That implies you're keeping such information with my session (across requests). Is that the case? I may just be misunderstanding.

If so, you need to encrypt it first. Storing sensitive data in the user's session is akin to writing it to disk in plaintext.