This explains what personal information I hold about you, why, and what rights you have over it. It is issued under Articles 13 and 14 of the GDPR.
Who is responsible
I am the data controller for your information. You can contact me at augustemoryraines@gmail.com. I have not appointed a Data Protection Officer, as a practice of this size is not required to.
What I collect
Contact details (name, address, phone, email), your date of birth, your GP's details, an emergency contact if you provide one, what you tell me about your health and circumstances, brief session notes, appointment and payment records, and any correspondence about your care.
Why I hold it, and on what legal basis
I process your contact and appointment information to provide and administer the service you have asked for, which is a contract between us under Article 6(1)(b).
Information about your health and personal circumstances is special category data. I process it under Article 9(2)(h), which covers the provision of health care by a professional bound by an obligation of professional secrecy, together with the Data Protection Act 2018.
Where I share information with someone outside the practice at your request, that is done on your explicit consent under Article 9(2)(a), recorded separately.
I keep financial records because tax law requires it, which is a legal obligation under Article 6(1)(c).
Who sees it
Nobody, in the ordinary course of the work. There is no administrative staff and no third party with routine access to your file.
The limited exceptions are my clinical supervisor, who discusses my work with me without your name or identifying details; Google, which hosts video sessions; and Tusla, An Garda Síochána, emergency services, or a court, in the circumstances set out in the Therapy Agreement.
I do not sell your information, use it for marketing, or make any automated decisions about you.
Information held outside the EEA
Google Meet is based in the US. Your information is transferred there under the EU-US Data Privacy Framework / Standard Contractual Clauses, and I have a data processing agreement in place. If you would prefer not to use this platform, tell me and we can discuss alternatives.
How long I keep it
Clinical records: seven years from your final session. Financial records: six years, as required by Revenue. After that, records are securely destroyed.
Your rights
You can ask for a copy of your records, which I will provide free of charge within one month. You can ask me to correct anything inaccurate. You can ask for erasure or restriction, though I may not be able to comply in full where I have a legal or professional obligation to retain records. You can object to processing, ask for your data in a portable format, and withdraw any consent you have given, which takes effect from that point onward.
Session notes may refer to other people. Where that happens I may need to redact those parts before releasing a copy.
To make any of these requests, contact me at augustemoryraines@gmail.com.
Complaints
If you are unhappy with how I handle your information, please tell me first. You also have the right to complain to the Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, or at dataprotection.ie.
Security
Records are held encrypted, on a password-protected device. Paper notes, where kept, are stored separately from your contact details.