Privacy Policy
Last updated: [date]
Your privacy matters, and confidentiality is central to this work. This policy explains what personal information I collect when you visit magdakennedy.com, get in touch, subscribe to my newsletter or work with me as a client, and what I do with it.
1. Who is responsible for your information
Magda Kennedy [trading as / legal entity name] is the data controller for the personal information described in this policy.
- Address: [28 Merrion Square, Dublin 2, D02 X285, Ireland]
- Email: [privacy email address]
- Phone: [phone number]
If you have any question about this policy or about your information, please contact me using the details above.
2. Information I collect
I only collect what I need to respond to you and to provide my services.
When you send an enquiry or book a discovery call
- Your name, email address and phone number (phone is optional)
- The topic you would like help with, such as anxiety and stress, confidence, sleep, habits, leadership or workplace wellbeing
- Your preferred format (in person in Dublin, or online)
- Anything you choose to tell me in your message
When you subscribe to the monthly letter
- Your email address
- [Basic delivery information, such as whether an email was delivered or opened – delete if not tracked]
When you become a client
- Contact details and, where relevant, emergency contact or GP details
- Session dates, notes and goals, including information about your health, wellbeing and personal circumstances that you share with me
- Payment and invoicing records. Card details are handled by [payment provider]; I do not see or store your full card number
When you work with me through your employer
- Your name, work email and attendance at workshops or group sessions. I do not share the content of any one-to-one session with your employer.
When you browse the website
- Technical information such as IP address, browser type, device type and pages visited, collected through server and security logs
- Cookie information, as described in section 8
Please do not include detailed medical history in the contact form. We can talk about that privately on a call.
3. How I use your information and the legal basis
I use your information only for the purposes below. I never sell it, and I do not use it for automated decision-making or profiling.
Purpose
Information used
Legal basis (GDPR)
Replying to your enquiry and arranging a discovery call
Contact details, topic, message
Steps taken at your request before entering a contract, Art. 6(1)(b), and your consent given on the form
Providing coaching and hypnotherapy sessions
Contact details, session notes, goals
Performance of our contract, Art. 6(1)(b)
Working with health and wellbeing information you share
Health and wellbeing information
Your explicit consent, Art. 9(2)(a)
Sending the monthly letter
Email address
Your consent, Art. 6(1)(a)
Invoicing, payments and tax records
Name, payment and invoice records
Legal obligation, Art. 6(1)(c)
Keeping the website secure and working
Technical and log information
Legitimate interests, Art. 6(1)(f)
Understanding how the website is used [if analytics are used]
Cookie and usage information
Your consent, Art. 6(1)(a)
Handling complaints, insurance or legal claims
Relevant client records
Legitimate interests, Art. 6(1)(f), and legal claims, Art. 9(2)(f)
4. Health and other sensitive information
Information about your health, including mental and emotional wellbeing, is a special category of personal data and I treat it with extra care.
- I will ask for your explicit consent before we begin working together, using a written client agreement.
- You can withdraw that consent at any time. If you do, I may not be able to continue sessions, but it will not affect anything done before you withdrew.
- Session notes are kept confidential and are not shared with anyone without your permission, except in the limited situations described in section 5.
- [Sessions are not recorded. / Sessions are only recorded with your agreement in advance.] Any personal self-hypnosis recording I make for you is for your use only.
5. Who I share your information with
I share personal information only where it is needed to run the practice, and only with providers bound by a written data processing agreement.
Provider type
Provider
What it is used for
Website hosting
[hosting provider]
Hosting the website and storing form submissions
Security and content delivery
Cloudflare
Protecting the website and delivering pages quickly
[email provider]
Sending and receiving messages
Newsletter
[newsletter provider]
Sending the monthly letter and managing unsubscribes
Video sessions
Zoom
Online sessions and discovery calls
Booking and client records
[booking or practice software]
Appointments and secure notes
Payments and accounting
[payment provider], [accountant]
Taking payment and keeping financial records
I may also disclose information without your consent in rare situations where:
- I believe you or someone else is at serious risk of harm
- A child or vulnerable adult may be at risk
- I am required to do so by law or by a court order
I discuss my work in professional supervision. When I do, I do not use your name or any detail that could identify you.
6. Transfers outside the European Economic Area
Some of the providers above are based in, or store data in, countries outside the EEA, including the United States. Where that happens, the transfer is protected by an adequacy decision of the European Commission, such as the EU–US Data Privacy Framework, or by Standard Contractual Clauses. You can ask me for more detail about the safeguards used.
7. How long I keep your information
Information
How long it is kept
Enquiries that do not lead to working together
[12 months] after our last contact
Client records and session notes
[7 years] after our final session
Invoices and payment records
6 years, as required by Irish tax law
Newsletter subscription
Until you unsubscribe
Website security logs
[up to 90 days]
When a period ends, the information is securely deleted or anonymised.
8. Cookies
This website uses a small number of cookies.
- Essential cookies keep the site secure and working, for example Cloudflare security cookies. These do not need your consent.
- [Analytics cookies] help me understand which pages are useful. These are only set if you accept them in the cookie banner, and you can change your choice at any time. [Delete this bullet if no analytics are used.]
I do not use advertising cookies. You can also block or delete cookies in your browser settings.
The contact page links to Google Maps for directions, and articles can be shared by email. If you follow a link to another website, that site's own privacy policy applies.
9. How I protect your information
I take practical steps to keep your information safe:
- The website uses encrypted (HTTPS) connections
- Client notes are stored in [encrypted, password-protected software / a locked cabinet] that only I can access
- Devices and accounts are protected with strong passwords and two-factor authentication
- Online sessions take place in a private room over an encrypted video service
No method of sending information over the internet is completely secure. If a data breach is likely to put your rights at risk, I will tell you and the Data Protection Commission as the law requires.
10. Children and young people
This website and my services are intended for adults aged 18 and over. I do not knowingly collect information from anyone under 18 through this website. [If young people are seen: sessions for under-18s are only arranged with a parent or guardian, who must give consent.]
11. Your rights
Under data protection law you have the right to:
- Access the personal information I hold about you and receive a copy
- Correct information that is inaccurate or incomplete
- Erase your information, where there is no legal reason for me to keep it
- Restrict how I use your information in certain circumstances
- Object to processing based on legitimate interests
- Data portability, meaning a copy of information you gave me in a commonly used format
- Withdraw consent at any time, including unsubscribing from the monthly letter through the link in every email
To use any of these rights, email [privacy email address]. I will reply within one month and there is normally no charge. I may ask you to confirm your identity first.
12. Complaints
If you are unhappy with how your information has been handled, please contact me first so I can try to put it right.
You also have the right to complain to the Data Protection Commission, Ireland's supervisory authority, at www.dataprotection.ie. If you live elsewhere in the EEA or in the UK, you can contact your local data protection authority instead.
13. Changes to this policy
I may update this policy from time to time, for example if I change a service provider or the law changes. The date at the top shows when it was last revised. If a change significantly affects current clients, I will let you know directly.
14. Contact
Magda Kennedy [28 Merrion Square, Dublin 2, D02 X285, Ireland] Email: [privacy email address] Phone: [phone number]