1. Who We Are
Ambrave Counselling & Therapy ("Ambrave", "we", "us", "our"), operated by AMBRAVE SINGAPORE PTE. LTD. (UEN 202342471D), is a Singapore-based practice offering corporate talks and training, and private mental health services including adult therapy, couples therapy, and children's Applied Behaviour Analysis (ABA) therapy.
Registered address: 200 Jln Sultan, #03-01D Textile Centre, Singapore 199018
Email: info@ambravesg.com
Phone: +65 8336 1662
Website: www.ambravesg.com
This Privacy Policy explains how we collect, use, disclose, and protect your personal data in compliance with Singapore's Personal Data Protection Act 2012 (PDPA). It applies to: visitors to www.ambravesg.com; corporate training clients and their employees; Employee Assistance Programme (EAP) clients; adult therapy clients; and children's ABA therapy clients (and their parents or guardians).
By using our website or services, you acknowledge that you have read and understood this policy.
2. Data Protection Officer
As required under the PDPA, Ambrave has appointed a Data Protection Officer (DPO). For all data protection queries, access requests, or complaints, please contact our DPO at:
Fion Yu, Data Protection Officer, Ambrave Counselling & Therapy
Email: info@ambravesg.com
Address: 200 Jln Sultan, #03-01D Textile Centre, Singapore 199018
We aim to respond to all data protection enquiries within 30 days of receipt.
3. Personal Data We Collect
We only collect personal data that is necessary for the purposes described in this policy. The data we collect depends on how you interact with us:
Website visitors
We use two analytics tools on www.ambravesg.com. Both start collecting either as soon as you interact with the page or a few seconds after it opens, whichever comes first. Google Analytics records the pages you view, the links and buttons you click, your approximate location (city level, from your IP address), your device and browser, and how you arrived at our site. Microsoft Clarityrecords your session — mouse movement, scrolling, clicks and the pages you move between — so we can see where the site is confusing to use.
We do not use either tool for advertising, and we do not sell or share this data with advertisers. The contents of our enquiry form are never sent to either tool. Neither tool tells us who you are by name; both identify browsers rather than people. The Google Maps embed in our footer also collects your IP address and browser information when it loads — see Section 5.
You can opt out of Google Analytics on every site you visit usingGoogle's browser add-on, and out of Microsoft Clarity usingthe controls in Microsoft's privacy statement. Most browsers also let you block or delete cookies entirely — see Section 12.
Contact form enquiries
Our website contains an enquiry form. When you submit it, we collect: yourname, email address, and the content of your message, along with your company and team sizeif you choose to provide them. Submission of this form requires you to tick a consent checkbox confirming you are happy for us to contact you about your enquiry.
The form is delivered to us by Web3Forms, which transmits your enquiry to our inbox. Spam is filtered by a hidden honeypot field, Web3Forms' own server-side checks, and an hCaptcha check that asks you to confirm you are human before the form will send. hCaptcha collects your IP address, browser and device details, and interaction data such as mouse movements, scroll position and key presses, in order to tell people apart from bots. It also sets its own cookies. Web3Forms and hCaptcha are both overseas processors — see Section 6.
Appointment bookings
Appointments are booked via our online booking system, operated by Odoo (ambrave-appts.odoo.com). When you book an appointment, Odoo collects data on our behalf, which may include: your name, email address,phone number, appointment type, and anynotes you provide (which may include health or workplace information).
WhatsApp enquiries
Our website includes a WhatsApp button that opens a chat with Ambrave at +65 8336 1662. When you use this feature, your phone number, WhatsApp display name, and the content of your messages (which may include health or workplace information) are shared with WhatsApp (a Meta platform). Please refer to Meta's privacy policy for information on how they handle your data.
Corporate training clients
When your organisation engages Ambrave for training programmes, we may collect:company name, HR or programme contact details, and where relevant, employee names and contact details provided for programme delivery and pre/post measurement.
EAP clients
Employee Assistance Programme clients provide name,contact details, and clinical data (presenting issues, session notes, mental health history). This data is treated with the highest level of confidentiality — see Section 8 (Mental Health Data).
Adult therapy clients
When you engage Ambrave for therapy, we collect: name,contact details, presenting issues,clinical session notes, mental health history, and where relevant, medication information andreferral documents.
Children's ABA therapy clients
For children's ABA therapy, we collect the child's name,date of birth, developmental history, andABA assessment and session records, as well as theparent or guardian's name and contact details. All data relating to children is collected only with verified parental or guardian consent — see Section 9.
