Privacy policy

This proposed policy describes how this website handles information. It is not a claim that registrations, suppliers or international transfers have been approved.

Who is responsible

Humura Counseling is the proposed controller for enquiries and appointment administration. Use the practice contact details below to ask a privacy question without sending health information.

The legal controller identity, NCSA registration number, privacy contact and any required EU representative are to be confirmed pending verification.

What the website asks for

A booking request asks for a first name or nickname, a contact channel, session type, format, language and preferred times. Paid-session requests also ask for a payment preference, not payment credentials. There is no booking free-text field.

The contact form asks for administrative contact details, a topic and a message. Please do not include diagnoses, medical records or other sensitive details. Contacting a counseling service can itself reveal sensitive information.

The site is not a clinical records system and has no client account or website database for session notes. Clinical records and payment records, if created by the practice, are separate and need their own care privacy information.

Why information is used

The proposed purposes are responding to an enquiry, arranging a session request or appointment, preventing abuse and maintaining site security. Submitting a request does not start therapy or make a payment.

The form asks for agreement to use the supplied details to respond. The appropriate legal basis for each purpose, any special-category processing and care-related obligations must be confirmed by counsel; consent wording alone is not proof of compliance.

How a request reaches Humura

When you send the booking or contact form, the website checks the details on its server and forwards them by email to the practice mailbox ([email protected]). The website does not keep a copy of your request in a database or log file. To limit spam it briefly keeps a scrambled (hashed) version of your network address and a counter, which is deleted automatically.

The site uses HTTPS, server-side validation, a spam trap and request limits. No security measure can guarantee absolute confidentiality. Required operational controls, account access and incident procedures remain subject to launch verification.

Personal details are never placed in page addresses (URLs). The web host may keep standard technical access logs (such as network address, time and page requested) for security.

Suppliers and transfers

The website host is to be confirmed and the practice mailbox provider is to be confirmed. Their contracts, processing locations, access and retention must be verified.

The website uses no analytics, advertising or tracking services, and loads its fonts and scripts from its own server rather than from third parties.

WhatsApp is an external Meta service. Opening WhatsApp, email, map directions or a payment link takes you to a separate provider with its own privacy terms. No WhatsApp chat or map is embedded on this page.

International processing may occur outside Rwanda. Required safeguards, NCSA authorisation and any GDPR transfer mechanism are to be confirmed. No approval is asserted by this draft.

Retention and your choices

Enquiry emails, provider logs, security records, clinical records and payment records need separate retention periods. Those periods and deletion responsibilities are to be confirmed; no invented thirty-day deletion promise is made.

Subject to applicable law, you may request access, correction, deletion, restriction, objection or portability, and withdraw consent where consent is the basis. Withdrawal does not undo lawful earlier processing. Contact Humura for a secure request process rather than sending identity documents in the general form.

You may complain to Rwanda’s National Cyber Security Authority, and to a competent European authority where GDPR applies. Response deadlines and authority contact details require legal verification before launch.

Confidentiality, children and incidents

Counseling confidentiality and its possible safeguarding or legal limits must be explained directly before care begins. The website cannot promise absolute secrecy, including where there is an immediate risk to life or a legal disclosure duty.

For children and teenagers, guardian authority, the young person’s agreement and information-sharing rules must be confirmed before care. Do not submit a child’s clinical history in a general enquiry.

A breach response plan, including any applicable notification duties and deadlines under Rwanda law or GDPR, must be approved before launch. This draft does not claim an operational certification.

Cookies, updates and unresolved details

The website does not set cookies and uses no advertising pixels, analytics or behavioural tracking. If that ever changes, this policy will be updated first.

Proposed version 0.1, dated 29 October 2026. Effective date, processor register, retention schedule and legal approval are to be confirmed. Material changes should be dated and explained here.