Privacy Policy

This Privacy Policy covers both counselling and massage therapy services provided by Calmflower Holistic Talk Therapy.

1. Data Controller

I, Lana Hunneyball, am the Data Controller for Calmflower Holistic Talk Therapy. If you have any questions about this Privacy Policy or how your data is handled, you can contact me at:

Business address: Glenandale 1, 39 Main Street, Ingleton, LA6 3EH.

OR Email: hello@calmflower.co.uk

Please address any complaints with the Commissioner’s Office (ICO). Registration number: ZC099139.

I would appreciate it, however, if we could try to resolve any of your concerns between us first.

2. Lawful Basis for Processing

Under UK GDPR, the lawful basis for processing your personal data is Article 6(1)(b): Contract – processing is necessary for the performance of a contract for therapeutic services.

Where special category data (including health information) is processed, the condition relied upon is Article 9(2)(h):  Provision of health or social care by a professional bound by confidentiality obligations.

This means your information is processed solely for the purpose of providing safe and appropriate therapeutic services. This may, for example, include your GP, with your consent.

3. Information I Collect

If you make an enquiry:

  • Name
  • Contact details
  • Information you choose to share

If you begin therapy:

  • Name, address, email address, phone number
  • Emergency contact details (if provided)
  • Relevant personal and health information
  • Session notes
  • Records of therapeutic approaches or interventions used
  • Email or message correspondence
  • Payment and invoicing records
  • Any audio or video recordings will only be created with both the therapist’s and client’s prior written consent and used solely for a clearly agreed purpose.

Some of this information constitutes special category data under UK GDPR due to its sensitive nature.

Supervision: Any client information shared in supervision sessions will be anonymised so that your identity is not disclosed.

4. How Your Information Is Used

Your personal data is used solely for:

  • Providing counselling and/or massage services
  • Administrative purposes (e.g., scheduling, invoicing)
  • Professional supervision (information shared anonymously)
  • Meeting legal, ethical, and insurance requirements

Your information will never be used for marketing purposes. It will not be used for automated decision-making or profiling.

5. Confidentiality and Sharing of Information

Your information is treated as confidential. It will not be shared with third parties unless:

  • You provide explicit consent
  • There is a legal obligation to disclose
  • There is a serious risk of harm to you or others
  • Safeguarding concerns arise
  • Disclosure is required by court order

Where appropriate and possible, any necessary disclosure would be discussed with you first.

For accounting purposes, my accountant may have access to payment records only.

Third-party service providers (such as email providers, website hosting services, secure cloud storage providers, or accounting software) may process personal data on my behalf. These providers are required to comply with UK data protection law. Emails are stored within secure, access-controlled systems provided by my email service provider.

6. Storage and Security of Data

I take appropriate technical and organisational measures to protect your data:

  • Paper records are stored in a locked cabinet.
  • Electronic records are stored on password-protected devices and a secure cloud storage service with appropriate security measures.
  • Reasonable steps are taken to ensure information security, including secure email and cloud storage.

In the unlikely event of a data breach that poses a risk to your rights and freedoms, I will notify the ICO and affected individuals within 72 hours in accordance with UK GDPR requirements.

7. Retention of Records

Client records are retained for 7 years after the end of therapy, in line with professional insurance requirements.

After this period:

  • Paper records are securely shredded.
  • Electronic records are permanently deleted.

Any session recordings (if made) will be securely deleted once no longer required for your therapeutic process, supervision, or legal obligations.

8. Your Rights Under UK GDPR

You have the right to:

  • Request access to the personal data I hold about you
  • Request correction of inaccurate or incomplete data
  • Request erasure of your data (subject to legal and insurance obligations)
  • Request restriction of processing
  • Request data portability
  • Object to processing of your personal data for optional purposes, for example, updates about workshops or other optional communications

Please note that any processing necessary to provide therapy, manage appointments, or meet legal, ethical, or safeguarding obligations cannot be objected to.

Requests will be responded to within one calendar month.

9. Complaints

If you have concerns about how your data is handled, please contact me in the first instance so we can attempt to resolve the matter. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

Website: [https://www.ico.org.uk](https://www.ico.org.uk)

Helpline: 0303 123 1113

10. Cookies and Website Data

This website may use cookies to improve user experience and monitor website performance (e.g., analytics services). Where non-essential cookies are used, your consent will be requested via a cookie banner. You can also control cookies through your browser settings.

11. Changes to This Policy

This Privacy Policy may be updated periodically to reflect legal or operational changes. The most recent version will always be available on the website.

 

Back To Top