Alba Holistic Therapies Privacy Policy

Effective date: 28 September 2026
Last reviewed: 28 September 2026

1.1. Who we are

Alba Holistic Therapies is the trading name of Jacqueline Cartwright, a sole trader based in Scotland. For the purposes of UK data protection law, Alba Holistic Therapies is the data controller responsible for the personal information described in this policy.

This policy applies when you visit our website, contact us, book or receive a service, attend a course or event, or otherwise deal with Alba Holistic Therapies.

Contact: hello@albaholistic.com
Website: https://albaholistic.com
Instagram: @albaholistictherapies

You can use the contact details above for any privacy question or to exercise your data protection rights. A postal correspondence address can be provided on request.

2.2. The information we may collect

Depending on how you interact with us, we may collect:

your name and contact details, such as your telephone number, email address and correspondence address;

appointment, course, event and service details;

messages, enquiries, feedback, complaints and correspondence;

payment, invoice and transaction information. If an external payment provider processes a card payment, we do not receive or store your complete card details;

consultation and treatment information needed to assess whether a service is suitable and to deliver it safely, such as relevant health conditions, symptoms, medication, allergies, pregnancy, mobility or accessibility needs, and treatment notes;

emergency-contact information where appropriate;

marketing preferences and records of consent;

photographs, videos or testimonials, but only where you have separately agreed to their use;

for Reiki teaching or other training, attendance, assessment and certification information;

for corporate, care-home, community or event work, the contact details and role of the person arranging the service; and

technical information generated when you use the website, such as your IP address, device and browser information, security logs, pages viewed and cookie choices.

Information about health is special category personal data and receives additional protection under data protection law.

Please provide only information that is relevant. If you give us personal information about somebody else, such as an emergency contact, you should tell them that you have done so and direct them to this policy where appropriate.

3.3. How we collect information

We usually collect personal information directly from you when you:

use our website or contact form;

complete a booking, consent or consultation form;

make a payment;

attend an appointment, course or event; or

provide feedback, a testimonial or an image.

We may also receive limited information from a parent or guardian, a person making a booking on your behalf, your employer or an organisation arranging a wellbeing service. Where appropriate, we will tell you that we have received the information and how it will be used.

4.4. Why we use your information and our lawful bases

We use personal information only where we have a lawful basis under UK data protection law.

To answer enquiries, provide information or quotations, and take steps towards a booking

Information used: Identity, contact and enquiry information

Lawful basis: Steps taken at your request before entering into a contract

To arrange and provide appointments, courses, events or other services

Information used: Identity, contact, booking, service and payment information

Lawful basis: Performance of a contract with you

To assess suitability and adapt a treatment or service safely

Information used: Consultation, health and treatment information

Lawful basis: Performance of a contract; for health information, your explicit consent under Article 9(2)(a) UK GDPR

To issue invoices, maintain accounts and comply with tax or other legal duties

Information used: Identity, contact, payment and transaction information

Lawful basis: Legal obligation

To run and protect the business, keep appropriate records, prevent fraud, and establish, exercise or defend legal claims

Information used: Relevant client, transaction, correspondence, technical and service records

Lawful basis: Legitimate interests in operating and protecting the business; legal obligation where applicable; and, for special category data used in a legal claim, Article 9(2)(f) UK GDPR

To send optional news, offers or wellbeing updates

Information used: Name, contact details and marketing preferences

Lawful basis: Consent. You may withdraw it at any time

To publish a testimonial, photograph or video

Information used: The content and any identifying details agreed with you

Lawful basis: Consent. The proposed use will be explained when consent is requested

To operate and secure the website

Information used: IP address, device, browser, security and essential-cookie information

Lawful basis: Legitimate interests in providing and securing the website; legal obligation where applicable

To use optional analytics, advertising or similar technologies

Information used: Cookie identifiers and website-usage information

Lawful basis: Consent obtained through the cookie controls

To respond to a genuine emergency where you cannot give consent

Information used: Relevant contact and health information

Lawful basis: Vital interests under Article 6(1)(d) and, where health information is involved, Article 9(2)(c) UK GDPR

Where we rely on legitimate interests, we consider whether the use is necessary and balanced against your rights and reasonable expectations.

You are not generally required by law to give us personal information. However, we need certain identity, contact, booking and payment information to enter into and perform a contract. We may also need relevant consultation and health information to decide whether a treatment is suitable and to provide it safely. If you do not provide required information, or withdraw explicit consent to the use of necessary health information, we may be unable to provide or continue the service.

5.5. Health information and explicit consent

We collect only health information that is relevant to the requested service. Before using this information, we will ask you to expressly confirm that you consent to its use for assessing suitability, adapting the service and delivering it safely.

Consent to use health information is separate from consent to receive a treatment or participate in a course. You may withdraw your data-protection consent at any time by contacting us. Withdrawal does not make earlier use unlawful, but it may mean that we cannot safely provide the service. We may still retain information where another lawful reason requires or permits us to do so, for example to comply with tax law or deal with a legal claim.

