Privacy Notice

Version 1.2 · Review date: 22 September 2026

1. Purpose of This Notice

This Privacy Notice explains how I, Robbie Semple, Psychotherapist and Data Controller, process your personal data when providing psychotherapy services. It is issued in accordance with:

Regulation (EU) 2016/679 (“GDPR”)
Data Protection Act 2018 (Ireland)
Professional obligations applicable to psychotherapists

This Notice applies to all clients receiving psychotherapy services, including prospective and former clients.

2. Identity of the Controller

Controller: Robbie Semple

Professional Role: Psychotherapist

Practice Location: Thailand (remote practice serving clients resident in Ireland)

Regulatory Jurisdiction: Ireland

Contact Email: [email protected]

3. Categories of Personal Data Processed

I process the following categories of personal data:

3.1 Personal Data

Name
Contact details (email, phone number)
Appointment history
Administrative and billing information

Mental health information
Therapy notes

3.3 Technical Data

IP address
Connection metadata
Device information (where applicable)

4. How Your Data Is Collected

Your data is collected:

Directly from you (via email, intake forms, or during sessions)
Through the Konfidens platform when you attend sessions
Through Microsoft 365 when communicating by email, or if you are a UCD student requesting student counselling through the Mind and Body Works portal
Through my website, which collects standard usage statistics

5. Purposes of Processing

Your personal data is processed for the following purposes:

Provision of psychotherapy services
Maintenance of clinical records
Appointment scheduling and communication
Compliance with legal and professional obligations
Responding to enquiries
Managing billing and administrative matters

6. Lawful Bases for Processing

Art. 6(1)(b) – Processing necessary for the performance of a contract
Art. 6(1)(c) – Processing necessary for compliance with legal obligations
Art. 6(1)(f) – Legitimate interests (administrative communications)

Art. 9(2)(h) – Processing necessary for the provision of health care
Art. 9(2)(f) – Establishment, exercise or defence of legal claims
Art. 9(2)(a) – Explicit consent (where required)

7. Where Your Data Is Stored

All clinical data is stored exclusively within the European Union using the Konfidens telehealth platform.

Konfidens acts as a data processor under Article 28 GDPR.

Communication data (e.g., emails and booking requests) may be processed by Microsoft Ireland Operations Ltd, which acts as a processor under Article 28 GDPR.

8. Territorial Disclosure

8.1 Data access from Thailand

Clinical sessions and administrative oversight are provided by Robbie Semple, currently normally resident in Thailand. Data may also be accessed by me when in Ireland. All client records remain stored within the EU/EEA (via Konfidens AS). Communications and access links are encrypted end-to-end.

8.2 International Data Transfers and Controller Access from Thailand

Because I work remotely, I access your EU-stored data from Thailand. Depending on the referral mechanism, my accessing data may also constitute an international data transfer under GDPR. As a result, extra measures are required to protect your privacy.

These extra measures are:

Standard Contractual Clauses are adopted with any organisation where a data transfer takes place.
A Transfer Impact Assessment addressing specific issues with accessing data from Thailand has been completed. Accessing data from Thailand is deemed low risk.
A cross-border access justification and statement of supplementary measures has been prepared.
Strong supplementary measures are implemented (encryption, MFA, device security). Details can be found in my Security Policy.
No local copies of your data are stored in Thailand.
All access is encrypted end-to-end.

8.3 Microsoft 365

Microsoft may process administrative data outside the EU. Standard Contractual Clauses (SCCs) are in place.

Your data is shared only with:

Konfidens (EU-based processor)
Microsoft 365 (processor)

Your data is not shared with:

Third parties
Insurers
Employers
Family members
Any other external organisations

unless required by law or with your explicit consent.

10. Retention Periods

Clinical records: 7 years from the date of last contact
Administrative records: 7 years
Emails: 7 years unless otherwise required
Consent forms: duration of therapy + 7 years

Records may be retained longer if legally required.

You have the following rights:

Right of access (Art. 15)
Right to rectification (Art. 16)
Right to erasure (Art. 17)
Right to restrict processing (Art. 18)
Right to data portability (Art. 20)
Right to object (Art. 21)
Right to withdraw consent (Art. 7)
Right to lodge a complaint with the Data Protection Commission (Ireland)

Requests may be submitted by email.

12. Security Measures

I implement the following measures to protect your data:

Full-disk encryption on all devices
Multi-factor authentication (MFA)
Encrypted connections (TLS)
No local storage of data in Thailand
Secure physical environment in Thailand
Anti-malware protection
Regular security updates
VPN for additional protection
Documented Security Policy
Breach Response Plan

13. Automated Decision‑Making

No automated decision-making or profiling is used.

14. Data Breaches

If a breach occurs that poses a risk to your rights and freedoms:

You will be notified without undue delay
The Data Protection Commission will be notified within 72 hours
All steps taken will be documented

15. Contact Information

For any questions or requests relating to your data:

Robbie Semple, Psychotherapist and Data Controller

Email: [email protected]