Privacy Notice
Last updated: 16/10/26
1. Who We Are
This client portal is operated by Regina Lynch (Gina), a counsellor based in Northern Ireland and a member of the British Association for Counselling and Psychotherapy (BACP).
Personal data is processed in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
In-person counselling services are provided in Northern Ireland. Online counselling services are available to clients within the UK and internationally, subject to professional, legal, and ethical considerations.
2. Purpose of the Client Portal
This portal is used to:
- Book and manage counselling appointments (online, over the phone and in person)
- Store contact and scheduling information
- Enable secure messaging related to appointments
- Facilitate payments for sessions
- Store therapeutic notes securely, accessible only to the counsellor
The portal is separate from the counselling contract and informed consent documentation.
Date of birth is collected to confirm age, apply appropriate safeguarding measures, determine consent requirements, and meet professional and legal obligations.
3. Personal Data Collected
We collect only the information necessary to operate the portal.
Administrative & Contact Data
- Name
- Date of birth
- Email address
- Phone number
Children & Young People
- Child or young person’s name
- Child or young person’s date of birth
- Parent or legal guardian’s name
- Parent or legal guardian’s email address
- Parent or legal guardian’s phone number
Appointment Information
- Date and time of sessions
- Type of session (e.g. initial assessment, online/phone/in-person counselling)
4. Therapeutic Notes & Special Category Data
- Child or young person’s name
- Child or young person’s date of birth
- Parent or legal guardian’s name
- Parent or legal guardian’s email address
- Parent or legal guardian’s phone number
Appointment Information
- Date and time of sessions
- Type of session (e.g. initial assessment, online/phone/in-person counselling)
4. Therapeutic Notes & Special Category Data
The portal may be used to store therapeutic notes and counselling records.
This information is classed as special category personal data under UK GDPR.
- Access is strictly limited to the counsellor
- Records are stored securely in accordance with professional standards
- Therapeutic records may include identifying details such as date of birth where clinically relevant
5. Lawful Basis for Processing
Administrative and Portal Data
- Article 6(1)(b) – Contractual necessity
- Article 6(1)(f) – Legitimate interests
- Payment processing is necessary for the performance of a contract
Therapeutic Records (Special Category Data)
- Article 9(2)(h) – Health or social care purposes
- Article 6(1)(b) – Performance of a contract
6. Confidentiality
- Article 6(1)(b) – Contractual necessity
- Article 6(1)(f) – Legitimate interests
- Payment processing is necessary for the performance of a contract
Therapeutic Records (Special Category Data)
- Article 9(2)(h) – Health or social care purposes
- Article 6(1)(b) – Performance of a contract
6. Confidentiality
All personal data is handled in accordance with the BACP Ethical Framework.
Confidentiality may only be broken where required by law or where there are safeguarding concerns or a serious risk of harm to the client or others. These limits are explained more fully within the counselling agreement.
Safeguarding responsibilities apply regardless of whether counselling is provided in person, over the phone or online.
7. Communications
- Email notifications contain minimal administrative information only
- Clients are discouraged from sharing sensitive personal information via email
- Secure internal messaging and phone communication are available
- Video call platforms are agreed directly with the client
The portal is not an emergency service.
8. Third-Party Services
Vultr
Vultr is our primary hosting provider. Both the server and backup data are located in London, UK.
Google Workspace
Google Calendar is used for appointment scheduling only. Client identities are represented by a unique reference (UUID). Calendar entries contain the appointment date, time and type of session, rather than the client's name or direct contact details.
Google Workspace Email (Gmail) is used for notifications and limited communication. We minimise the personal information included in emails and discourage sharing sensitive personal or therapeutic information by email, in favour of private messaging through the portal.
Stripe
Payments are processed securely using Stripe.
When making a payment, Stripe collects and retains payment card or payment method details as necessary to process transactions and, where authorised, future payments.
We do not receive or store full payment card details. We may retain Stripe identifiers to facilitate future payments where authorised.
Stripe may act as a data controller or data processor depending on the processing activity. Its processing is subject to its own privacy notice and applicable data protection obligations.
Zoho
Zoho is a business services company. We use Zoho's UK/EU data centres.
We use Zoho for invoicing when payments are not processed through Stripe. This involves sharing the client's name and email address for invoicing purposes.
We use Zoho Sign to send and manage counselling contracts electronically. The personal data processed for this purpose includes names and electronic signatures, including those of parents or legal guardians where applicable.
Halaxy
We use Halaxy, a practice management platform designed for healthcare and therapeutic services, to store clinical notes and documents, including counselling contracts and therapeutic notes. Practice data for users in the EU is stored in data centres within the EU, subject to the provider's applicable storage arrangements and terms.
Proton
Proton provides privacy-focused communication and data services. Proton AG is based in Switzerland, and Proton operates European data centres for its services.
We use Proton Meet for online video counselling which is end to end encrypted. Meeting links are sent through private messaging in the portal to minimise the sharing of information by email. You may choose the display name used when joining a call.
We may also use Proton's document-sharing services to share documents with you, which may include confidential or therapeutic information.
9. Data Security
Appropriate technical and organisational measures are in place to protect personal data, including secure authentication, access controls, and restricted access to therapeutic records.
10. Data Retention
- Administrative and booking data is retained only for as long as necessary for service provision and legal obligations
- Therapeutic records are retained in line with BACP guidance, legal requirements, and professional indemnity insurance obligations
For children and young people, records are typically retained until the individual reaches adulthood plus the required retention period. Where applicable, clients or their parent or legal guardian may request the purging of therapeutic notes in accordance with the practice’s record-retention policy, subject to any legal, safeguarding, professional or insurance requirements to retain them.
11. Your Rights
Under UK GDPR, you have the right to:
- Access your personal data
- Request correction of inaccurate data
- Request erasure (where applicable)
- Restrict or object to processing
- Request data portability
To exercise these rights, please contact the counsellor directly, though the portal's Private Message, or sending a letter to Office 2102, 92 Castle Street, Belfast, Northern Ireland, BT1 1HE. We request that you do not email personal information.
12. Complaints
If you have concerns about how your personal data is handled, please raise these with the counsellor in the first instance.
You also have the right to complain to the Information Commissioner’s Office (ICO).
13. Changes to This Notice
This Privacy Notice may be updated from time to time. The most recent version will always be available through the client portal.