Privacy Policy & International Data Protection Notice

Last updated: July 15, 2026

​

This Privacy Policy describes the policies and procedures of Gabriel Marchand (Sole Practitioner) on the collection, use, storage, protection, and disposal of Your personal and sensitive information.

​

While My practice is based in South Africa and complies strictly with the Protection of Personal Information Act (POPIA), No. 4 of 2013, My services are offered globally. This policy is designed to respect international data protection standards, including the General Data Protection Regulation (GDPR) for clients in the EU/UK, and equivalent state/national privacy frameworks elsewhere.

​

By submitting any screening, application, or intake forms, and by using My Services, You explicitly consent to the cross-border transfer, collection, processing, and storage of Your information as described in this policy.

​

1. Definitions & Key Roles

• The Practitioner (The "Responsible Party" or "Data Controller"): Gabriel Marchand, a sole practitioner operating online via Google Meet.

• The Client (The "Data Subject"): Any individual applying for, screening for, or participating in My individual or group online sessions.

• Personal Data: Any information relating to an identified or identifiable individual.

• Special Category / Special Personal Data: Highly sensitive information, including but not limited to Your mental health history, physical health, emotional well-being, trauma history, or personal life details provided during intake/screening.

 

2. Collection of Sensitive Screening Data (Google Forms)

To evaluate your readiness and suitability for individual or group sessions, I collect sensitive, in-depth information via digital intake and screening forms (primarily hosted on Google Forms).

​

What We Collect

• Identifying & Contact Information: Full name, date of birth/age, email address, phone number, physical time zone, and emergency contact details.

• Special / Sensitive Personal Data: Deeply personal details about Your psychological history, current emotional struggles, mental health goals, trauma history, and past therapeutic experiences.

​

Your Consent & Cross-Border Acknowledgment

By filling out and submitting these screening forms, You explicitly acknowledge and consent to the following:

1. Voluntary Provision: You are sharing this sensitive psychological and personal data voluntarily to assist me in screening.

2. Cross-Border Processing: You consent to Your data being transferred to and processed in South Africa (where I am located) and globally on secure cloud-based servers (such as Google’s infrastructure).

3. Platform Risks: While I enforce strict cybersecurity protocols, transmitting sensitive health information over third-party digital networks (such as Google) carries inherent data risks. You submit this data acknowledging these parameters.​

​

3. Storage & Security Protocol

I enforce strict technical and organizational measures to keep your highly sensitive psychological data safe:

• Access Control: Only Gabriel Marchand has access to raw data collected from Google Forms and Google Sheets. No virtual assistants, administrative staff, or third parties can access this data.

• Multi-Factor Authentication (MFA): The Google Workspace account hosting My forms, client database, and calendar is protected by strict Multi-Factor Authentication (MFA) and strong, randomized passwords.

• Device Encryption: All physical devices (laptops, tablets, mobile phones) used to access Google Workspace or conduct Google Meet sessions are fully encrypted, password-protected, and secured with biometric locks.

• Cloud-First Storage: To reduce the risks of physical device theft, all sensitive files are kept securely in encrypted cloud environments (Google Drive) rather than downloaded onto local hard drives.

​

4. Data Retention & Secure Disposal Protocol

To protect Your privacy, I do not store sensitive psychological data indefinitely. I adhere to a strict lifecycle protocol for data disposal:

​

A. For Applicants Who Do Not Proceed

If You submit a screening form but do not join a group or begin individual sessions (either because the container is not a fit, or You choose not to move forward):

• Retention Period: Your sensitive screening form responses and any preliminary notes will be kept for no longer than 90 days.

• Disposal Method: After 90 days, the Google Form response, associated Google Sheet rows, and any emails related to your screening will be permanently, digitally shredded/deleted from all cloud platforms (including clearing trash/recycle bins).

​

B. For Active and Ongoing Clients

If You proceed with My services (individual or group):

• Retention Period: Your intake forms, screening data, and ongoing session notes will be kept for the duration of our professional relationship, and thereafter for a period of 5 years to comply with legal, clinical, and ethical record-keeping standards in South Africa.

• Disposal Method: Upon reaching the 5-year post-relationship threshold, all digital records, cloud folders, and associated files will be permanently deleted and purged from all servers.

​

5. Limitation of Liability & Third-Party Platforms

I utilise secure, industry-leading third-party platforms to run My practice (primarily Google Forms, Google Drive, and Google Meet).

​

While I take all reasonable security steps required by POPIA (Section 19) and global frameworks, I cannot guarantee the absolute security of Google's global servers or prevent complex cloud-level data breaches.

​

By using My Service and submitting sensitive screening forms, You release Gabriel Marchand from liability for any data breaches, leaks, or unauthorised access that occur due to third-party software vulnerabilities or infrastructure failures, provided I have maintained reasonable security measures (such as MFA and secure device access) on my end.

​

6. Your Rights Under POPIA & GDPR

Regardless of where You are located in the world, I recognise Your fundamental rights regarding Your personal data:

• Right of Access: You may request a copy of all personal and sensitive data I hold about You at any time.

• Right to Rectification: You may request that I update, correct, or complete any inaccurate personal details.

• Right to Erasure ("Right to be Forgotten"): You may request that I prematurely delete and destroy your screening/session data. Please note that this is subject to overriding legal or clinical record-keeping obligations.

• Right to Withdraw Consent: You can withdraw Your consent for me to process Your data at any time. Note that doing so during a screening phase will result in the immediate cancellation of Your application, as I cannot safely conduct sessions without screening data.

​

7. Contact Me

If you have any questions, concerns, or requests regarding how your sensitive screening data is handled, stored, or destroyed, please contact me directly:

• Practitioner: Gabriel Marchand

• Email: gabrielmarchandtherapy@gmail.com

• Location: South Africa