6.6. Marketing

We will send marketing by email or text only where the law permits it and, where required, you have actively opted in. Marketing consent is optional and is not a condition of receiving a service.

You can unsubscribe at any time by using an unsubscribe option in the message or contacting us. We may keep a minimal suppression record so that we can respect your request not to receive further marketing.

Service messages about an appointment, payment, course or important change are not marketing.

7.7. Cookies and similar technologies

Our website may use cookies or similar technologies.

Strictly necessary technologies help the website function, remain secure and remember privacy choices. These may be used without consent where a legal exception applies.

Optional technologies, such as analytics, advertising, embedded-media or social-media technologies, will not be used until you choose to accept them where consent is required.

The website's cookie controls should identify the technologies in use, their providers, purposes and durations. You can use those controls to accept, reject or change optional choices as easily as you accepted them. You can also control cookies through your browser, although blocking necessary technologies may affect how the website works.

8.8. Who we share information with

We do not sell or rent personal information.

Where necessary, we may share limited information with:

providers supporting website hosting, forms, bookings, email, secure storage, communications, payments, accounting or other business administration;

professional advisers, insurers, accountants and legal representatives;

an organisation arranging or paying for a workplace, care-home, community or event service. We will not normally share individual consultation or treatment details with that organisation without your permission;

emergency services or an emergency contact where genuinely necessary to protect somebody's vital interests; and

regulators, courts, law-enforcement bodies or other authorities where disclosure is required or permitted by law.

Service providers may use personal information only for agreed purposes and must protect it appropriately where data-protection contracts are required.

9.9. International transfers

Some technology providers may store or process information outside the United Kingdom. Where personal information is transferred internationally, we will use providers and safeguards permitted by UK data protection law, such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to approved contractual clauses, together with any additional protections that are required.

You may contact us for more information about safeguards relevant to your information.

10.10. How long we keep information

We keep personal information only for as long as it is reasonably needed for the relevant purpose, including legal, tax, insurance and dispute-resolution requirements. Our standard periods are:

Enquiries that do not lead to a booking: Up to 12 months after the last meaningful contact

Client consultation, consent and treatment records: Seven years after the last appointment, unless a longer period is reasonably required by law, an insurer, safeguarding needs or an active complaint or claim

Appointment and service correspondence forming part of the client record: Normally the same period as the related client record

Financial and tax records: At least five years after the 31 January Self Assessment submission deadline for the relevant tax year, or longer where HMRC or another legal requirement applies

Course, attendance and certification records: Seven years after completion, unless a longer period is needed to verify a qualification or resolve a dispute

Marketing details: Until you unsubscribe or consent is withdrawn; a minimal suppression record may then be retained

Testimonials, photographs and videos: Until consent is withdrawn or the material is no longer used, subject to reasonable steps for material already lawfully printed or published

Website security logs: Normally no more than 12 months, unless needed to investigate an incident or legal claim

We periodically review retained information and securely delete or anonymise it when it is no longer needed. Different periods may apply to records concerning a child; these will be explained to the parent, guardian or young person before the information is collected.

11.11. How we protect information

We use proportionate technical and organisational safeguards designed to protect personal information against loss, misuse, unauthorised access, alteration or disclosure. These may include access controls, strong passwords, device security, secure storage, backups, confidentiality procedures and collecting only the information reasonably required.

No online system is completely secure. If a personal-data breach creates a risk to individuals, we will assess it and notify the Information Commissioner's Office and affected people where the law requires.

12.12. Your data-protection rights

Depending on the circumstances and lawful basis, you may have the right to:

ask for a copy of your personal information;

ask us to correct inaccurate or incomplete information;

ask us to delete information;

ask us to restrict how information is used;

object to processing based on legitimate interests;

object at any time to the use of your information for direct marketing;

receive certain information in a portable format or ask for it to be sent to another organisation; and

withdraw consent at any time where we rely on consent.

These rights are not absolute and legal exceptions may apply. To make a request, contact us using the details in section 1. We may need to confirm your identity. We normally respond within one month and do not charge a fee, although the law permits a reasonable fee or refusal in limited circumstances.

You have an absolute right to object to direct marketing.

13.13. Automated decisions

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

14.14. Links to other websites and platforms

Our website or social-media pages may link to services operated by other organisations. Those organisations control their own use of personal information, and you should read their privacy information. We are not responsible for external sites or platforms.

15.15. Complaints

Please contact us first if you have a privacy concern so that we have an opportunity to resolve it.

You also have the right to complain to the UK Information Commissioner's Office (ICO):

Website: https://ico.org.uk/make-a-complaint/

Telephone: 0303 123 1113

16.16. Changes to this policy

We may update this policy when our services, suppliers or legal obligations change. The latest version will be posted on the website with its effective and review dates. If a change materially affects how we use information already collected, we will take reasonable steps to bring it to your attention and obtain fresh consent where required.