Privacy & GDPR Policy
Last updated: 4 September 2026
Rita G. Health Psychology respects your privacy and is committed to protecting your personal information.
This Privacy & GDPR Policy explains what personal data I collect, why I collect it, how it is used and protected, how long it is kept, and your rights under the General Data Protection Regulation (GDPR) and the Data Protection Act 2018.
1. Who is responsible for your data
Rita G. Health Psychology is the data controller for the personal data described in this policy.
For questions about this policy, your personal information, or to exercise your data protection rights, please contact:
Email: ritagpsychology@gmail.com
2. What information I collect
The information I collect depends on how you interact with me and whether you become a client.
Website enquiries
If you contact me through the website enquiry form, I may collect:
- Your name
- Your email address
- Your phone number, if you choose to provide it
- Whether you are enquiring as an individual or an organisation
- The information you include in your message
The website enquiry form is processed through Netlify, which hosts this website. Form submissions may be processed and stored by Netlify and are also sent to me so that I can respond to your enquiry.
Please avoid including detailed medical, psychological or other sensitive information in the general website enquiry form.
Booking a consultation or requesting a call back
Bookings and call-back requests are handled through Carepatron, a third-party practice-management platform.
When you use the booking system, information such as your name, contact details, appointment preferences and any information you choose to provide may be collected and processed through Carepatron on my behalf.
You can read Carepatron's Privacy Policy for further information about how Carepatron handles personal data.
When you become a client
If you choose to work with me, I will collect information that is relevant and reasonably necessary to provide health psychology support.
Depending on the reason you are seeking support, this may include:
- Your name and contact details
- Relevant health and wellbeing information
- Existing medical conditions or diagnoses that you disclose to me
- Current or previous medical treatment or medication where relevant
- Lifestyle and health behaviours
- Sleep, stress and emotional wellbeing
- Information about how a health condition or life circumstances are affecting you
- Your goals and agreed plans
- Relevant information discussed during consultations
- Session and progress notes
- Appointment and communication records
I do not diagnose medical or mental health conditions and do not provide medical treatment. However, clients may disclose existing diagnoses, treatments, medication and other health information where this is relevant to the health psychology support they are seeking.
Information concerning physical or mental health is classified as special category personal data under GDPR and receives additional protection.
I only collect and record health information that is relevant and reasonably necessary for providing my services.
Further information about confidentiality, consent and the handling of client records will be provided before or at the beginning of our work together.
3. Information collected when you visit the website
This website does not currently use advertising cookies or behavioural advertising and does not use your information to track you across other websites.
When you visit the website, certain technical information may automatically be processed by the website hosting provider. This may include your IP address, browser or device information, date and time of access, requested pages, and information necessary for website security and operation.
Where the website uses external services, such as externally hosted fonts, your browser may communicate directly with the relevant service provider.
4. Why I process your information and my legal basis
Under GDPR, personal data must only be processed where there is an appropriate lawful basis.
Enquiries and requests for information
I process the information you provide to respond to your enquiry and communicate with you about services.
Where your enquiry relates to potentially receiving my services, the legal basis is generally Article 6(1)(b) GDPR - taking steps at your request before entering into a contract.
For other general communications, processing may be based on Article 6(1)(f) GDPR - legitimate interests, specifically my legitimate interest in responding to people who contact the practice.
Booking and providing services
I process the personal information necessary to arrange appointments, communicate with you and provide the services you have requested.
The legal basis is Article 6(1)(b) GDPR - performance of a contract or taking steps before entering into a contract.
Health and other special category information
Health psychology support may involve discussing your physical health, psychological wellbeing, existing medical conditions, medical treatment, medication, lifestyle or other health-related information.
Information concerning physical or mental health is special category personal data under GDPR.
Where I process health information on the basis of your explicit consent, the relevant special-category condition is Article 9(2)(a) GDPR - explicit consent for one or more specified purposes.
You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing that took place before consent was withdrawn.
Withdrawal of consent may affect my ability to continue providing services where the relevant health information is necessary to provide appropriate health psychology support.
Website operation and security
Limited technical information may be processed where necessary for the legitimate interests of maintaining a secure, reliable and functional website.
Legal and professional requirements
Personal information may also be processed or retained where this is necessary to comply with an applicable legal obligation or to establish, exercise or defend legal claims.
5. Data minimisation
I only collect personal information that is adequate, relevant and reasonably necessary for the purpose for which it is being processed.
In particular, I do not require clients to provide complete medical histories where that information is not relevant to the health psychology support being provided.
6. Confidentiality
Information shared during consultations is treated as confidential.
There may be limited circumstances in which information can or must be disclosed, including where disclosure is required by law or where another overriding legal or professional obligation applies.
The limits of confidentiality relevant to your service will be explained as part of the client information and consent process.
