Data Protection Notice

This Data Protection Notice (“Notice”) explains how The Harbour Clinic Pte Ltd (“The Harbour Clinic”, “we”, “us”
or “our”) collects, uses, discloses, stores and otherwise processes personal data in accordance with the Personal
Data Protection Act 2012 of Singapore (“PDPA”).

This Notice applies to personal data in our possession or under our control, including personal data processed on
our behalf by third-party service providers.

In some circumstances, The Harbour Clinic may also collect, receive, store or otherwise process personal data on
behalf of independent clinical psychologists or other independent practitioners providing professional
services to clients. Where we process personal data solely on behalf of an independent practitioner and for that
practitioner’s purposes pursuant to a contractual arrangement, we may act as a data intermediary in relation to
that processing.

Because the services facilitated by The Harbour Clinic relate to clinical psychology, some of the personal data we
handle may include sensitive information concerning an individual’s physical or mental health, psychological
functioning, development, behaviour or personal circumstances. We take the nature and sensitivity of this
information into account when determining appropriate safeguards.

This Notice should be read together with any consent forms, service terms, confidentiality information, privacy
notices or other information provided by The Harbour Clinic or your independent practitioner.

OUR ROLE AND THE ROLE OF INDEPENDENT PRACTITIONERS

Clinical psychology services facilitated through The Harbour Clinic are provided by independent practitioners.
Independent practitioners are responsible for their own:

​

 

• clinical services;

• professional and clinical decision-making;

• clinical notes and professional records;

• interpretation of assessment information and test results;

• diagnoses, formulations and treatment decisions;

• reports and other clinical documents they create;

• professional, ethical and legal obligations; and

• handling and retention of personal data forming part of their own professional clinical records.

 

The Harbour Clinic provides administrative and operational services that facilitate access to these practitioners.
In doing so, The Harbour Clinic may collect and maintain personal data for our own administrative and business
purposes, including information relating to enquiries, contact details, bookings, payments, communications and
service administration.

​

The Harbour Clinic may also collect, receive, store or otherwise process certain clinical or health-related
information on behalf of an independent practitioner for use in that practitioner’s clinical work.

For example, an independent practitioner may use questionnaire, intake or assessment software administered by
The Harbour Clinic to collect information from a client. The Harbour Clinic may therefore store or otherwise process
that information on the practitioner’s behalf.

Such information may include:

 

• intake information;

• clinical or developmental history;

• psychological screening questionnaire responses;

• assessment questionnaire responses;

• psychometric or other assessment data;

• information supplied by parents, guardians or collateral informants;

• referral documents;

• previous assessment or medical documents; and

• other information requested by the practitioner for the purpose of providing clinical services.

Where The Harbour Clinic processes such information solely on behalf of an independent practitioner, The Harbour
Clinic may act as a data intermediary, while the independent practitioner remains responsible for the purposes for
which the information is collected and for its clinical use and interpretation.

The Harbour Clinic does not ordinarily create or maintain the independent practitioner’s own professional
clinical notes, therapy notes, clinical formulations, diagnostic opinions or professional reports.

The fact that clinical information is collected or stored using a system administered by The Harbour Clinic does not
mean that The Harbour Clinic is responsible for the practitioner’s clinical interpretation of that information or the
professional services provided by the practitioner.

PERSONAL DATA

For the purposes of this Notice:
“client” means an individual who has contacted us, been referred to us, enquired about services, booked services
through us or received services facilitated through The Harbour Clinic. Where applicable, this may include a child
or young person and their parent, guardian or authorised representative.

“personal data” means data, whether true or not, about an individual who can be identified from that data, or from
that data together with other information to which the relevant organisation has or is likely to have access.

Depending on your interaction with us and the services being provided, personal data that The Harbour Clinic may
collect, receive, store or otherwise process can include:

 

• name and date of birth;

• telephone number, email address and other contact details;

• residential address;

• relevant demographic information;

• information required to verify identity where reasonably necessary;

• details of a parent, guardian, caregiver, emergency contact or authorised representative;

• enquiry and referral information;

• appointment and booking information;

• payment, billing and transaction information;

• correspondence and communications;

• consent and service-administration information;

• health, medical, psychological or developmental information supplied through an enquiry or intake process;

• information about previous assessments, diagnoses, treatment or healthcare providers;

• clinical or developmental history;

• psychological screening and questionnaire responses;

• assessment questionnaire responses and related assessment data;

• information supplied by parents, guardians, family members, referrers or other collateral informants;

• referral letters, previous reports or other documents supplied for use by an independent practitioner;

• feedback, complaint or service-quality information; and

• technical information generated when you use our website or online services, which may include IP address, browser or device information, cookies, analytics identifiers and website-usage information.

