Privacy Policy

Hanne-Cecilia Smyth-Olsen, Psychotherapist & Counsellor. Privacy enquiries can be directed to therapy@hannececilia.com.

Booking form: name, email address, chosen therapy type (individual/couples), session time, language, and any optional message you choose to include.

Contact form ("Write to me"): name, email address and your message.

Payments: bookings are paid through Stripe. Card details are entered directly with Stripe and are never stored on this website. I receive payment confirmation, amount, currency, email and Stripe transaction identifiers.

No other public forms collect personal data.

Booking and delivering sessions — to perform the contract with you (GDPR art. 6(1)(b)).

Responding to contact enquiries — legitimate interest in answering enquiries (art. 6(1)(f)).

Accounting for payments — legal obligation under Norwegian bookkeeping law (art. 6(1)(c)).

The following is stored in the site's database:

• Bookings (name, email, session type, time, status, optional message)
• Contact messages (name, email, message, timestamp)
• Payment transactions (Stripe ID, amount, currency, email, metadata)
• Email delivery log (recipient, status, timestamp)

Any clinical notes or therapy records are managed separately from this website and are not stored through the website platform.

The application itself does not store IP addresses. Infrastructure providers (hosting, database, payments) may log IP addresses transiently for security and operational purposes.

The website does not use cookies for visitors, and no analytics tools such as Google Analytics, Meta Pixel or Plausible are installed. Stripe may set its own cookies on its hosted checkout page when you complete a booking.

Personal data is shared with the following processors that provide services to the website:

• Lovable Cloud / Supabase — hosting and database, EU region
• Stripe Payments Europe — card payments (Ireland/EU, with permitted transfers to the US)
• Lovable Email / Resend — sending booking confirmation and contact emails
• Cloudflare — CDN and operational infrastructure

Data is never sold or shared with third parties for marketing.

Database and email infrastructure are hosted in the EU. Stripe processes payment data within the EU/EEA but may transfer data to the US under approved EU transfer mechanisms (Standard Contractual Clauses and the EU–US Data Privacy Framework).

Contact messages: retained for up to 12 months after last contact, then deleted.

Bookings: retained for as long as necessary to manage the client relationship.

Payment records and accounting information: retained in accordance with applicable Norwegian bookkeeping and accounting legislation.

You have the right to access, rectification, erasure and restriction of processing of your personal data, as well as the right to data portability and to object to processing. Where processing is based on consent, you may withdraw consent at any time.

Deletion requests are honoured to the extent legally possible. Booking entries and contact messages can be deleted on request. Payment records must be retained until the statutory period expires.

You may also lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet).

Data is transmitted over encrypted connections (HTTPS/TLS). Access to the admin interface is protected by authentication and role-based access control.

This policy may be updated to reflect changes in the service or legal requirements. The latest version will always be available on this page.