Privacy Notice

1. Who is responsible for your information?

Online Therapy With Tony is operated by Tony Dunne, MIACP Accredited Psychotherapist. For the purposes of the General Data Protection Regulation (GDPR) and the Data Protection Act 2018, Tony Dunne is the data controller for the personal data processed through this website and in the provision of psychotherapy.

Contact: info@onlinetherapywithtony.com | OnlineTherapyWithTony.com

This service is established in Ireland. Online therapy may be offered to suitable adult clients who are physically located in approved European jurisdictions, subject to professional, legal and insurance requirements.

2. Information I may collect

I collect only information that is reasonably necessary to respond to you, assess whether online therapy is appropriate, provide the service safely, meet professional obligations and administer the practice. This may include:

• Identity and contact details, such as your name, date of birth, address, postal code, email address and telephone number.
• Enquiry and appointment information, including your availability and the broad reason you are seeking therapy.
• Emergency and safeguarding information, including your current location during sessions, an emergency contact or next of kin, and local GP or emergency-service details where appropriate.
• Clinical information, including relevant health information, presenting concerns, risk assessments, therapy goals and brief session notes.
• Administrative and payment information, such as invoices, payment status and transaction references. I do not normally receive or retain full payment-card details.
• Communications sent by email, telephone, text message, enquiry form or secure video platform.
• Limited technical website information, such as security logs, IP address, device or browser information and cookie preferences, where collected by the website or hosting provider.

3. How I obtain your information

Most information is provided directly by you. With your knowledge or where otherwise lawful and necessary, information may also be received from a referrer, an emergency contact, a healthcare professional, a payment provider, or another person involved in responding to an immediate safety or legal concern.

4. Why I use your information and the legal bases

Depending on the circumstances, personal data may be processed because it is:

• Necessary to take steps at your request before entering into a therapy contract, or to perform that contract (Article 6(1)(b) GDPR).
• Necessary to comply with a legal obligation (Article 6(1)(c)).
• Necessary to protect your or another person's vital interests in an emergency (Article 6(1)(d)).
• Necessary for my legitimate interests in running a safe, ethical and accountable professional practice, including security, complaints handling and the establishment or defence of legal claims (Article 6(1)(f)).
• Based on your consent for genuinely optional activities, such as non-essential cookies or a preferred reminder method (Article 6(1)(a)).

Therapy information may reveal health, sexual-life, sexual-orientation, religious, philosophical or other sensitive information and is therefore special-category data. Where applicable, it is processed for the provision and management of health or social care under professional confidentiality (Article 9(2)(h)); with explicit consent where that is the appropriate condition (Article 9(2)(a)); to protect vital interests where a person is incapable of giving consent (Article 9(2)(c)); for substantial public-interest safeguarding obligations where applicable (Article 9(2)(g)); or for the establishment, exercise or defence of legal claims (Article 9(2)(f)).

Consent is not relied upon where another legal basis is necessary and appropriate. Withdrawing consent does not affect processing already carried out lawfully and may not require deletion of records that must be retained for professional, legal, insurance or safety reasons.

5. Online sessions and cross-border practice

At the beginning of an online session, I may confirm your current physical location and a safe way to contact you if the connection fails. This is necessary because emergency, safeguarding, professional and regulatory arrangements can differ between countries.

If there is a serious and immediate concern for your safety or another person's safety, relevant information may be shared with an emergency service, healthcare professional, safeguarding authority or emergency contact in the country where you are located. Only information reasonably necessary for the situation will be disclosed.

You should tell me before a session if you are in a different country or location from usual. A session may need to be postponed if I cannot lawfully, ethically or safely provide therapy in that location.

6. Confidentiality and professional supervision

The content of therapy is confidential. Confidentiality may be limited where disclosure is required or permitted by law, where there is a serious concern about risk of harm, where safeguarding duties arise, where information is required by a court or other lawful authority, or where disclosure is necessary to establish, exercise or defend a legal claim. Where safe and lawful, I will seek to discuss a proposed disclosure with you first.

As part of ethical practice, clinical work is discussed in professional supervision. Information is minimised and, wherever practicable, identifying details are removed. A supervisor is also bound by professional confidentiality.