​

Some of this information may be collected and processed by The Harbour Clinic for our own purposes. Other
information may be collected or processed by us solely on behalf of an independent practitioner.
We generally seek to collect only personal data reasonably relevant to the purposes for which it is required.
Other terms used in this Notice have the meanings given to them under the PDPA where the context permits.

HOW WE COLLECT PERSONAL DATA

We may collect personal data directly from you when you:

 

• contact us by telephone, email, messaging service or through our website;

• submit an enquiry;

• make or manage a booking;

• complete an intake, consent, screening or administrative form;

• complete a questionnaire or assessment form administered through a system operated by The Harbour Clinic;

• provide information or documents for use by an independent practitioner;

• communicate with our administrative team;

• make a payment; or

• otherwise interact with The Harbour Clinic or systems administered by us.

We may also receive relevant personal data from third parties including:

​

 

• parents, guardians or authorised representatives;

• referring healthcare professionals;

• other healthcare providers;

• schools or educational institutions;

• family members or other collateral informants where appropriately authorised;

• independent practitioners providing services through The Harbour Clinic;

• government agencies or other organisations where appropriate; and

• service providers acting on our behalf.

Where another person provides information about you, we will handle that information in accordance with
applicable data-protection requirements.

Where you provide personal data about another individual, you should ensure that you are authorised to provide
the information where consent or other authority is required.

COLLECTION, USE AND DISCLOSURE OF PERSONAL DATA

We collect, use and disclose personal data in accordance with the PDPA.

Where consent is required, consent may be obtained expressly or may be deemed to have been given where
permitted under the PDPA.

Personal data may also be collected, used or disclosed without consent where this is permitted or required under
the PDPA or another applicable law.

Where required under the PDPA, we will notify you of the purposes for which personal data will be
collected, used or disclosed on or before such collection, use or disclosure.

The Harbour Clinic may collect, use or disclose personal data for purposes including:

​

 

• responding to enquiries about services;

• assisting clients to identify or arrange an appropriate service or practitioner;

• registering and administering a client’s relationship with The Harbour Clinic;

• arranging, confirming and managing appointments;

• facilitating the provision of clinical psychology services by independent practitioners;

• collecting information requested by an independent practitioner and making that information available to the practitioner;

• administering questionnaires, forms or assessment systems on behalf of independent practitioners;

• storing questionnaire, intake or assessment information on behalf of independent practitioners;

• facilitating communication between clients and practitioners;

• communicating about appointments, fees, forms, reports or other administrative matters;

• communicating with a parent, guardian or authorised representative where appropriate;

• verifying identity or authority where reasonably necessary;

• processing payments, refunds and other financial transactions;

• managing enquiries, requests, feedback and complaints;

• managing the quality, safety and administration of our services;

• responding appropriately to safety or safeguarding concerns brought to our attention;

• maintaining and securing our information technology, questionnaire and practice-management systems;

• detecting, preventing and responding to fraud, security incidents or misuse of our systems;

• operating, securing and improving our website and online services;

• conducting website analytics and measuring the effectiveness of our website or advertising, subject to applicable data-protection requirements;

• maintaining appropriate business, accounting, insurance, audit and administrative records;

• obtaining legal, accounting, information-technology, insurance or other professional services;

• investigating or responding to complaints, claims, disputes or legal proceedings;

• complying with applicable laws, regulations, court orders, regulatory requirements or lawful requests from authorities; and

• any other purpose notified to you for which consent is obtained where required.

Where information is required in order to arrange or facilitate a service, failure to provide that information may
mean that we or the relevant independent practitioner are unable to arrange or provide the requested service.

DISCLOSURE OF PERSONAL DATA

We do not disclose personal data to third parties except where reasonably necessary for the purposes described in
this Notice, where disclosure has been authorised, or where disclosure is otherwise permitted or required by law.