Professional supervision
As part of maintaining appropriate professional standards, aspects of my client work may be discussed with my professional supervisor.
Only information reasonably necessary for supervision will be discussed. Identifying information will be removed or minimised wherever reasonably possible, and information discussed in supervision is treated confidentially.
Further information about supervision and confidentiality will be provided as part of the client information and consent process.
7. Who your information may be shared with
I do not sell or rent your personal information and I do not use client health information for advertising or marketing.
Where necessary, personal information may be processed by service providers that help me operate the website and practice, including:
- Netlify - website hosting and website enquiry-form processing
- Carepatron - appointment booking and practice management
- My email provider - receiving, storing and responding to communications
- Other IT or professional service providers where reasonably necessary to operate the practice securely
Relevant information may also be shared with my professional supervisor as described above.
Personal information may be disclosed where required by law, where necessary to establish, exercise or defend legal claims, or where another lawful basis for disclosure applies.
Service providers are only permitted access to information where necessary for the services they provide and subject to applicable data protection requirements.
8. International data transfers
Some technology providers may process or store personal information outside Ireland or the European Economic Area (EEA).
Where personal information is transferred outside the EEA, I will ensure that an appropriate mechanism permitted under GDPR applies where required. This may include an adequacy decision of the European Commission, Standard Contractual Clauses, or another lawful transfer mechanism.
9. How long I keep your information
I keep personal information only for as long as reasonably necessary for the purpose for which it was collected, subject to applicable legal, professional and insurance requirements.
General enquiries
Where an enquiry does not result in an ongoing client relationship, correspondence and associated personal information will normally be deleted within 12 months of the last communication, unless there is a legitimate or legal reason to retain it for longer.
Client records
If you become a client, relevant records may need to be retained after our work together ends.
The appropriate retention period will be determined by the nature of the records and any applicable legal, professional and insurance requirements. Further information about the retention of client records will be provided as part of the client information and consent process.
When personal information is no longer required, it will be securely deleted or destroyed where reasonably practicable.
10. How your information is protected
I take appropriate and reasonable technical and organisational measures to protect personal information against unauthorised access, accidental loss, inappropriate disclosure, alteration, misuse or destruction.
Access to client information is limited to what is reasonably necessary to provide and administer the service.
Where third-party systems are used to process information, appropriate privacy and security safeguards are considered when selecting and using those services.
No method of electronic storage or communication can be guaranteed to be completely secure, but reasonable measures are taken to protect personal information under my control.
11. Email and electronic communications
Email and online communications can carry privacy and security risks.
Please avoid sending detailed medical, psychological or other highly sensitive information through the general website contact form or ordinary email unless necessary.
Where detailed personal or health information is required as part of our work together, you may be asked to provide it through an appropriate client or practice-management system.
12. Cookies and website analytics
This website does not currently use advertising cookies or behavioural advertising.
I do not currently use website analytics to build profiles of individual visitors or track visitors across other websites.
Essential technical functions provided by the website host may process limited technical information necessary for security and operation of the website.
If non-essential cookies, analytics or other tracking technologies are introduced in the future, this policy will be updated and consent will be requested where required by law.
13. Your data protection rights
Depending on the circumstances, GDPR gives you a number of rights regarding your personal information. These may include the right to:
- Access - request access to and a copy of personal information I hold about you
- Rectification - ask me to correct inaccurate or incomplete information
- Erasure - request deletion of your personal information in certain circumstances
- Restriction - ask me to restrict processing in certain circumstances
- Object - object to certain processing, including processing based on legitimate interests
- Data portability - request certain personal information in a structured, commonly used and machine-readable format where this right applies
- Withdraw consent - withdraw consent at any time where processing is based on consent
These rights are not absolute and some may only apply in particular circumstances. I may also need to retain certain information despite a deletion request where there is a lawful reason or obligation to do so.
To exercise your rights, contact: ritagpsychology@gmail.com
I may need to request information reasonably necessary to verify your identity before acting on a request.
I will respond to requests without undue delay and normally within one month. Where permitted under GDPR, this period may be extended by up to two further months because of the complexity or number of requests. If an extension is required, I will inform you within the initial one-month period.
14. Complaints
If you have concerns about how your personal information has been handled, you are welcome to contact me so that I can try to address your concerns.
You also have the right to lodge a complaint with the Data Protection Commission (DPC), Ireland's independent data protection supervisory authority.
Further information is available at www.dataprotection.ie.
15. Third-party websites and services
This website may contain links to third-party websites and services, including Carepatron and social-media platforms.
When you follow a link to an independent third-party website or service, that provider may process your personal information under its own privacy policy. I am not responsible for the privacy practices of independent third-party websites.
16. Changes to this policy
I may update this Privacy & GDPR Policy from time to time to reflect changes to my services, technology, legal requirements or the way personal information is processed.
The "Last updated" date at the top of this page shows when this policy was most recently revised.