7. Who may receive your information?

Information is not sold. It may be shared only where necessary with:

• Professional supervisors and, where required, professional or insurance advisers.
• Carefully selected providers supporting website hosting, secure email, appointment administration, video sessions, IT security, document storage, accounting and payment processing.
• Your GP, emergency contact, emergency services or safeguarding bodies where you have authorised this or where disclosure is otherwise lawful and necessary.
• Regulators, professional bodies, insurers, legal advisers, courts or public authorities where required or permitted by law.
• Another healthcare professional where you request or authorise coordinated care.

Service providers may process information only for defined purposes and are required to protect it through appropriate contractual, organisational and technical safeguards. Payment providers process payment-account or card information under their own privacy terms.

8. International data transfers

The practice is based in Ireland and primarily seeks to use providers that process data within Ireland or the European Economic Area (EEA). Some technology providers or their support functions may process data outside the EEA. Where this occurs, an approved transfer mechanism and appropriate safeguards will be used, such as an adequacy decision or the European Commission's Standard Contractual Clauses, together with additional safeguards where required.

A client's presence outside Ireland does not necessarily mean that clinical records are stored in that country. However, a limited disclosure to local services may be necessary in an emergency or safeguarding situation.

9. How long information is retained

• Enquiries that do not proceed to therapy: normally deleted within 12 months, unless there is a clear reason to retain them for longer.
• Adult client contact details, clinical notes and therapy-contract records: normally retained for seven years after the last date of service, unless another period is justified by law, safeguarding needs, a complaint, an ongoing claim or an insurer's requirement.
• Financial and tax records: retained for the period required by Irish tax and accounting law.
• Website security logs and cookie records: retained only for the period reasonably necessary for security, operation and consent management, according to the relevant provider settings.

When a retention period ends, records are securely deleted or destroyed. This service is designed principally for adults aged 18 and over. Any future work with a person under 18 would require a separate privacy and consent process and an appropriate retention period.

10. Security

Reasonable technical and organisational safeguards are used to protect personal data. These include access controls, strong authentication, device and account security, secure storage, confidentiality procedures, data minimisation and separation of identifying contact information from brief clinical notes where practicable. No internet or communication system can be guaranteed completely secure, but risks are reviewed and safeguards updated as the service develops.

You can support confidentiality by joining sessions from a private location, using a secure device and connection, wearing headphones where helpful, and not recording a session. Sessions are not recorded by me unless there is a separate, explicit and documented agreement for a specific purpose.

11. Website cookies and analytics

Cookies that are strictly necessary for website security, operation or your privacy choices may be used without consent where permitted. Analytics, advertising or other non-essential cookies will be used only after an appropriate consent choice. You should be able to reject non-essential cookies as easily as you accept them and change your preference later. A separate Cookie Notice should identify the cookies actually used when the website configuration is finalised.

12. Your data-protection rights

Subject to the circumstances and applicable law, you may have the right to:

• Ask whether your personal data is being processed and request access to it.
• Ask for inaccurate or incomplete information to be corrected.
• Ask for deletion or restriction of processing.
• Object to processing based on legitimate interests.
• Receive certain information you provided in a portable format.
• Withdraw consent where processing is based on consent.
• Complain to a data-protection supervisory authority.

These rights are not absolute. For example, access may need to take account of another person's rights, and deletion may not apply where information must be retained for legal, professional, insurance, safeguarding or legal-claims purposes. Identity may need to be verified before a request is completed.

13. Requests and complaints

To exercise a data-protection right or raise a privacy concern, email info@onlinetherapywithtony.com. I will normally respond within one month, subject to the GDPR rules for complex or multiple requests.

You may also complain to the Irish Data Protection Commission at dataprotection.ie. If you live elsewhere in the EEA, you may also contact the supervisory authority in your country of residence.

14. Automated decisions and marketing

I do not use your clinical information for automated decision-making or profiling that produces legal or similarly significant effects. I do not use therapy information for targeted advertising. I will not send marketing communications unless there is a lawful basis and an appropriate opportunity to opt out.

15. Changes to this notice

This notice will be reviewed as the website, technology providers, legal requirements and geographical scope of the service develop. The current version and its revision date will be published on OnlineTherapyWithTony.com. Material changes affecting existing clients will be communicated where appropriate.