Data Controller: Linda Corlett, trading as Time to Change, Gorey Business Park, Ramstown, Gorey, Co. Wexford, Ireland. Email linda@timetochange.ie · Phone 085 182 1645.

This Privacy Notice explains how we process your personal data in accordance with the EU General Data Protection Regulation (GDPR), the Irish Data Protection Act 2018, and the IACP Code of Ethics & Practice.

1. Data we collect

Website & booking form

Contact information: name, email, phone, postal address, Eircode.
Session details: chosen service, format (in-person, online, phone), date and time.
Emergency contact (optional): name, relationship, phone.
Confidential intake (optional): reason for seeking counselling, previous counselling history, GP details, current medication, referral source.
Consent record: which consent boxes you ticked, timestamp, policy version.

Clinical records (once you become a client)

Brief, factual session notes are kept as required by IACP standards. These are stored securely and separately from marketing systems.

2. Special-category (health) data — Article 9

Information about your mental health, medication and reason for seeking counselling is special-category data under GDPR Article 9. We process it on the basis of Article 9(2)(h) — the provision of health and social care — and on the basis of your explicit consent (Article 9(2)(a)) captured at the booking stage.

3. Lawful basis for processing

Consent (Art. 6(1)(a)) — for optional intake fields and marketing emails.
Contract (Art. 6(1)(b)) — to arrange and deliver your sessions.
Legal obligation (Art. 6(1)(c)) — safeguarding, tax and insurance requirements.
Vital interests (Art. 6(1)(d)) — if there is a serious risk to your life or another person's.

4. How your data is stored

Bookings and messages submitted through this website are stored in an EU-hosted database with row-level security. Access is restricted to Linda Corlett as sole practitioner and data controller. Data in transit is encrypted with TLS. Locally-kept clinical notes are stored in a locked location and, where digital, on encrypted devices.

5. Sharing your data

Your information is never sold. It is shared only where necessary:

With clinical supervisors (anonymised) as part of the IACP-mandated supervision framework.
With your GP or other healthcare professional only with your prior consent, or where required by law or safeguarding obligations.
With our website / hosting processors under a Data Processing Agreement (EU-based servers).

6. International transfers

Data is stored on servers within the European Economic Area. Where any sub-processor operates outside the EEA, transfers are protected by Standard Contractual Clauses.

7. How long we keep your data

Website enquiries: up to 12 months.
Booking records: up to 12 months after your last session, then anonymised or deleted.
Clinical notes: 7 years from the last session (IACP guidance); 7 years past the age of majority for minors.
Financial records: 6 years (Revenue Commissioners requirement).

8. Your rights

Under GDPR you have the right to:

Access your personal data (Subject Access Request).
Rectify inaccurate data.
Erase your data ("right to be forgotten"), subject to legal retention obligations.
Restrict or object to processing.
Data portability.
Withdraw consent at any time.

To exercise any right, email linda@timetochange.ie. We will respond within one calendar month.

9. Complaints

If you are not satisfied with how your data is handled, you have the right to lodge a complaint with the Irish Data Protection Commission — dataprotection.ie, 21 Fitzwilliam Square South, Dublin 2, D02 RD28.

10. Cookies

This website uses strictly-necessary cookies only. See our Cookie Policy.

11. Changes to this notice

We review this notice regularly. Material changes will be highlighted on the website and, where relevant, notified to active clients by email.

Privacy Policy