Depending on the circumstances, personal data may be disclosed to:

 

• the independent practitioner providing or proposed to provide services to you;

• authorised personnel involved in administering The Harbour Clinic;

• a parent, guardian or authorised representative where appropriate;

• third-party practice-management, questionnaire, online-form, booking, communications, cloud, information-technology, payment or other service providers supporting our operations;

• professional advisers including lawyers, accountants, auditors and insurers;

• regulatory, professional or governmental bodies where required or permitted by law;

• emergency services or other appropriate persons where disclosure is permitted or required in connection with a serious safety concern; and

• another person or organisation where disclosure has been authorised or is otherwise permitted or required by applicable law.

Where reasonably practicable, we limit disclosures to the information reasonably necessary for the relevant
purpose.

CLINICAL DATA PROCESSED ON BEHALF OF INDEPENDENT PRACTITIONERS

An independent practitioner may engage The Harbour Clinic to collect, receive, store or otherwise process
personal data on their behalf.

​

For example, The Harbour Clinic may provide or administer software through which clients complete clinical intake
forms, screening measures, questionnaires or other assessment materials requested by their practitioner.

Where The Harbour Clinic processes personal data solely on behalf of an independent practitioner and for that
practitioner’s purposes pursuant to a contractual arrangement, The Harbour Clinic may act as a data intermediary
in relation to that processing.

In these circumstances:

 

• the independent practitioner determines the clinical purposes for which the information is collected and used;

• The Harbour Clinic provides the administrative or technological means through which the information is collected, stored or made available to the practitioner;

• The Harbour Clinic does not make the practitioner’s clinical decisions or interpret the information on the practitioner’s behalf unless specifically agreed and lawfully permitted;

• the practitioner remains responsible for their own professional clinical record and clinical use of the information; and

• The Harbour Clinic remains responsible for complying with the data-protection obligations that apply to it in relation to the information it processes.

The Harbour Clinic may continue to store information collected on behalf of a practitioner for as long as reasonably
necessary for the purposes for which we have been engaged to process it, subject to applicable legal and data-
protection requirements.

INDEPENDENT PRACTITIONER CLINICAL RECORDS

Independent practitioners maintain responsibility for their own professional clinical records.

Depending on the service provided, these records may include:

​

 

• clinical and therapy notes;

• clinical observations;

• clinical formulations;

• interpretation of psychological assessment results;

• diagnoses;

• treatment plans;

• professional reports;

• clinical correspondence; and

• other information created by the practitioner in the course of their professional work.

Although some of the underlying information used by a practitioner may have been collected or stored through a
system administered by The Harbour Clinic, the practitioner’s own professional clinical record remains separate.

The Harbour Clinic does not ordinarily create or maintain the practitioner’s professional clinical notes, diagnostic
formulations or other records created by the practitioner in the course of providing clinical services.

CHILDREN AND YOUNG PEOPLE

Where services are arranged for a child or young person, we may collect personal data relating both to the child or
young person and to their parent, guardian or caregiver.

We or the independent practitioner may also collect relevant information from schools, teachers, family members,
healthcare professionals or other persons where appropriately authorised or otherwise permitted by law.

Some information about a child or young person may be collected through questionnaires or assessment systems
administered by The Harbour Clinic on behalf of the independent practitioner.

We take particular care when handling personal data relating to children and young people.

​

The extent to which information may be collected from, accessed by or disclosed to a parent, guardian or other
person may depend on the circumstances, including applicable law, the young person’s age and capacity, consent
and confidentiality considerations, and relevant professional obligations.

Where personal data is collected directly from a child or young person, we will take appropriate steps to
communicate information about the collection, use and disclosure of that data in a manner appropriate to
their age and understanding, and to obtain consent from a parent or guardian where required or
appropriate.

WITHDRAWING CONSENT

Consent provided to The Harbour Clinic for the collection, use or disclosure of personal data remains valid until
withdrawn, unless the relevant information may continue to be collected, used or disclosed without consent under
applicable law.

You may withdraw consent for some or all purposes by submitting a written request to our Data Protection Officer
using the contact details below.

Upon receiving a withdrawal request, we will consider the nature and scope of the request and inform you of the
likely consequences of withdrawing consent.

