1. Data Controller

Edel Grogan is the Data Controller for The Grace Tree. This means I am responsible for deciding how and why your personal data is collected and processed.

​

2. Information I Collect

I collect minimum personal data necessary to provide safe, ethical individual and couples therapy services:

• Contact & Booking Information: Your name, email address, phone number, and scheduling preferences.

• Intake & Assessment Data: Address, GP contact details, emergency contact details, relevant medical/medication history, and initial questionnaire answers (including couples intake responses).

• Clinical Notes: Brief, anonymised session summaries recorded after our appointments.
   

3. Purpose & Legal Basis for Processing

I process your data under the following legal bases:

• Performance of a Contract: Processing your contact and booking information to manage appointments, issue administrative updates, or contact you regarding schedule changes.

• Legitimate Interest: Managing my practice effectively to provide high-quality therapeutic care.

• Explicit Consent (Special Category Data - Article 9 GDPR): Health and therapy data is classified as sensitive data under GDPR. Processing your clinical information and session notes is done with your explicit consent to deliver psychotherapy.

• Vital Interests: Emergency contact details are stored solely to protect your life or safety in the event of an immediate medical or psychological emergency.
   

4. How & Where Your Data Is Stored

Your data is stored securely using GDPR-compliant cloud infrastructure with encryption at rest and in transit:

• Website & Bookings: Your contact details, booking forms, and appointment histories are hosted securely via Wix.com (our website platform). Wix processes data under strict EU/GDPR security standards.

• Clinical Notes & Client Files: Session notes, client intake files, and assessment documentation are stored on Google Drive using secure, password-protected, and encrypted storage. Notes are kept brief and pseudonymised (stored using client reference initials/codes rather than full names where appropriate).
   

5. Confidentiality & Data Sharing

Your privacy and trust are central to my practice. Information shared within sessions remains strictly confidential and will never be sold or used for marketing purposes. Information is only shared under the following specific circumstances:

• Professional Supervision: As a member of the IACP, I undergo regular professional supervision to ensure high clinical standards. Case details are presented anonymously, with no identifying client information disclosed.

• Legal & Safety Exceptions:

  1. Risk of Harm: If there is a real and immediate risk of serious harm to yourself or another person.

  2. Child Protection (Mandated Reporting): As a mandated person under the Children First Act 2015, I am legally obligated to report disclosures of child abuse, neglect, or active risks to welfare to TUSLA (the Child and Family Agency).

  3. Court Orders: Where required to disclose records by operation of law or court order.

• Emergency Contact: Your emergency contact will only be contacted in an acute emergency involving an immediate threat to life.

​

6. Data Retention Period

In compliance with professional indemnity insurance standards and clinical practice guidelines in Ireland:

• Client records, intake forms, and session notes are retained for 10 years following the conclusion of therapy.

• After the retention period expires, all digital files and records will be permanently deleted and destroyed securely.

​

7. Your Data Protection Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of Access: You have the right to request a copy of the personal data held about you (a Subject Access Request). Requests must be made in writing and will be fulfilled within 30 days. For couples therapy, access requests must be submitted jointly or with explicit consent from both partners.

• Right to Rectification: You may request corrections to any inaccurate or incomplete personal information.

• Right to Erasure / Restriction: You may request the deletion or restriction of your personal data, subject to my legal and professional record-keeping obligations under indemnity insurance.

• Right to Lodge a Complaint: If you have concerns about how your data is handled, please contact me directly first so I can resolve the issue. You also have the right to lodge a formal complaint with the Irish Data Protection Commission (DPC) via www.dataprotection.ie.