Privacy Policy
Last updated: August 2026
The Behaviour Hive is committed to protecting the privacy of the families, children, schools and organisations we work with. This policy explains what personal information we collect, why we collect it, how we use it, how long we keep it, and the rights you have over it.
We are conscious that much of the information we hold is sensitive — it concerns children, their behaviour, their health and their family circumstances. We treat it accordingly.
1. Who we are
The Behaviour Hive is a private behaviour psychology practice led by Catherine (Katie) Smyth, MSc, BCBA, a Chartered Behaviour Psychologist registered with the Psychological Society of Ireland.
For the purposes of data protection law, The Behaviour Hive is the data controller for the information described in this policy.
- Address: Donadea, Co. Kildare, W91 VY0T, Ireland
- Phone: 045 574 041
- Email: info@thebehaviourhive.com
2. What information we collect
When you contact us or browse the website
- Your name, email address and phone number
- Any information you choose to include in an enquiry or booking form
- Appointment date, time and format
- Technical information about your visit, including IP address, browser type and pages viewed
When we work with your family
- Your child's name, date of birth and address
- Developmental, educational and medical history, including any diagnoses, assessments or reports you share with us
- Information about your child's behaviour, communication, sensory needs and daily routines
- Observations recorded at home, in school or in the community
- Information provided by parents, carers, teachers and, where relevant, other professionals
- Assessment findings, behaviour support plans, session notes and correspondence
- Payment records and invoices
Some of this is special category data under Article 9 of the GDPR — information concerning health, including a child's diagnosis, developmental profile or psychological presentation. We apply additional safeguards to this information and only collect what is necessary to provide the service.
3. Our lawful basis for using your information
| What we use it for | Lawful basis |
|---|---|
| Responding to enquiries and arranging a free consultation | Legitimate interests — responding to someone who has contacted us |
| Delivering assessment, planning and mentoring services | Performance of a contract; and for health information, Article 9(2)(h) — the provision of health or social care and the management of health care services |
| Keeping clinical records | Legal obligation and professional obligation under PSI guidance; Article 9(2)(h) |
| Invoicing, accounting and tax | Legal obligation |
| Website analytics and advertising | Consent, given through the cookie banner |
| Reporting a child protection concern | Legal obligation under the Children First Act 2015; Article 9(2)(b) and 9(2)(g) |
4. Children's information and who gives consent
Where our client is a child, the parent or guardian with legal responsibility normally provides consent to the service and to the handling of their child's information.
We also involve the child themselves as far as their age and understanding allow. Children are entitled to know what information is held about them and to have their views taken seriously. As a young person approaches adulthood, they may exercise data protection rights over their own information directly.
In Ireland, the digital age of consent is 16. We do not knowingly collect information directly from a child under 16 through this website without the involvement of a parent or guardian.
5. Limits of confidentiality
What you tell us is confidential, with a small number of exceptions we are required by law or professional obligation to observe. We will always try to discuss any disclosure with you first, unless doing so would place a child at further risk.
Child protection: A practising psychologist is a mandated person under Schedule 2 of the Children First Act 2015. This means that where we have reasonable grounds for concern that a child has been, is being, or is at risk of being harmed, we are legally required to report that concern to Tusla, the Child and Family Agency. This duty overrides confidentiality.
Risk of serious harm: Where there is a risk of serious harm to you, your child, or another person, we may need to share information with emergency services, a GP, or another appropriate body.
Legal requirement: We may be required to disclose information by a court order or other legal process.
6. Who we share information with
We do not sell your information, and we do not share it for anyone else's marketing.
We share information with schools, GPs, other therapists or agencies only with your written consent, except where one of the limits in section 5 applies.
We use the following service providers, who process information on our behalf under contract:
| Provider | What they handle |
|---|---|
| Squarespace | Website hosting, enquiry forms and site analytics |
| Google (Workspace and Calendar) | Email, documents and appointment scheduling |
| Meta Platforms | Website advertising measurement, where you have consented to marketing cookies |
| Secure Practice Cloud Storage | Secure digital storage of clinical records and reports |
| Designated Accountant / Bookkeeper | Accounting and Revenue tax compliance |
We do not send clinical records, assessment reports or health information to Meta. Advertising tools are used only for general website measurement.
7. Transfers outside the European Economic Area
Some of our providers are based in, or transfer data to, the United States. Where that happens, transfers are made under safeguards approved by the European Commission — standard contractual clauses, or certification under the EU–US Data Privacy Framework. You may request further detail on these safeguards at any time.
8. How long we keep information
| Information | Retention period |
|---|---|
| Clinical records relating to a child | A minimum of seven years after the child reaches the age of majority — in practice, until their 25th birthday[cite: 1]. This follows PSI guidance on record keeping[cite: 1]. |
| Records relating to a child protection concern | Retained indefinitely, in line with PSI guidance and the Child Care Acts 1991–2015 |
| Clinical records relating to an adult client | Seven years from the end of the service |
| Enquiries that do not become clients | 12 months |
| Invoices and financial records | Six years, as required by Revenue |
| Marketing consents | Until you withdraw consent |
9. How we protect your information
- Records are stored securely, with access limited to those who need it to deliver or administer the service.
- Devices and accounts are password protected and encrypted.
- Paper notes, where used, are stored in a locked location and transferred to secure digital storage.
- We do not discuss identifiable client information over unsecured channels such as social media messaging.
- Email is convenient but not fully secure. Please avoid sending detailed sensitive information by email unless we have agreed a secure method with you.
10. Your rights
Under the GDPR you have the right to:
- Ask for a copy of the information we hold about you or your child.
- Ask us to correct information that is inaccurate or incomplete.
- Ask us to delete information, where we are not required to keep it.
- Ask us to restrict how we use it, or object to a particular use.
- Ask us to transfer information to another provider.
- Withdraw consent at any time, where consent is the basis we rely on.
To exercise any of these, email info@thebehaviourhive.com. We will respond within one month. There is no charge.
Please note that some information cannot be deleted on request, because we are professionally and legally required to retain clinical records for the periods set out in section 8.
11. Complaints to the regulator
If you are unhappy with how we have handled your information, please contact us first so we can try to put it right. You also have the right to complain to the Data Protection Commission:
- Online at www.dataprotection.ie — complaints must be submitted in writing through their online form
- 6 Pembroke Row, Dublin 2, D02 X963
- Canal House, Station Road, Portarlington, Co. Laois, R32 AP23
12. Cookies
Our website uses cookies for essential site function, analytics and advertising measurement. Non-essential cookies are only set where you have given consent through the cookie banner. You can change your preferences at any time through the banner or your browser settings.
13. Changes to this policy
We may update this policy from time to time. The date at the top shows when it was last revised. Material changes affecting current clients will be notified directly.
14. Contact
The Behaviour Hive, Donadea, Co. Kildare, W91 VY0T · 045 574 041 · info@thebehaviourhive.com