We will process withdrawal requests within a reasonable period.

Where applicable, we will also take appropriate steps in relation to third-party service providers processing the
relevant personal data on our behalf.

Depending on the scope of the withdrawal, we may no longer be able to arrange or provide some administrative
services.

Withdrawal of consent does not require us to delete information that we are permitted or required to retain and
does not prevent collection, use or disclosure without consent where permitted or required under applicable law.

Where personal data is processed by The Harbour Clinic solely on behalf of an independent practitioner,
withdrawal of consent relating to the practitioner’s clinical use of that information should generally be discussed
with the practitioner.

Withdrawal of consent from The Harbour Clinic does not necessarily withdraw consent separately provided to an
independent practitioner.

ACCESS TO PERSONAL DATA

You may request:

1. access to personal data about you that The Harbour Clinic holds in its own capacity and that is in our
possession or under our control; and

2. information about the ways in which that personal data has been or may have been used or disclosed by us
during the one-year period preceding your request, as provided under the PDPA.

Requests should be submitted in writing to our Data Protection Officer.

We may require sufficient information to verify your identity and identify the information requested.

A reasonable fee may be charged for an access request where permitted under the PDPA. If a fee applies, we will
inform you of the estimated fee before processing the request.

We will respond as soon as reasonably possible. If we are unable to respond within 30 calendar days after
receiving the request, we will inform you in writing within that period of the time by which we expect to respond.

Access rights are subject to the exceptions and prohibitions provided under the PDPA.

Information processed on behalf of an independent practitioner

​

Where personal data is held or processed by The Harbour Clinic solely on behalf of an independent
practitioner, including questionnaire, intake or assessment information collected for that practitioner’s clinical
purposes, the relevant independent practitioner may be responsible for responding to requests for access to that
information.

If we receive an access request relating to such information, we may refer or forward the request to the relevant
practitioner or otherwise assist with the request as appropriate.

Requests concerning the practitioner’s own professional clinical notes, reports, formulations or other clinical
records should be made directly to the practitioner.

CORRECTION OF PERSONAL DATA

You may request correction of an error or omission in personal data about you that The Harbour Clinic holds in its
own capacity and that is in our possession or under our control.

Correction requests should be submitted in writing to our Data Protection Officer.

Where a correction should be made, we will correct the relevant personal data as soon as practicable and take any
additional steps required under the PDPA.

The correction right is subject to applicable statutory exceptions.

Where personal data is held or processed by The Harbour Clinic solely on behalf of an independent practitioner,
the practitioner may be responsible for determining and implementing an appropriate correction. We may therefore
refer or forward such a request to the relevant practitioner.

Requests relating to information contained solely in a practitioner’s own professional clinical record should be
directed to that practitioner.

PROTECTION OF PERSONAL DATA

We take reasonable administrative, physical and technical measures to protect personal data in our possession or
under our control against unauthorised access, collection, use, disclosure, copying, modification, loss, disposal and
similar risks.

These protections apply both to personal data that The Harbour Clinic holds for its own purposes and to personal
data that we process on behalf of independent practitioners.

Depending on the systems and information involved, measures may include:

​

 

• restricting access to persons who reasonably require it;

• role-based access controls;

• password and authentication requirements;

• multi-factor authentication where appropriate;

• encryption and secure communications technologies where appropriate;

• use of appropriate cloud, questionnaire, practice-management and information-technology service providers;

• device and account-security measures;

• software and operating-system updates and security patching;

• malware and security protections;

• confidentiality and data-protection requirements for personnel and relevant service providers;

• secure disposal or deletion processes;

• review of access permissions and security arrangements; and

• procedures for identifying, assessing and responding to suspected data breaches.

We recognise that health, clinical and psychological information — including questionnaire and assessment data —
may be particularly sensitive and take that sensitivity into account when determining appropriate access controls
and security safeguards.

​

While no information system can eliminate all security risks, we maintain reasonable administrative, technical and
physical safeguards appropriate to the nature and sensitivity of the personal data we handle.

DATA BREACHES

We maintain procedures for identifying, assessing, containing and responding to suspected or confirmed personal
data breaches.

Where a breach relates to personal data that The Harbour Clinic holds for its own purposes, we will assess and
respond to the breach in accordance with applicable requirements under the PDPA.

