Anchor Therapy provides occupational therapy in Dublin, Cork and online. This policy explains what personal information we collect, why we collect it, how we keep it safe, who we share it with, how long we keep it, and your rights. Some of the information we hold is about your health, so we take particular care with it.

Who we are

The data controller is Michelle Murray, trading as Anchor Therapy.

For anything about your personal information, including requests to exercise your rights, contact us at info@anchortherapy.ie.

Our occupational therapists are registered with CORU, Ireland's regulator for health and social care professionals, and follow its Code of Professional Conduct and Ethics, including its rules on confidentiality and record keeping.

What we collect

When you get in touch or join our waiting list

Your name, email address, phone number and date of birth.
What you'd like help with, your availability and preferences (for example, online or in person, and location).
If you're filling in a form for someone else (for example, a parent or guardian for a young person), your name, contact details and relationship to them.
Bill payer, funding and emergency contact details, if you give them.
Your agreement to our privacy statement and cancellation policy, and how you'd like us to contact you.

When you attend sessions

Appointment details: dates, times, type of session, practitioner and attendance.
Clinical records: assessments, session notes, reports, goals and outcomes. This is health information.
Documents you or others send us about your care, for example referral letters or reports.
For online sessions, the details needed to set up the video call. Sessions are not recorded.

Payments

Invoices, payments and refunds.
Card payments are handled by our payment provider, Stripe. We never see or store your full card number.

Messages

Emails, WhatsApp messages and text messages between you and us.
A record of the appointment messages we send you, for example confirmations and reminders.

Feedback

If you choose to fill in our feedback form, your answers. You can do this without giving your name.

Why we use it, and our legal basis

To assess you, provide occupational therapy and keep clinical records

Legal basis: To provide the service you asked for (contract). For health information, the provision of health care by a health professional under a duty of confidentiality (GDPR Article 9(2)(h) and section 52 of the Data Protection Act 2018).

To manage your place on our waiting list and offer you appointments

Legal basis: To take steps at your request before providing a service, and our legitimate interest in running the practice.

To send appointment confirmations, reminders and changes, and practical updates

Legal basis: To provide the service, and our legitimate interest in making sure appointments go ahead. You can tell us how you prefer to be contacted (see below).

To invoice and take payment

Legal basis: To provide the service (contract), and our legal obligations to keep financial records.

To meet our professional and legal obligations

For example, CORU record-keeping requirements, tax law or a court order.

Legal basis: Legal obligation.

To share reports with others, such as your GP, an employer or a funding body, where this isn't otherwise required

Legal basis: Your consent, which we ask for first.

To improve our service using feedback

Legal basis: Our legitimate interest. Feedback is optional.

How we contact you

We send appointment confirmations, reminders and practical updates by email, and by WhatsApp or text message (SMS) to the mobile number you give us. We don't send clinical information in WhatsApp or text messages.

You can tell us at any time which of these you'd like us to use, or ask us to stop using one, by emailing info@anchortherapy.ie or telling your therapist. We don't send marketing messages.

If you message us on WhatsApp, our practice WhatsApp account may be used by our administrative system as well as on our phone, so that messages about your appointments are kept together with your record.

Who we share it with

We never sell your information. We share it only where needed.

Service providers who process information for us

These providers work under contracts that require them to keep your information secure and confidential and to use it only on our instructions:

Our practice management system and secure database, hosted in the European Union.
Stripe, for card payments.
Zoho, for email (EU data centre).
8x8 (Jitsi as a Service), for online video sessions.
Meta (WhatsApp Business), for WhatsApp messages.
Our SMS provider, for text messages.
Our website host, for our website and online forms.

During our move to a new practice management system, some records are also held by Cliniko, the system we used previously.

Others, only when needed

Organisations that pay for your sessions (for example, a college or employer): we share what's needed for billing, such as your name, session dates and fees. Never clinical details.

Your GP, other health professionals, an employer or a funding body (for example, for a Workplace Needs Assessment report): with your agreement.

When the law requires it or someone is at risk: confidentiality has limits. We will share information if you or someone else is at serious risk of harm, if a child is at risk of harm or neglect, if we're told about a serious crime, or if a court orders us to. We share only what is needed, with the people who need to know, and we will tell you and talk it through with you wherever we can.

Professional advisers, such as our accountant, insurer or legal adviser, where needed and under a duty of confidentiality.

Transfers outside the European Economic Area

We store our records in the European Union. Some of our service providers are based outside the European Economic Area or may access information from outside it.

Where that happens, we make sure the transfer is protected by a lawful safeguard, such as the European Commission's Standard Contractual Clauses or an adequacy decision (for example, the EU–US Data Privacy Framework).

How we keep it safe

Records are held in secure, access-controlled systems. Only the people who need your information to look after you or run the practice can see it.
Information is encrypted when it is sent over the internet, and our backups are encrypted.
Links we send you, for example to join an online session or pay an invoice, are private to you, expire, and can be withdrawn.

How long we keep it

Clinical records: In line with CORU guidance on record keeping. As a general rule, adults' records are kept for 8 years after your last contact with us. Children's and young people's records are kept until your 25th birthday (or 26th if you were 17 when your care ended), or for 8 years after your last contact, whichever is later.

Financial records (invoices and payments): 6 years after the end of the tax year they relate to, as Irish tax law requires.

Enquiries and waiting list details: Where you don't go on to attend, we keep these for 12 months after our last contact with you.

Messages (email, WhatsApp and text): Messages about your care are kept as part of your record. Other messages are kept for up to 2 years.

When information is no longer needed, we delete it securely. Backups are overwritten on a rolling basis.

Children and young people

We work with young people aged 13 and over. A parent or guardian may complete forms and attend on their behalf. We respect young people's privacy and talk with them, at a level that suits their age and understanding, about who will see what.

Your rights

You have the right to:

Access the information we hold about you and get a copy.
Have inaccurate information corrected.
Have your information deleted, unless we must keep it (for example, clinical and financial records for the periods above).
Restrict how we use it, or object to us using it on the basis of our legitimate interests.
Receive information you gave us in a portable format (data portability).
Withdraw your consent at any time, where we rely on it. This doesn't affect what we did before you withdrew your consent.

To use any of these rights, email info@anchortherapy.ie. We'll reply within one month. We may need to confirm your identity first. There's no charge in most cases.

Complaints

If you have a concern, please contact us first and we'll do our best to put it right.

You also have the right to complain to the Data Protection Commission:

www.dataprotection.ie
21 Fitzwilliam Square South
Dublin 2
D02 RD28

Cookies

Our website uses only the cookies it needs to work. We don't use advertising or analytics cookies.

Changes to this policy

We'll update this policy when how we handle information changes, and show the date of the latest version at the top.