Privacy Notice

Last updated: 09/01/25

1. Who We Are

This client portal is operated by Regina Lynch (Gina), a counsellor based in Northern Ireland and a member of the British Association for Counselling and Psychotherapy (BACP).

Personal data is processed in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

In-person counselling services are provided in Northern Ireland. Online counselling services are available to clients within the UK and internationally, subject to professional, legal, and ethical considerations.

2. Purpose of the Client Portal

This portal is used to:

• Book and manage counselling appointments (online and in person)
• Store contact and scheduling information
• Enable secure messaging related to appointments
• Facilitate payments for sessions
• Store therapeutic notes securely, accessible only to the counsellor

The portal is separate from the counselling contract and informed consent documentation.

Date of birth is collected to confirm age, apply appropriate safeguarding measures, determine consent requirements, and meet professional and legal obligations.

3. Personal Data Collected

We collect only the information necessary to operate the portal.

Administrative & Contact Data

• Name
• Date of birth
• Email address
• Phone number

Children & Young People

• Child or young person’s name
• Child or young person’s date of birth
• Parent or legal guardian’s name
• Parent or legal guardian’s email address
• Parent or legal guardian’s phone number

Appointment Information

• Date and time of sessions
• Type of session (e.g. initial assessment, online counselling, in-person counselling)

4. Therapeutic Notes & Special Category Data

The portal may be used to store therapeutic notes and counselling records.

This information is classed as special category personal data under UK GDPR.

• Access is strictly limited to the counsellor
• Therapeutic notes are not shared with third parties
• Records are stored securely in accordance with professional standards
• Therapeutic records may include identifying details such as date of birth where clinically relevant

5. Lawful Basis for Processing

Administrative and Portal Data

• Article 6(1)(b) – Contractual necessity
• Article 6(1)(f) – Legitimate interests
• Payment processing is necessary for the performance of a contract

Therapeutic Records (Special Category Data)

• Article 9(2)(h) – Health or social care purposes
• Article 6(1)(b) – Performance of a contract

6. Confidentiality

All personal data is handled in accordance with the BACP Ethical Framework.

Confidentiality may only be broken where required by law or where there are safeguarding concerns or a serious risk of harm to the client or others. These limits are explained more fully within the counselling agreement.

Safeguarding responsibilities apply regardless of whether counselling is provided in person or online.

7. Communications

• Email notifications contain minimal administrative information only
• Clients are discouraged from sharing sensitive personal information via email
• Secure internal messaging and phone communication are available
• Video call platforms are agreed directly with the client

The portal is not an emergency service.

8. Third-Party Services

Google Workspace (Calendar)

Google Calendar is used for appointment scheduling only. Client identities are replaced with a unique reference (UUID). Only the appointment date, time, and type of session are recorded. No identifiable client information is shared.

Stripe (Payments)

Payments are processed securely using Stripe.

When making a payment, Stripe will collect and retain payment card or payment method details as necessary to process the transaction and any future authorised payments.

We do not receive or store full payment card details. We may retain a Stripe customer ID to allow future payments to be taken where authorised.

Stripe acts as an independent data controller in relation to payment information and processes personal data in accordance with its own privacy notice and data protection obligations.

No therapeutic data is shared with third-party service providers.

9. Data Security

Appropriate technical and organisational measures are in place to protect personal data, including secure authentication, access controls, and restricted access to therapeutic records.

10. Data Retention

• Administrative and booking data is retained only for as long as necessary for service provision and legal obligations
• Therapeutic records are retained in line with BACP guidance, legal requirements, and professional indemnity insurance obligations

For children and young people, records are typically retained until the individual reaches adulthood plus the required retention period.

11. Your Rights

Under UK GDPR, you have the right to:

• Access your personal data
• Request correction of inaccurate data
• Request erasure (where applicable)
• Restrict or object to processing
• Request data portability

To exercise these rights, please contact the counsellor directly.

12. Complaints

If you have concerns about how your personal data is handled, please raise these with the counsellor in the first instance.

You also have the right to complain to the Information Commissioner’s Office (ICO).

13. Changes to This Notice

This Privacy Notice may be updated from time to time. The most recent version will always be available through the client portal.