Where a breach relates to personal data that we process on behalf of an independent practitioner, we will notify the
relevant practitioner as required and cooperate with them in assessing and responding to the breach.

Where The Harbour Clinic is responsible for making a notification under the PDPA, we will notify the Personal
Data Protection Commission (“PDPC”) and affected individuals where required by law.

We may also take other appropriate steps to contain an incident, reduce the risk of harm, investigate its cause and
reduce the risk of recurrence.

ACCURACY OF PERSONAL DATA

We make reasonable efforts to ensure that personal data collected by or on behalf of us is accurate and complete
where it is likely to be used by us to make a decision that affects you or is likely to be disclosed by us to another
organisation.

We generally rely on information provided by you, your authorised representative and other relevant sources.

Please inform us if your contact details or other relevant information changes.

Where information has been collected or stored on behalf of an independent practitioner, you may also need to
notify the practitioner of relevant changes.

RETENTION OF PERSONAL DATA

We retain personal data only for as long as retention continues to serve the purpose for which the information was
collected or is otherwise necessary for legal, regulatory, insurance or legitimate business purposes.

For personal data held by The Harbour Clinic for our own purposes, this may include administrative information
relating to:

​

 

• enquiries;

• bookings and appointments;

• consent and service administration;

• payments and transactions;

• communications;

• complaints or incidents; and

• other records reasonably required to administer our business.

Where The Harbour Clinic collects or stores clinical or other personal data on behalf of an independent
practitioner, we may retain that information for as long as reasonably necessary to perform the services for which
we have been engaged and in accordance with applicable legal and data-protection requirements.

We will cease to retain personal data, or remove the means by which the personal data can be associated with an
identifiable individual, when it is reasonable to assume that:

1. retention no longer serves the purpose for which the personal data was collected or processed; and

2. retention is no longer necessary for legal or business purposes.
Independent practitioners remain separately responsible for determining and complying with retention requirements applicable to their own professional clinical records.

​

Termination of services or withdrawal of consent does not necessarily result in immediate deletion of personal data
where continued retention is permitted or required.

TRANSFERS OF PERSONAL DATA OUTSIDE SINGAPORE

As an online service provider, we may use technology, cloud infrastructure, service providers or authorised
personnel located outside Singapore.

Personal data may therefore be transferred to, stored in, processed in or accessed from locations outside
Singapore.

Where personal data is transferred outside Singapore, we will comply with the Transfer Limitation Obligation
under the PDPA.

We will take appropriate steps to ensure that transferred personal data receives a standard of protection at least
comparable to the protection provided under the PDPA.

Depending on the circumstances, safeguards may include:

​

 

• ensuring overseas recipients are subject to legally enforceable obligations concerning protection of the transferred personal data;

• appropriate contractual data-protection provisions;

• due diligence concerning service providers and their privacy and security arrangements; or

• another transfer mechanism permitted under the PDPA.

​

Where we process personal data on behalf of an independent practitioner and that processing involves
locations outside Singapore, we will implement appropriate safeguards in accordance with our
arrangements with the practitioner and applicable requirements under the PDPA.

The use of overseas technology infrastructure, personnel or service providers does not remove our obligation to
take appropriate steps to protect personal data in our possession or under our control.

THIRD-PARTY SERVICE PROVIDERS

We may use third-party service providers to support functions including:

​

 

• practice and appointment administration;

• clinical questionnaires and online forms;

• assessment-data collection;

• email and other communications;

• cloud hosting and storage;

• payment processing;

• accounting and business administration;

• website hosting;

• website analytics and performance measurement;

• information-technology support; and

• other functions reasonably necessary for our operations or for services we provide on behalf of independent practitioners.

Where a third party processes personal data on our behalf, we take reasonable steps appropriate to the
circumstances in selecting and managing that provider, including considering relevant security, privacy and
contractual arrangements.

Where such a provider processes personal data outside Singapore, the provisions above concerning overseas
transfers apply.

Where a third-party provider collects or processes personal data for its own independent purposes, that provider’s
own privacy notice and data-protection obligations may separately apply.

​

WEBSITE, COOKIES, ANALYTICS AND ADVERTISING MEASUREMENT

When you use our website, certain technical information may be collected automatically through cookies and
similar technologies.

