Privacy Notice

The short version

We collect information about your child and about you so that we can carry out a safe, thorough ADHD, autism or cognitive assessment and, where appropriate, prescribe and monitor treatment. Health information is sensitive and we protect it carefully. We share it with your child’s GP, with anyone else only if you agree, and with Tusla or other authorities only where the law requires. We do not contact schools without your consent. Anything for school normally goes through you. You have the right to see the information we hold and to ask us to correct it. Questions: privacy@shinebrightclinic.ie.

1. Who we are

Shine Bright Clinic Limited, 3 Landscape Road, Churchtown, Dublin, D14 WC65, is the data controller. Our data protection contact is Stephen Creedon, Business Lead: privacy@shinebrightclinic.ie. Clinical responsibility for your child’s care rests with our Consultant Child and Adolescent Psychiatrist, the Clinical Lead.

2. What information we collect

About your child

Name, date of birth, address, school and year group
Developmental, medical, educational and family history that you provide
Completed rating scales and questionnaires from you, from your child’s teacher (school forms come back via you; online questionnaires come to us directly) and, where age-appropriate, from your child
Clinical notes, physical measurements (height, weight, blood pressure, pulse), assessment findings, diagnosis, reports, prescriptions and review records
Information from your GP’s referral, if there is one, and any previous assessments you share with us

About parents and guardians

Names, contact details, relationship to the child and guardianship status, and who may attend appointments
Payment records (we do not store full card numbers; payments are processed through Halaxy online and by SumUp in the clinic)
Correspondence with us, including emails, forms and call notes

Health information, and information about a child, are special-category data and receive extra protection under data protection law.

3. Why we use it and our legal basis

Purpose	Legal basis
Assessing your child, making a diagnosis, providing a report, prescribing and monitoring treatment	Provision of health care by, or under the responsibility of, a professional bound by an obligation of secrecy (GDPR Art. 9(2)(h), with Art. 6(1)(b): our contract with you)
Sending the report and prescribing plan to your child’s GP	Health care provision (Art. 9(2)(h)); necessary for safe ongoing care
Sharing with any other professional you name	Your explicit consent (Art. 9(2)(a)), which you may withdraw at any time
Keeping accurate clinical records for the required period	Legal and professional obligations (Art. 6(1)(c), 9(2)(h)), including Medical Council standards
Protecting a child’s safety and welfare	Legal obligation under the Children First Act 2015 (Art. 6(1)(c), 9(2)(b)/(g)); a child’s safety overrides confidentiality where the law requires
Bookings, payments, queries and complaints	Our contract with you (Art. 6(1)(b)) and our legitimate interest in running the clinic (Art. 6(1)(f))
Clinical audit and quality improvement	Legitimate interest and professional obligation, using de-identified information wherever possible
Website analytics	Your consent (Art. 6(1)(a)), given through our cookie banner, which you can withdraw at any time

Your child’s GP: a copy of the report and any prescribing plan is always sent to the GP, because safe ongoing care depends on it.
Our clinical team: the Consultant Psychiatrist and any clinician the Clinical Lead approves to be involved in your child’s care (for example a clinical nurse specialist or advanced nurse practitioner carrying out medication reviews or a school observation). All are bound by professional confidentiality and contracts with us.
Your child’s school: we only contact your child’s school with your written consent (for example, to arrange a school observation, which is rare). School forms come to us through you, teachers’ online questionnaires come to us directly, and any letter or report for school is given to you to share as you choose.
Other professionals (for example CAMHS, a psychologist, a pharmacy): only with your consent, or where needed for urgent care or an onward referral you have agreed to.
Tusla (Child and Family Agency), An Garda Síochána or a court: only where the law requires or permits it. We will tell you unless doing so could put a child at risk.
Our service providers, who process data on our instructions under written contracts: Halaxy (our clinic software: online booking, forms and questionnaires, appointment emails and texts, clinical records and online card payments), MHS (online questionnaires: the Conners 4 and SRS-2), Google Workspace (email), Google Analytics (website statistics, only if you accept analytics cookies), SumUp (card payments in the clinic), Vercel (website hosting), and our accountant (financial records only). We never sell or share information for marketing.

We do not transfer your information outside the European Economic Area unless our provider offers appropriate safeguards (such as EU Standard Contractual Clauses); details are available on request.

5. How long we keep it

Children’s health records are kept in line with HSE record-retention standards: at a minimum until your child’s 25th birthday (or 26th if they were 17 when their care with us ended), or for 8 years after their death if earlier. Safeguarding records are kept for the same period. Financial records are kept for 7 years as required by Revenue. Enquiry records where no assessment takes place are deleted after 12 months.

6. How we protect it

Records are held in Halaxy, an encrypted, access-controlled practice-management system with data held in the EU. Paper is minimised, stored in locked cabinets, and scanned or shredded. Clinical correspondence uses secure email; we never send clinical information through social media or personal accounts. Everyone who works with children at the clinic is Garda vetted before they start, and everyone who works with us is trained in data protection and bound by confidentiality. We have a data-breach procedure and will tell you and the Data Protection Commission if a breach puts your rights at high risk.

7. Contacting us about your child’s care

Our office hours are Monday to Friday, 9am–5pm. Questions about your child’s care go to hello@shinebrightclinic.ie, or medication@shinebrightclinic.ie for families attending our medication clinic. We aim to reply within 24 hours, and clinical questions are passed to the clinical team. We do not operate an emergency line; outside office hours please contact your GP out-of-hours service or, in an emergency, 112/999.

8. Your rights

To be told how we use information (this notice)
To access a copy of the information we hold about your child and about you
To have inaccurate information corrected, and incomplete information completed
To ask us to delete information, or to restrict or object to how we use it, where the law allows (clinical records usually must be kept for the retention period above)
To withdraw consent at any time where we rely on consent
To complain to the Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963, www.dataprotection.ie

To exercise any right, email privacy@shinebrightclinic.ie. We respond within one month. Each legal guardian is normally entitled to access their child’s record; we may ask for evidence of guardianship. A young person’s own wishes about their record are given increasing weight as they approach 18, in line with Medical Council guidance.

9. Website and changes

Our website uses Google Analytics cookies only if you agree to them in our cookie banner, and you can change your choice at any time with “Cookie settings” at the bottom of every page. Our Book page shows Halaxy’s booking system, which may set strictly necessary cookies to complete your booking. Our Cookies page has the details. We review this notice at least every two years and whenever how we use information changes; the current version is always on our website and in the clinic.

For young people

Shine Bright Clinic is a place where a doctor helps find out whether ADHD or autism is part of why some things feel hard for you, or how you learn best. To do that, we write down things about you: what your parents and teacher tell us, what you tell us, and what we notice. We keep all of this private and safe. We share it with your GP so they can help look after you. Anything for your school goes through your parents, unless they agree to something else. If we were ever worried that you weren’t safe, we would have to tell someone whose job is to keep children safe. We would try to tell you first. You can ask to see what we’ve written about you, and you can tell us if something is wrong.