This notice explains how I handle personal information when you visit my website, contact me or attend therapy. My practice works with adults.
Who is responsible for your information?
I am Conor Donaghey, the data controller responsible for information used in my practice.
Phone: 089 954 4928
Email: conordonagheypsychotherapy@gmail.com
You can contact me using these details with questions or requests about your information.
Enquiries and website use
When you contact me by email, telephone, text, WhatsApp or a website enquiry form, I may receive your name, contact details and whatever information you include in your message. I use this to respond, discuss availability and arrange appointments.
Please keep initial messages brief and avoid sending detailed health information or sensitive disclosures through these channels. They are for enquiries and practical arrangements, rather than therapy or emergency support.
My website is hosted by Netlify. Hosting services may process technical information, such as IP addresses and request logs, to deliver and secure the website.
Website enquiries are checked by a server-side process on Netlify before they are stored. That check confirms required fields are present, rejects automated submissions, and limits how often the same network address can send messages. Verified enquiries are then stored by Netlify Forms, which uses Akismet for spam filtering, and sent to my email account. Appointment requests also include your selected time or appointment preferences. Netlify also processes appointment requests and stores appointment availability and security records. Your enquiry details are handled separately from my clinical records.
Cookies, security and video hosting
This website does not set visitor tracking, analytics or advertising cookies. Website forms are protected against automated spam using server-side checks, a hidden honeypot field, rate limiting and Netlify’s spam filtering rather than third-party CAPTCHA cookies.
Some website videos are delivered by Cloudflare R2. Loading these videos sends technical request information, including your IP address, to Cloudflare. Fonts are hosted with the website. The website code does not include advertising or visitor analytics trackers.
Information collected during therapy
If you become a client, I may collect:
- Your identifying and contact details.
- GP and emergency contact details.
- Information relevant to assessment and therapy, including health information, relevant history and risk-related information.
- Brief session notes.
- Administrative records, including appointments, payments and signed agreements.
Even though I keep your name and contact details separately from session notes, those notes are still your personal information and are protected accordingly.
I collect information from you and, where appropriate and lawful, from other people involved in your care. Where this happens, I will explain the arrangement unless a legal exception applies.
Why I use your information
I use information to respond to enquiries, arrange and provide therapy, maintain appropriate records, manage payments and meet applicable legal responsibilities. Necessary records are also retained to meet my insurer’s requirements and deal with potential complaints or legal claims.
Providing information is your choice. However, without certain contact, assessment or safety information, I may be unable to arrange or provide therapy safely. I will explain what is needed and why.
Legal grounds for processing
For enquiries about starting therapy and delivery of agreed services, I rely on Article 6(1)(b) GDPR: taking steps at your request before entering a contract, or performing that contract.
For health information necessary to provide therapy, I rely additionally on Article 9(2)(h), subject to the applicable professional confidentiality requirements, including Article 9(3) and section 52 of the Data Protection Act 2018.
Where necessary to retain records or establish, exercise or defend legal claims, I rely on legitimate interests under Article 6(1)(f), together with Article 9(2)(f) where applicable. My interest is in maintaining necessary evidence and responding fairly to claims, balanced against your privacy rights.
For website delivery, spam prevention and security, I rely on legitimate interests under Article 6(1)(f). My interest is in operating a secure, reliable website and protecting enquiries from abuse, balanced against your privacy rights.
Where a specific law requires processing or disclosure, Article 6(1)(c) may apply, together with an appropriate additional condition where sensitive information is involved.
Where I rely on consent for a separate purpose, I will explain that purpose and how you can withdraw consent. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
Storage, communications and service providers
Clinical and identifying records are stored separately on encrypted, password-protected devices or drives. My work phone is password protected.
I use Gmail for email, a work phone for calls and texts, WhatsApp for messaging, Netlify for website hosting and enquiry forms, and Cloudflare for video delivery. Relevant information is processed by these providers as necessary to operate their services.
I restrict access to practice records. Service providers may process communications or technical information; this does not mean they have access to my separately stored clinical records.
International transfers
These providers operate internationally and may process communications or technical information outside the European Economic Area, including in the United States. The safeguards described in their published terms include European Commission adequacy decisions, including the EU–US Data Privacy Framework for covered transfers to certified organisations, and European Commission standard contractual clauses where required.
Netlify’s data protection information and Data Processing Agreement describe its processing terms and transfer safeguards. Google explains its safeguards in its data transfer framework information. WhatsApp describes its transfers and how to obtain its contractual safeguards in its EEA Privacy Policy. Cloudflare describes its international processing and safeguards in its Privacy Policy.
You can contact me for further information about the providers used in my practice and how to obtain a copy of the relevant safeguards.
How long information is kept
Therapy records: I retain necessary clinical and client records for ten years after therapy ends, as required by my professional indemnity insurer. They are then securely destroyed unless an ongoing legal or complaint matter requires longer retention.
Messages: Emails, text messages and WhatsApp messages are deleted from my accounts or devices within one month, whether or not you become a client. Where necessary, relevant information is first recorded in the separate client record and retained under the policy above.
Deleting a message from my accounts or devices does not remove copies held by its sender. Providers may also retain temporary or backup copies under their own arrangements.
Website enquiries and appointment requests: I delete enquiry copies from Netlify Forms and any appointment-request administration records within one month, as well as the related email notifications. Where information is needed for ongoing therapy, I first transfer the necessary details into the separate client record. This is a practice deletion policy; it does not mean the website automatically deletes submissions.
Technical and security records: These are kept for the time needed to operate the website, prevent abuse and investigate security incidents, subject to the hosting and security providers’ retention arrangements. They are separate from therapy records and enquiry messages.
Confidentiality and sharing
I treat your information as confidential. Information may be disclosed where necessary and lawful, including safeguarding responsibilities, a valid court requirement or serious risks to someone’s safety. Any disclosure is limited to what is necessary.
My client agreement explains the limits of confidentiality in more detail. Where appropriate and lawful, I will discuss a proposed disclosure with you.
I attend professional supervision. Client work is discussed without identifying details, with care taken to minimise the possibility of identification.
Your rights
Depending on the circumstances, you may:
- Request access to your personal information.
- Ask for inaccurate information to be corrected.
- Request erasure or restriction of processing.
- Object to processing based on legitimate interests.
- Request data portability where applicable.
- Withdraw consent where processing relies on consent.
These rights have conditions and exceptions. For example, a request to erase information may not override a justified need to retain records for legal claims.
Requests are normally handled free of charge and answered within one month. Where a permitted extension is necessary, I will explain this within that period.
Concerns or complaints
Please contact me if you have concerns about how I handle your information.
You may also complain directly to Ireland’s Data Protection Commission:
Changes to this notice
I will update this notice if my arrangements change. The current version will be available on my website and on request.