Who is responsible for your information

I am Fran Treacy, a sole practitioner providing therapeutic support, parenting support, separation support and workshops. I am the data controller for personal information used in my practice. For privacy enquiries, contact fran@frantreacy.ie or write to Fran Treacy, 19 The Heights, Marybourgh Hill, Douglas, Cork T12 XRR8 Ireland.

Information I collect

When you contact me or book an appointment, I collect the details you provide, such as your name, contact details, appointment choice and date, and messages about your enquiry or booking. Where applicable, I also hold consent or agreement records and payment or invoice information. For work with children, relevant parent or guardian details and permissions may be needed.

My website uses Squarespace and my appointment system is Acuity Scheduling. These services may process technical information such as IP addresses, browser details and activity needed to deliver and protect their services. The Cookie Notice explains website tracking.

I do not currently keep written session notes. I do hold relevant booking, correspondence and administration records. These may include sensitive information about your health or personal circumstances. To help protect your privacy, please keep online enquiries brief. We can discuss your personal history together rather than through the enquiry form.

Why I use information and the legal bases

I use necessary contact and appointment information to respond to requests, arrange and provide agreed services, and manage bookings. The basis is taking steps at your request before entering a contract, or performing our service agreement (GDPR Article 6(1)(b)).

I retain required accounting information to meet legal obligations (Article 6(1)(c)). I may process information necessary for proportionate practice administration, security, resolving concerns or defending legal claims on the basis of legitimate interests (Article 6(1)(f)), taking account of your rights. Where a specific legal duty requires disclosure, I rely on that duty.

Providing essential contact details is necessary to arrange a booking. Without them I may not be able to provide the requested service. Marketing is separate from therapy and would require its own choice. Where I need to collect or use sensitive information about your health or personal circumstances to arrange or provide support, I ask for your explicit consent under GDPR Article 9(2)(a), alongside the relevant Article 6 basis explained above. I explain what information is needed and why before asking for consent. You may withdraw your consent by contacting me. Withdrawal does not affect processing that was lawful before it was withdrawn. If the information is necessary to provide a service safely, we will discuss whether that service can continue. Where particular information must be retained or disclosed on another lawful basis, I will identify the applicable legal basis and Article 9 condition.

Service providers and sharing

Acuity Scheduling, part of Squarespace, processes appointment and contact information for the booking service. Squarespace provides the website platform.

Information may be shared where necessary with professional advisers or insurers to manage a complaint or claim, or with an appropriate authority where disclosure is legally required or otherwise lawfully justified. Only information relevant to the purpose should be shared. The Confidentiality Statement explains the professional context.

International processing

Squarespace services may involve processing outside the European Economic Area, including in the United States. Squarespace describes its transfer safeguards in its Data Processing Addendum, including the EU–US Data Privacy Framework and standard contractual clauses where applicable. You can read these at www.squarespace.com/dpa or contact me for information about safeguards relevant to your data. 

How long information is kept

Necessary adult client administration records are kept for seven years after the last session. Routine enquiries that do not lead to a service are normally deleted 12 months after the last contact. Children’s records are normally kept until age 25, or age 26 if the young person was 17 when therapy ended, subject to any applicable safeguarding requirements. Necessary tax and accounting records are generally kept for six years in accordance with Revenue requirements.

These periods may be extended where a specific legal or insurance requirement applies, or where relevant records are needed for an investigation or legal claim. Unnecessary duplicates and unrelated information are removed sooner. At the end of the applicable period, information is securely deleted or anonymised; paper records, if held, are securely shredded.

Protecting your information

Access to client information is limited to authorised purposes. I use protected accounts and devices, appropriate access controls and secure disposal arrangements. No internet service can guarantee absolute security.

Your rights and concerns

Depending on the circumstances, you may request access, correction, erasure, restriction or portability of your information, and object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing. Some records may still need to be retained on another applicable basis. Contact me using the details above; I normally respond within one month, subject to lawful extensions.

You may complain to the Irish Data Protection Commission at www.dataprotection.ie. You do not have to contact me first. This policy will be updated when the practice’s arrangements change.