Last updated: 20 August 2026
Who I am
I am Ishana Durante-Bose, and I run The Circle Clinic. I am the person responsible for your personal data, which in legal terms makes me the data controller.
- The Circle Clinic, Rapenburg 17, 2311 GE Leiden, The Netherlands
- Chamber of Commerce (KVK): 85431346
- VAT (BTW): NL004092677B81
- NIP registration: 236055
- Email: info@thecircleclinic.com
- Phone: +31 6 1313 4670
If anything here is unclear, or you want something explained in plain terms, please just email me. I would rather have the conversation than have you wondering.
The short version
I collect as little as I can, I keep it secure, and I do not sell it or share it for marketing. If you contact me about therapy, your name and email reach me, confidentiality-bound admin personnel like Luzina, and, with your agreement, the therapist you want to work with. If you become a client, I keep a treatment file, which Dutch healthcare law requires me to hold for 15 years. You can ask me at any time what I hold, and ask for a copy.
The rest of this page is the details.
What I collect, and when
When you fill in the contact form
The form collects your name and email address, along with whatever you choose to tell me about what you are looking for and which therapist you would like to work with. It also records the page you submitted from, which helps me understand which parts of the site people find useful.
Please do not use the contact form to send detailed information about your health. A first email only needs enough for me or Luzina to point you in the right direction. There is space for the rest once we’re working together – in a setting built for it.
When you become a client
Once we begin working together I keep a treatment file. Depending on the work, that may include your contact details, date of birth, session notes, intake information, correspondence, and invoicing records.
Therapy notes are health data, which the GDPR calls special category data and treats with extra care. I hold them under the exemption that applies to healthcare providers bound by professional secrecy, and under the Dutch Medical Treatment Agreement Act (WGBO), which governs how healthcare records are kept in the Netherlands.
When you join the newsletter
Just your email address. The newsletter goes out once or twice a year. Every email has an unsubscribe link, and I will never keep sending you newsletters if you unsubscribe.
If you buy something
The website has a shop. If you buy a digital product I receive your name, email address, billing details and a record of the order. Card details go directly to the payment provider and never reach me or the website.
When you simply visit the website
The site uses Google Analytics to count visits and see which pages get read. This only runs if you accept analytics cookies in the banner. If you decline, it does not run and I see nothing about your visit beyond ordinary server logs. There is more detail in the Cookie Policy.
Why I collect it, and the legal basis
| What | Why | Legal basis |
|---|---|---|
| Contact form details | To reply to you and route your enquiry to the right therapist | Steps taken at your request before entering a contract |
| Treatment file | To provide psychological care safely and to a professional standard | Contract, and a legal obligation under the WGBO. For the health data itself, the healthcare provider exemption in Article 9(2)(h) GDPR |
| Invoicing records | To send invoices and meet Dutch tax obligations | Legal obligation |
| Newsletter | To send you occasional updates you asked for | Your consent |
| Analytics cookies | To understand how the site is used | Your consent |
| Shop orders | To sell and deliver what you bought | Contract |
Who else sees your information
The Circle Clinic is me, working with a small number of people. This is exactly who they are and what they can see.
- Laura is a NIP-registered psychologist who works with me as a freelancer. If you choose to work with Laura, she receives your contact details and holds her own treatment file for your work together.
- Lizzie and Divya are completing their clinical practice internships. They work under supervision. If you work with either of them, their supervisor is involved in that work.
- Luzina helps me with administration as a freelancer and has access to the info@thecircleclinic.com inbox so that enquiries get answered promptly. She sees the contact details and administrative information needed to do that, and nothing more (she’s bound by confidentiality too).
Everyone listed here is bound by confidentiality, whether by their professional code, their contract with me, or both.
Being introduced to another therapist
When you get in touch and tell me who you would like to work with, I pass your name and email to that person so they can contact you.
If the therapist you picked is not available, I will come back to you with another suggestion. I will not pass your details to a different therapist until you have said yes. That consent is yours to give, and yours to withhold, and saying no changes nothing about how I respond to you.
The services I rely on
Running a practice means using other people’s software. These suppliers process data on my behalf, under contracts that require them to protect it:
- GoDaddy, which hosts the website
- Google Workspace, for the info@thecircleclinic.com email account
- Google Analytics, for website statistics, and only with your consent
- WPForms, the contact and newsletter forms on the website
- MoneyMonk, financial administration
- Stripe and PayPal, if you buy something from the shop
Some of these companies are based in the United States, or store data there. Where that happens, transfers are covered by the EU-US Data Privacy Framework or by Standard Contractual Clauses approved by the European Commission.
I do not sell your data. I do not share it with advertisers. Nobody outside the people and services named above sees it, except in the specific situations set out below.
Confidentiality, and its limits
What you tell me stays between us. There are four situations where I may have to share information without your consent, and I would tell you if any of them arose unless doing so would create a risk:
- I believe you, a child, or another adult is at risk of serious harm
- A court orders me to disclose information
- I need to use records to respond to or defend a legal claim
- The law otherwise requires it
I discuss my work in supervision and intervision with other fully registered psychologists. This is a professional requirement and it makes me better at my job. In those settings I do not use your name or anything else that would identify you.
Session recordings
As part of ongoing professional training and accreditation, I sometimes video record sessions for reflection and consultation.
I will always ask before recording, and you can say no, or change your mind later – it won’t affect your therapy or our relationship in any way. Recordings are stored securely and only seen by supervisors or accreditation assessors who are themselves bound by professional confidentiality.
How long I keep things
- Treatment files: 15 years from the end of treatment. This is set by the WGBO and is not something I can shorten at will, though you can ask me to delete earlier and I will do so where the law permits.
- Contact form enquiries that do not become therapy: up to 12 months, then deleted.
- Invoicing and tax records: 7 years, as Dutch tax law requires.
- Newsletter: until you unsubscribe.
- Analytics: 14 months.
Keeping it safe
Files are stored securely with access limited to the people who need it. The website runs over an encrypted connection. Email is protected by two-factor authentication. I review this periodically, and if there were ever a breach affecting your rights, I would tell you and report it to the Autoriteit Persoonsgegevens as the law requires.
Your rights
You have the right to:
- See what I hold about you, and get a copy of your file
- Correct anything that is wrong
- Delete your data, where the law allows it. The 15 year retention rule limits this for treatment files
- Restrict or object to how I use your data
- Take your data elsewhere in a portable format
- Withdraw consent at any time, for anything you consented to, such as the newsletter, cookies, or recordings
Email me at info@thecircleclinic.com and I will respond within one month. There is no charge.
Children
The Circle Clinic works with adults. I do not knowingly collect information about anyone under 16 through this website.
Complaints
If you think I have handled your data badly, please tell me first, because most things are quickest to fix directly. If that does not resolve it, you have the right to complain to the Dutch data protection authority:
Autoriteit Persoonsgegevens, Postbus 93374, 2509 AJ Den Haag autoriteitpersoonsgegevens.nl
A note on emergencies
The Circle Clinic is not an emergency service. If you are in crisis, please contact your huisarts, the huisartsenpost, call 112, or call 113 Zelfmoordpreventie on 0800 0113. They are there around the clock.
Changes to this policy
If I change how I handle your data, I will update this page and change the date at the top. If the change is significant and you are a current client, I will tell you directly.
Questions about any of this are welcome. Email info@thecircleclinic.com.