Privacy & Cookie Policy

Last updated: 14 July 2026

This Privacy Policy explains how Barnardt & Fleming Private Practice (“we”, “us”, “our”, or “the practice”) collects, uses, shares and protects your personal information when you visit www.barnardtfleming.com or contact us. We are committed to protecting your privacy in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”) and the ethical rules of the Health Professions Council of South Africa (HPCSA).

1. Who is responsible for your information

The responsible party is Barnardt & Fleming Private Practice, a clinical psychology practice based in Cape Town, South Africa, comprising clinical psychologists Kirsten Barnardt and Karen Fleming.

Information Officer: Karen Fleming
Privacy contact: karen@barnardtfleming.com / kirsten@barnardtfleming.com
Practice address: 33 Church Street, Cape Town City Centre, Cape Town, 8000, South Africa

2. The information we collect

Information you give us

When you email us to make an enquiry or arrange an appointment, we collect the information you choose to share, such as your name, email address, contact details and the reasons you are seeking therapy.

Clinical information

If you become a client, we collect and keep clinical records as part of providing psychological services. This may include health information, personal history and session notes. This information is treated as confidential and is protected by professional confidentiality and POPIA.

Information collected automatically

When you visit the website, our hosting provider may automatically log limited technical information (such as your IP address, browser type and pages visited) to keep the site secure and running. We do not use this information to identify you personally.

3. Why we process your information and our lawful basis

• To respond to your enquiries and arrange appointments;
• To provide psychological and therapeutic services;
• To keep clinical records as required by the HPCSA and applicable law;
• To meet our legal, ethical and professional obligations;
• To keep the website secure and functioning.

We process your information on the basis of your consent, the performance of a service you have requested, compliance with a legal or professional obligation, and our legitimate interests in operating the practice responsibly.

4. Special personal information (health information)

Information about your health is “special personal information” under POPIA. We process it because it is necessary for the provision of health services by, or under the responsibility of, a registered health professional, and subject to an obligation of confidentiality. We will not use your health information for any purpose other than providing your care, unless the law requires it or you give us your consent.

5. Cookies and similar technologies

Our website uses only the cookies and similar technologies described below. We keep tracking to a minimum and do not currently run online advertising.

• Essential functionality: your browser may store limited local data needed for the site to display correctly. These are not used to track you.
• Fonts: our pages load typefaces from Google Fonts. When they load, your IP address is shared with Google to deliver the font files. Google’s handling of this data is governed by its own privacy policy.
• Analytics: We use Google Analytics and Google Search Console to understand how visitors find and use our website so we can improve it. These tools may set cookies and collect information such as the pages you visit, approximate location and device type. This information is used in aggregate and is not used to identify you personally.
• Advertising: We do not currently run online advertising. If we use Google Ads in future, we may use advertising and remarketing cookies to measure and improve our campaigns, and we will update this policy accordingly.

You can control or delete cookies through your browser settings. Disabling essential storage may affect how the site displays.

6. Who we share your information with

We do not sell your personal information. We share it only where necessary, and with appropriate safeguards, including:

• Service providers (operators) who help us run the practice — for example our website hosting provider (Vercel), our email provider, and the secure video-consultation platform we use for online sessions;
• Clinical documentation tools — where used, and only with your specific consent, secure third-party tools that assist with clinical note-taking and documentation, governed by a separate consent form;
• Healthcare providers such as your GP or psychiatrist, only with your consent;
• Medical aid schemes where you ask us to provide documentation for a claim;
• Authorities or third parties where we are legally or ethically required to disclose information (for example, a serious risk of harm or a lawful court request).

7. Cross-border transfers

Some of our service providers may store or process information on servers located outside South Africa. Where this happens, we take reasonable steps to ensure your information is protected by a comparable level of security and in line with POPIA.

8. How we protect your information

We use appropriate technical and organisational measures to protect your information, including encrypted platforms for sessions and records, restricted access, and professional confidentiality. No method of transmission over the internet is completely secure, so we cannot guarantee absolute security, but we take your privacy seriously.

9. How long we keep your information

We retain your personal information only for as long as necessary to fulfil the purposes described in this Privacy Policy and to meet our legal, ethical and professional obligations. Clinical records are retained in accordance with the Health Professions Council of South Africa (HPCSA) Guidelines on the Keeping of Patient Health Records. In general, records are retained for a minimum of six (6) years from the date of your last consultation, with longer retention periods where required by law or professional guidelines, including in relation to records concerning minors. Enquiries that do not result in the commencement of psychological services are retained only for as long as reasonably necessary and are then securely deleted.

10. Your rights under POPIA

Subject to certain legal limits, you have the right to:

• Ask what personal information we hold about you and request access to it;
• Ask us to correct or update information that is inaccurate or incomplete;
• Ask us to delete information where we are no longer entitled to keep it;
• Object to certain processing of your information;
• Withdraw consent you have given (this will not affect processing that already took place);
• Lodge a complaint with the Information Regulator.

To exercise any of these rights, please use the privacy contact details above.

11. Complaints to the Information Regulator

If you believe we have not handled your personal information lawfully, you may lodge a complaint with the Information Regulator (South Africa):

Information Regulator (South Africa)
Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
Telephone: 010 023 5200
General enquiries: enquiries@inforegulator.org.za
POPIA complaints: POPIAComplaints@inforegulator.org.za
Website: inforegulator.org.za

12. Changes to this policy

We may update this Privacy Policy from time to time. The latest version will always be available on this page, with the “last updated” date shown above.

13. Contact us

For any questions about this policy or your personal information, email karen@barnardtfleming.com or kirsten@barnardtfleming.com.