NRIC and identification data
We do not collect NRIC or other national identification numbers through this website. Where identity verification is needed for in-person clinical services, that is handled separately at intake under its own consent.
4. How We Use Your Data
We use personal data only for the purposes for which it was collected:
- Responding to your enquiries and booking requests
- Scheduling and administering appointments
- Delivering corporate talks and training services
- Providing therapy and clinical services
- Processing payments and issuing invoices
- Compliance with legal obligations, and our professional obligations under the SAC and APACS ethical codes
- Communicating with you about your service (not marketing without your separate, explicit consent)
- Aggregated, anonymised reporting to corporate clients on programme outcomes — individual data is never shared with employers
We will not use your data for any purpose that was not notified at the time of collection without first obtaining your consent.
5. Who We Share Your Data With
We do not sell your personal data. We share data only where necessary and as described below:
Odoo (appointment booking)
Odoo acts as a data intermediary on our behalf for every appointment you book with us — adult therapy, children's services and corporate discussions. Data entered into the Odoo booking form is stored on Odoo's servers. We have engaged Odoo under data processing terms.
WhatsApp / Meta
When you contact us via WhatsApp, your data is processed by Meta Platforms, Inc. Meta processes data in the United States and other jurisdictions under their own privacy policy. We have no control over how Meta handles data transmitted via WhatsApp.
Google (Maps embed)
Our website footer includes an embedded Google Map. When this embed loads, Google may collect your IP address and browser/device data. This is governed by Google's privacy policy.
Web3Forms (enquiry form delivery)
When you submit our enquiry form, the details you provide are transmitted to our inbox by Web3Forms, a US-based form-delivery service acting as a data intermediary on our behalf. Web3Forms relays your submission to us and states that it does not store it. Spam is filtered by a hidden honeypot field, Web3Forms' own server-side checks, and the hCaptcha check described below. See Section 6 for the cross-border transfer.
hCaptcha (bot protection on the enquiry form)
Our enquiry form uses hCaptcha, operated by Intuition Machines, Inc., a US-based company. hCaptcha decides whether a submission comes from a person or a bot. To do that it collects your IP address, browser and device details, and interaction data such as mouse movements, scroll position and key presses, and it sets its own cookies. We do not receive this data; Intuition Machines holds it as controller under its ownprivacy policy. Without completing the check the form will not send. You can still reach us by email or WhatsApp instead. See Section 6 for the cross-border transfer.
Clinical supervisors
In line with our professional obligations under SAC and APACS ethical codes, session records may be reviewed by a clinical supervisor. All supervisors are bound by the same confidentiality obligations as the treating therapist.
Legal or regulatory requirements
We may disclose personal data if required to do so by law, court order, or a regulatory authority. We will notify you of any such disclosure where we are legally permitted to do so.
What we do not share
EAP and therapy clients: we never share individual clinical data with your employer or any third party without your explicit written consent. Any reporting to corporate EAP clients is anonymised and aggregate only.
6. Cross-Border Data Transfers
Some of our third-party service providers process data outside Singapore:
- WhatsApp / Meta: data is processed in the United States and other jurisdictions. Meta has implemented standard contractual clauses and other transfer mechanisms.
- Web3Forms: our enquiry form is delivered via Web3Forms, which runs on servers in the eastern United States. Web3Forms states that it does not store the submissions it relays. Its server logs can contain personal data, and it states that it deletes those logs roughly every two months.
- hCaptcha: the bot check on our enquiry form is operated by Intuition Machines, Inc., which is based in the United States and states that it controls and operates the service from there. It states that it complies with the EU-US Data Privacy Framework and the UK extension to it.
- Odoo: Odoo hosts each customer database in the region closest to the customer, which for Ambrave is its Asia & Pacific region (Singapore and Taiwan). Odoo also keeps redundant backups in separate data centres, and it states that backup locations cannot be chosen or restricted, so some backup copies may sit outside Singapore.
- Google: Google Maps embed data is processed by Google globally.
Where data is transferred outside Singapore, we ensure that appropriate safeguards are in place as required under the PDPA.
7. How Long We Keep Your Data
We keep client records for as long as Ambrave is in practice. We do not run a fixed deletion schedule. The periods below are minimums we hold records for, not the point at which we delete them.
- Contact form and general enquiry data: kept on file. We do not delete enquiries to a set timetable.
- Appointment and booking records: kept on file.
