Privacy and Cookies Policy

[Last updated: August 2026]

Privacy POLICY

Catherine Paterson is committed to protecting your privacy and handling personal information lawfully, fairly, transparently and securely in accordance with applicable UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This policy explains what information may be collected, why it is used, how it is protected, when it may be shared, how long it may be retained and the rights available to you.

01. Who We Are

For the purposes of data protection law, Catherine Paterson is the Data Controller for personal information collected through this website and in connection with her practice, except where another organisation is independently responsible for its own processing.

Contact: [Insert business email address]

Business/contact address: [Insert appropriate business or correspondence address]

02. Who This Policy Covers

This Privacy & Cookies Policy applies if you:

  • Visit this website.

  • Contact Catherine with an enquiry.

  • Subscribe to newsletters or marketing communications.

  • Download digital resources.

  • Purchase self-guided digital products, recordings or online educational resources.

  • Book or attend one-to-one therapeutic services.

  • Participate in live workshops, breathwork sessions, retreats, courses or online events.

  • Complete a registration, intake, health or wellbeing form.

03. What Information We Collect

Website Visitors, Enquiries, Newsletter Subscribers & Digital Purchases

Depending on how you interact with the website or practice, we may collect:

  • Your name and contact details, including email address and telephone number where provided.

  • Information you voluntarily provide through contact, registration or enquiry forms.

  • Messages, correspondence and records of communications.

  • Transaction and purchase information. Full payment-card details are processed by the relevant payment provider and are not ordinarily received or stored by Catherine.

  • Newsletter and marketing preferences.

  • Technical information such as IP address, browser type, device information and similar technical data.

  • Website usage information and information generated by cookies or similar technologies, where applicable.

Therapy Clients, Workshop Participants & Event Attendees

If you book one-to-one work or participate in a workshop, retreat, breathwork session or other facilitated event, additional information may be collected where reasonably necessary to assess suitability, deliver the service safely and maintain appropriate professional records. This may include:

  • Contact and booking details.

  • Health and wellbeing information that you choose or are asked to provide.

  • Completed intake, registration, consultation or health declarations.

  • Appointment or attendance history.

  • Relevant session or practice notes.

  • Emergency contact information where appropriate.

  • Information relevant to safeguarding, safety or suitability where necessary.

Health and wellbeing information may constitute special category personal data under UK data protection law and receives additional protection. Where special category information is processed, an appropriate lawful basis and the additional legal condition required for that processing will be identified and applied.

We aim to collect only information that is reasonably necessary for the purpose for which it is required.

04. How We Collect Information

We may collect personal information when you:

  • Visit or interact with the website.

  • Complete a contact, booking, intake, registration or health form.

  • Subscribe to a newsletter or request a resource.

  • Purchase a digital product, recording, class or event place.

  • Book or participate in a therapeutic session, workshop, retreat or event.

  • Contact Catherine by email, telephone or another agreed communication method.

  • Provide information directly during the course of therapeutic or facilitated work.

  • Use the website where cookies or similar storage and access technologies are operating.

05. Why We Use Information & Lawful Bases

Personal information is used only where there is a lawful basis for doing so. Depending on the circumstances, this may include:

Contract

Where processing is necessary to take steps at your request before entering into a contract, or to provide a service, event, digital product or other resource you have requested or purchased.

Consent

Where you have freely given specific consent, for example for certain marketing communications or non-essential cookies and similar technologies where consent is required. You may withdraw consent at any time, although this will not affect processing that was lawful before withdrawal.

Legitimate Interests

Where there is a legitimate business or professional reason to process information and those interests are not overridden by your rights and interests. This may include appropriate administration, maintaining and securing the website, responding to enquiries and managing the practice.

Legal Obligation

Where processing is necessary to comply with a legal requirement, including appropriate tax, accounting, safeguarding, data protection or other legal obligations.

Where special category information such as health data is processed, an additional condition under UK data protection law is also required. The condition relied upon will depend on the purpose and circumstances of the processing.

06. Email Communications & Marketing

If you subscribe to newsletters or other marketing communications, your information may be processed through our email communication provider.

You can unsubscribe from marketing emails at any time using the unsubscribe link included in the message or by contacting Catherine.

Purchasing a product, booking a service or completing an enquiry does not automatically mean that you have consented to all future marketing. Electronic marketing will be sent only where there is an appropriate legal basis under applicable data protection and electronic communications law.

07. Confidentiality

Information shared within one-to-one therapeutic work is treated confidentially and handled with care.

There are limited circumstances in which information may need to be disclosed, including where disclosure is required by law, where there is a serious concern about your safety or the safety of another person, or where Catherine has a professional safeguarding responsibility to act.

Where reasonably possible and appropriate, Catherine will discuss this with you before information is shared.

