Privacy Policy
- Home
- Privacy Policy
Who we are
PsychSupport & Educational Services is the controller of personal data described in this policy. We are committed to safeguarding clinical and educational information to international standards.
What we collect
- Identity & contact data — name, date of birth, address, email, phone, guardian details.
- Clinical data (special category) — diagnoses, assessments (PHQ-9, GAD-7, C-SSRS), session notes, treatment plans.
- Educational records — enrolments, IEPs, 504 plans, progress reports.
- Billing & insurance — payer, claims, payments (we do not store full card numbers — PCI DSS compliant tokenisation).
- Technical data — IP, device, browser, audit logs (HIPAA §164.312(b)).
Why we use your data
- Provide care and educational services (GDPR Art. 9(2)(h), HIPAA Treatment).
- Bill insurers and process payments (Payment, Operations).
- Comply with legal obligations (HIPAA, FERPA, IDEA, tax law).
- With explicit consent — research, marketing, AI features (you may opt out).
How long we keep it
Adult clinical records are retained for at least 6 years (HIPAA), minor records until age of majority plus 6 years. Educational records per FERPA / IDEA. Marketing data only while you consent.
Your rights
You may access, correct, export, restrict or request erasure of your personal data. Some clinical records are subject to legal retention. Submit a data-rights request.
International transfers
Where data leaves the EEA / UK we use Standard Contractual Clauses and risk assessments aligned with the Schrems II ruling.
Security
TLS 1.3 in transit, AES-256 at rest, role-based access control, MFA for staff, ISO/IEC 27001-aligned controls, annual independent assessments.
Questions or concerns?
Our Data Protection Officer / Privacy Officer responds within 30 days.