whether a document meets the law is not something its own author can certify. If you find something missing or wrong, write to me — I will correct it, and I will tell you what I changed.

14. Updates

This notice is updated as practice changes. You are reading version 2.0. I put a version number on it so that which text you consented to does not become a guess later; a substantive change increases this number. Last updated: 2 August 2026.