Depending on the technologies used, this may include:

​

 

• IP address;

• browser and device information;

• pages visited;

• date and time of visits;

• referring website or source;

• interactions with website features; and

• identifiers used for analytics or advertising measurement.

We may use this information to operate and secure our website, understand how visitors use it, improve our
services and measure the effectiveness of our website or advertising.

Where consent is required for a particular use of cookies or similar technologies, we will obtain consent as
required.

We do not use independent practitioners’ clinical notes, substantive psychological assessment responses, raw
clinical assessment data, diagnoses or professional clinical reports for advertising targeting.

Where analytics or advertising-measurement services are used, we seek to limit the personal data disclosed to
what is reasonably necessary for the relevant purpose and do not intentionally transmit substantive clinical records
or questionnaire responses to advertising providers.

MARKETING COMMUNICATIONS

Communications relating to appointments, bookings, payments, forms, reports, service administration or other
matters relating to a service you have requested are generally administrative rather than promotional
communications.

If The Harbour Clinic sends promotional or marketing communications, we will do so in accordance with applicable
requirements under the PDPA, including the Do Not Call provisions where they apply to communications sent to
Singapore telephone numbers.

Where required, we will obtain appropriate consent or check the relevant Do Not Call Registry before sending a
specified marketing message.

Where applicable, marketing communications will include an appropriate means of withdrawing consent or
requesting that such communications cease.

A request to stop marketing communications will not prevent us from sending necessary administrative or service-
related communications.

CLINICAL CONFIDENTIALITY

Information provided in connection with psychological services may also be subject to professional duties of
confidentiality owed by the independent practitioner providing the service.

Those professional confidentiality obligations are separate from The Harbour Clinic’s obligations under the PDPA.

Independent practitioners are responsible for explaining the confidentiality arrangements applicable to the
professional services they provide, including any circumstances in which information may be disclosed without the
client’s consent.

The Harbour Clinic will maintain confidentiality in relation to personal data within its possession or control in
accordance with applicable legal and contractual obligations.

​

DATA PROTECTION OFFICER

The Harbour Clinic has designated a Data Protection Officer (“DPO”) to oversee our data-protection practices.

You may contact our DPO if you:

​

 

• have questions about this Notice or our handling of personal data;

• wish to withdraw consent relating to processing carried out by The Harbour Clinic;

• wish to request access to or correction of personal data for which The Harbour Clinic is responsible;

• wish to raise a privacy concern or complaint; or

• otherwise wish to contact us regarding personal-data protection.

Data Protection Officer
The Harbour Clinic Pte Ltd
Email: dan@harbourclinic.com.sg
Telephone: +65 8220 2604
Address: 20 Cecil Street #05-03 PLUS, Singapore 049705

We may request information reasonably necessary to verify your identity before processing a request concerning
personal data.

Where your request concerns information that The Harbour Clinic processes solely on behalf of an independent
practitioner, or concerns the practitioner’s own professional clinical records, we may direct or forward your request
to the relevant practitioner as appropriate.

QUESTIONS AND COMPLAINTS

If you have a question or concern regarding our collection, use, disclosure, storage or protection of personal data,
please contact our Data Protection Officer in the first instance.

We will consider complaints in good faith and take reasonable steps to investigate and respond to them.

Where a complaint concerns an independent practitioner’s own clinical records or handling of personal data for
their independent professional purposes, we may direct you to the relevant practitioner.

Nothing in this Notice affects any right you may have to contact the Personal Data Protection Commission or
exercise another right available under applicable law.

EFFECT OF NOTICE AND CHANGES TO NOTICE

This Notice applies together with any other notices, consent documents, contractual provisions or privacy terms
that apply to personal data processed in connection with our services.

Independent practitioners may also provide their own consent, confidentiality or privacy information relating to the
professional services they provide and the clinical records they maintain.

We may update this Notice from time to time to reflect changes to our practices, services, technology or legal
obligations.
The current version will be made available through our website and will indicate the date on which it was last
updated.
Where a change involves a new purpose for collection, use or disclosure of personal data for which notification or
consent is required under the PDPA, we will provide the required notification and obtain consent where necessary.

Last updated: 14 August 2026