Privacy Notice

Effective 13 August 2026 | Version 1.0

This notice explains what personal information I collect, why I use it, how I protect it, and the choices and rights available to you.

1. Who is responsible for your information?

Shoreline Counselling & Psychotherapy is the registered business name under which I, Ana Planas Domínguez, provide counselling and psychotherapy services as a sole trader.

Under the General Data Protection Regulation (GDPR) and the Data Protection Act 2018, I am the data controller. This means that I am responsible for deciding how and why your personal information is collected, used, stored and protected.

Data controller: Ana Planas Domínguez, trading as Shoreline Counselling & Psychotherapy

Business address: The Fairways, Ferrybank, Waterford

Email: info@shoreline-counselling.com

Telephone: +353 85 120 7357

2. Who does this notice apply to?

This notice applies to people who visit the Shoreline website, make an enquiry, request an appointment, receive therapy, or take part in individual, couple or family work. It also applies, where relevant, to parents, guardians, emergency contacts, referrers and other people whose information is included in a client record.

This notice explains data protection. The therapeutic agreement provides additional detail about confidentiality, professional boundaries, cancellations, safeguarding and the practical arrangements for therapy.

3. What information may I collect?

Depending on how you engage with Shoreline, I may collect:

· identity and contact details, including your name, address, date of birth, telephone number and email address;

· information contained in an enquiry or appointment request;

· contact preferences and information about whether it is safe to leave a voicemail, send a text message or use email;

· appointment details, attendance, cancellations and administrative correspondence;

· information about your health, wellbeing, relationships, family circumstances, personal history, neurodivergence, medication, risk or support needs;

· therapy assessments, working notes, session records, safety plans, referrals and correspondence connected with your care;

· information relevant to child or adult safeguarding, including risk to you or another person;

· information about parents, guardians, partners, family members, children, emergency contacts or other people discussed during therapy;

· payment, invoice and accounting information, although I do not need to retain full payment-card details;

· complaints, feedback, requests relating to your information and records of how those requests were handled; and

· technical website information such as IP address, browser, device, pages visited, referral source and cookie identifiers, where permitted by your cookie choices.

4. How do I obtain your information?

Most information is provided directly by you, for example through the website, by email or telephone, during an initial consultation, or in therapy.

With an appropriate basis, I may also receive information from a parent or guardian, a partner or family member participating in therapy, a referrer, another health or social care professional, an emergency contact, or a safeguarding or statutory body. Website and analytics providers may supply technical information about how the website is used.

If personal information is obtained from someone other than you, I will provide the information required by law when appropriate. There are limited exceptions, including where providing it would be impossible, involve disproportionate effort, seriously impair the purpose of the processing, or conflict with another person's rights or a duty of confidentiality.

5. Why do I use your information?

I only use personal information where there is a lawful reason to do so. The main purposes and legal bases used by Shoreline are explained below.

Responding to enquiries

I use the contact details and information you include in your enquiry to respond, understand what you are looking for and consider whether I can appropriately offer the service you need.

Lawful basis: Article 6(1)(b) of the GDPR — taking steps at your request before entering into a contract. If you provide health information in connection with possible care, Article 9(2)(h) may also apply.

Arranging and providing therapy

I use identity, contact, appointment, health, relationship and clinical information to arrange and provide counselling or psychotherapy.

Lawful basis: Article 6(1)(b) — performance of the therapeutic contract — and Article 9(2)(h) for the provision or management of health or social care, subject to professional confidentiality.

Maintaining appropriate records

I keep administrative, clinical, risk and safeguarding records to provide a safe and professionally appropriate service and maintain an accurate record of the work.

Lawful basis: Article 6(1)(b), Article 6(1)(c) or Article 6(1)(f), depending on the circumstances. Article 9(2)(h) applies to relevant health information, and Article 9(2)(f) may apply where information is needed for a legal claim.

Managing risk, emergencies and safeguarding concerns

I may use contact, clinical, risk, emergency-contact and safeguarding information where this is necessary to respond to a serious concern about your safety or another person’s safety.

Lawful basis: Article 6(1)(c), Article 6(1)(d) or Article 6(1)(f), depending on the circumstances, together with the appropriate condition under Article 9.

Billing, accounting and tax

I use identity, contact, payment and invoice information to manage payments, accounts and tax obligations.

Lawful basis: Article 6(1)(b) for the therapeutic contract and Article 6(1)(c) for legal obligations.

Operating and protecting the website and business systems

I use limited technical and security information to operate the website, protect Shoreline’s systems and prevent unauthorised access or misuse.

Lawful basis: Article 6(1)(f) — my legitimate interests in operating and protecting a small professional practice.

Website analytics

If you consent, Squarespace Analytics and Google Analytics use cookie identifiers and website usage information to help me understand how visitors find and use the website.

Lawful basis: Article 6(1)(a) — consent. Non-essential analytics are not activated unless you choose to accept them.

Complaints, regulatory matters and legal claims

I may use relevant correspondence, administrative information and clinical records to respond to a complaint, meet a regulatory requirement or establish, exercise or defend a legal claim.

Lawful basis: Article 6(1)(c) or Article 6(1)(f), together with Article 9(2)(f) where special-category information is required for a legal claim.

Where I rely on legitimate interests, those interests include running and securing the practice, maintaining appropriate records, communicating with clients, and establishing or defending legal claims. I consider the likely impact on your rights before relying on this basis.

Consent to receive therapy is not the same as consent under data protection law. I do not rely on GDPR consent where another legal basis is more appropriate. Where I do rely on consent, such as for non-essential analytics cookies, you may withdraw it at any time.6. Health and other sensitive information

Information about physical or mental health is special-category personal data under the GDPR and receives additional protection. Where this information is needed to consider, arrange or provide therapy, I generally process it under Article 9(2)(h) of the GDPR for the provision or management of health or social care, subject to my professional duties of confidentiality.

Different conditions may apply where information is required to protect vital interests, meet a safeguarding or legal obligation, or establish, exercise or defend a legal claim. I will only use sensitive information where it is necessary and proportionate.

6. Health and other sensitive information

What you bring to therapy is confidential. Confidentiality is central to my work, but it is not absolute. I may share relevant information where you have asked me to do so, where this is necessary to provide the service, where the law requires or permits it, or where there is a serious concern about your safety or another person's safety.

Depending on the circumstances, information may be shared with:

· service providers that support the secure operation of the website, communications, administration, storage or online sessions;

· my professional supervisor, normally using anonymised or minimised information wherever practicable;

· a parent or guardian where a young person is receiving therapy, within the confidentiality boundaries agreed at the beginning;

· a GP, health professional, emergency service or emergency contact where this is appropriate and lawful;

· Tusla, An Garda Síochána or another safeguarding or statutory body where disclosure is required or justified;

· a court, regulator or professional body where there is a valid legal or regulatory requirement; and

· an accountant, insurer or legal adviser where information is necessary for accounting, insurance, advice or legal claims.

I will share only the information reasonably necessary for the purpose. I do not sell personal information and I do not provide client information to advertisers.

7. Confidentiality and when information may be shared