- Clinical and therapy records (adult): kept for at least6 years from your last appointment, and in practice for longer.
- EAP records: kept for at least 6 years from the last session. EAP contract terms may place further confidentiality restrictions on them.
- Children's ABA therapy records: kept for at least 6 years from the child's last appointment, or from the child turning 18, whichever is later.
- Corporate training records: kept on file, or for the period set out in the client contract.
You can withdraw your consent for us to hold your data. Section 11 explains how, and what we may still need to keep after you do.
8. Mental Health and Clinical Data — Heightened Protections
Ambrave handles mental health, therapy, and EAP data as sensitive personal data. We apply elevated protections to this data category:
- Clinical records are accessible only to the treating therapist and, where required by professional standards, a clinical supervisor under confidentiality.
- EAP confidentiality: employers who engage Ambrave for EAP servicesdo not receive individual employee data. Any reporting provided to the employer is anonymised and aggregate (e.g. utilisation rates), and only if agreed in the EAP contract.
- Under the PDPA, mental health data carries lower breach notification thresholds — even a breach affecting a small number of individuals may require notification to the PDPC and to affected individuals if it could cause discrimination, emotional distress, reputational damage, or financial harm. We take this obligation seriously and have implemented corresponding safeguards.
9. Children's Data
Where we provide ABA therapy or other services to children, all personal data relating to that child is collected only with the explicit consent of a parent or legal guardian. We do not knowingly collect data directly from children. Parents and guardians retain all PDPA rights (access, correction, withdrawal of consent) in respect of their child's data held by Ambrave.
10. How We Protect Your Data
We implement reasonable physical, administrative, and technical safeguards to protect personal data against unauthorised access, use, disclosure, modification, or loss:
- Access to clinical records is restricted to authorised therapists on a need-to-know basis
- Electronic data is stored on password-protected systems with access controls
- Paper records (where used) are stored in locked, access-controlled locations at our practice
- Third-party processors (Odoo) are engaged under data processing terms
- Staff with access to personal data are subject to confidentiality obligations
No system is perfectly secure. If you have reason to believe your data has been compromised, please contact our DPO immediately.
11. Your Rights Under the PDPA
Under the PDPA, you have the right to:
- Access: request a copy of the personal data we hold about you and information about how it has been used or disclosed in the past 12 months.
- Correction: request that we correct any personal data we hold about you that is inaccurate, incomplete, or misleading.
- Withdrawal of consent: withdraw your consent for us to collect, use, or disclose your personal data for purposes that are not legally required. Note that withdrawal of consent for clinical purposes may mean we are unable to continue providing treatment.
We will respond to all access and correction requests within 30 days of receipt. To exercise any of these rights, please contact our DPO using the details in Section 2.
12. Cookies
Our website uses analytics cookies set by Google Analytics and Microsoft Clarity, described in Section 1. They tell us which pages are read, where visitors lose their way, and which parts of the site lead to an enquiry. We do not use advertising or re-targeting cookies. We also use essential storage to support basic website functionality, such as remembering which sections of the site you have visited.
Analytics loads either as soon as you interact with the page or a few seconds after it opens, whichever comes first. You can block or delete cookies in your browser settings at any time, or use the opt-out links in Section 1. Blocking them does not affect your ability to use any part of this website.
13. Data Breach Notification
In the event of a data breach that is likely to result in significant harm to affected individuals, we will:
- Notify the Personal Data Protection Commission (PDPC) within 3 calendar days of completing our assessment of the breach, as required under the PDPA;
- Notify affected individuals as soon as reasonably practicable if the breach is likely to cause them significant harm.
For mental health and clinical data, we apply the PDPC's lower notification threshold — a breach affecting even a small number of individuals will be assessed for notification obligations if it could cause discrimination, distress, reputational damage, or financial harm.
14. Changes to This Policy
We may update this Privacy Policy from time to time. When we make significant changes, we will notify you by updating the "Last updated" date at the top of this page and, where appropriate, by sending a notice to clients whose data we hold. We encourage you to review this page periodically.
15. Contact Us and Complaints
For any questions about this Privacy Policy, to make a data access or correction request, or to withdraw your consent, please contact our DPO:
Fion Yu, Data Protection Officer, Ambrave Counselling & Therapy
Email: info@ambravesg.com
Address: 200 Jln Sultan, #03-01D Textile Centre, Singapore 199018
Phone: +65 8336 1662
If your concern is not resolved to your satisfaction, you may lodge a complaint with the Personal Data Protection Commission (PDPC):