Further information about therapeutic confidentiality is set out in the Therapeutic Services Agreement. Group participants should also refer to the Community Participation Agreement for expectations concerning the privacy of information shared within group experiences.

08. Third-Party Service Providers

Trusted third-party service providers may process personal information on our behalf or as independent controllers where necessary to operate the website, communicate with you, take payments, manage bookings or deliver services.

Providers currently used or which may be used in connection with the practice include:

  • Squarespace - website hosting, forms, website functionality and related website services.

  • Acuity Scheduling - appointment booking, scheduling and related communications where used.

  • Zoom - online sessions, workshops and events where used.

  • Mailchimp - newsletters and subscriber communications.

  • PayPal and/or Stripe - secure online payment processing where selected or offered.

Each provider handles personal information in accordance with its own legal obligations and contractual arrangements. We do not sell your personal information.

09. International Transfers

Some technology and service providers operate internationally and may process information outside the United Kingdom.

Where personal information is transferred internationally, we take reasonable steps to ensure that an appropriate lawful transfer mechanism or safeguard is in place where required by UK data protection law.

10. Data Retention

Personal information is retained only for as long as reasonably necessary for the purpose for which it was collected, taking account of relevant legal, contractual, professional, safeguarding, insurance, tax and accounting requirements.

Indicative retention periods may include:

  • Newsletter subscriptions - until you unsubscribe or the information is otherwise removed in accordance with our mailing-list practices.

  • General enquiries - normally for a limited period after the enquiry has been dealt with, unless a longer period is reasonably required.

  • Therapeutic records - for the period reasonably required by applicable professional, insurance, safeguarding and legal considerations.

  • Workshop and event records - for as long as required for appropriate operational, safety, accounting, insurance or legal purposes.

  • Financial and transaction records - for the period required by applicable tax, accounting and legal obligations.

A separate internal retention schedule may be used to set more specific periods for different categories of information.

11. Your Data Protection Rights

Depending on the circumstances and the legal basis for processing, you may have rights including the right to:

  • Request access to personal information held about you.

  • Request correction of inaccurate or incomplete information.

  • Request erasure of information in certain circumstances.

  • Request restriction of processing in certain circumstances.

  • Object to certain processing.

  • Request transfer of information where the right to data portability applies.

  • Withdraw consent at any time where consent is the lawful basis for processing.

These rights are subject to legal conditions and exemptions and do not apply in every circumstance.

12. Data Protection Concerns & Complaints

If you have a concern or complaint about how your personal information has been handled, please contact Catherine at [Insert business email address].

Data protection complaints will be handled in accordance with applicable UK law. We will provide a clear way to raise a complaint, acknowledge it within 30 days, take appropriate steps to investigate it without undue delay, keep you appropriately informed where necessary and communicate the outcome.

You also have the right to raise a concern or complaint with the Information Commissioner’s Office (ICO). We encourage you to contact Catherine first where you feel comfortable doing so, as this may allow the matter to be resolved directly.

13. Security

We take reasonable technical and organisational measures to protect personal information against accidental loss, unauthorised access, alteration, disclosure or misuse.

Access to personal information is limited to those who reasonably need it for the purposes described in this policy. However, no internet transmission or electronic storage system can be guaranteed to be completely secure.

COOKIES & SIMILAR TECHNOLOGIES

14. What Are Cookies & Similar Technologies?

Cookies are small files or pieces of information stored on or accessed from your device when you use a website. Similar technologies may include pixels, scripts, local storage, tags and other technologies that store information on, or access information from, a device.

These technologies may be used to make the website function, remember preferences, maintain security, understand website performance or usage, and provide other functionality.

15. Cookies & Technologies We Use

Essential Technologies

Some cookies or similar technologies are necessary for the website or a service you request to function. Where the applicable legal exemption applies, these may be used without consent.

Functional, Analytics & Other Optional Technologies

The website may use functional, analytics or other optional technologies where appropriate. Where consent is legally required, these technologies will not be used until you have made the relevant choice.

Where optional cookies or similar technologies are used, the website should provide clear information about their purpose and an appropriate mechanism for accepting, rejecting or managing them.

The specific technologies in use may change as the website develops.

16. Managing Cookies & Your Preferences

When you first visit the website, you may be presented with a cookie banner or settings tool that allows you to manage technologies that require your consent.

Where consent is required, your choice should be freely given, specific and informed. You should also be able to change or withdraw that choice through the available cookie settings or other appropriate mechanism.

You can also control many cookies through your browser settings. Disabling some essential technologies may affect website functionality.

17. Changes to This Policy

We may update this Privacy & Cookies Policy from time to time to reflect changes in the law, technology, service providers, website functionality or the way the practice operates.

The current version will be published on the website together with the revision date.

© 2026 Catherine Paterson. All rights reserved.