Privacy Policy

1. Introduction
 

Welcome to Aligned Health. I respect your privacy and am committed to protecting your personal data. This privacy policy explains how I collect, use, store, and safeguard your information when you visit my website, make an inquiry, or engage in my health coaching and EFT practice.

​

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, I Caitlin Thorpe am the Data Controller responsible for your personal data.

​

​

2. The Data I Collect About You
 

Depending on how you interact with my services, I may collect, store, and process the following categories of personal data:

​

• Identity & Contact Data: Your full name, email address, phone number, and location.

• Special Category Data (Health & Emotional Well-Being Data): Notes, intake form responses, and information disclosed during health coaching and EFT sessions regarding your physical health, emotional patterns, lifestyle habits, and history of relevant life events.

• Financial & Transaction Data: Payment details, billing address, and transaction history processed securely through third-party payment processors.

• Technical & Usage Data: Information about how you use my website, including IP address, browser type, and page interactions (via standard cookies).

​

​

3. How I Collect Your Data
 

I collect data through:

​

• Direct Interactions: When you fill out an intake form, book a discovery call, sign up for a newsletter, or communicate with me via email/messaging.

• Client Sessions: Notes and reflections gathered during online or in-person coaching and EFT sessions.

• Automated Technologies: Basic analytical data collected via website cookies when you navigate my site.

​

4. Legal Basis & Purpose for Processing Your Data

 

I will only process your personal data when the law allows me to:

​

• Performance of Contract: To deliver 1:1 coaching, manage bookings, and fulfill service agreements.

• Explicit Consent (Special Category Data): Because EFT and coaching involve processing sensitive health data, I rely on your explicit consent provided via your client intake agreement/consent form before we begin working together. You may withdraw this consent at any time.

• Legitimate Interests: To reply to general inquiries, manage business admin, and ensure service quality.

• Legal Obligation: To comply with UK tax and accounting laws (e.g., maintaining financial records).

​

​

5. How Your Data Is Stored and Kept Secure
 

I implement strict technical and organizational safeguards to ensure your confidential information remains secure:

​

• Session Notes & Intakes: Electronic records, intake forms, and session reflections are stored in password-protected, encrypted systems (e.g., HIPAA/GDPR-compliant client management tools or encrypted cloud storage).

• Payment Security: All financial transactions are handled via secure third-party payment gateways (e.g., Stripe/PayPal). I never store raw payment card details.

• Data Retention: I retain client session records for 7 years following the conclusion of our work together, in alignment with standard UK professional insurance and accounting requirements. Afterward, data is securely destroyed.

​

6. Sharing Your Data

 

Your personal disclosures during sessions are held in strict confidence. I do not sell or rent your data to third parties. Data is only shared under the following limited circumstances:

​

• Third-Party Service Providers: Trusted tools required to operate my business (e.g., secure calendar booking tools, email hosts, accounting software), all of which comply with UK GDPR standards.

• Legal Obligations or Safeguarding: If required by law, or if there is a serious, immediate risk of harm to yourself or others, confidentiality may be broken in accordance with professional ethical boundaries.

​

​

7. Your Legal Rights Under UK GDPR

 

As a resident of the UK, you have rights regarding your personal data:

​

• Right of Access: You can request a copy of the personal data held about you (a Subject Access Request).

• Right to Rectification: You can ask to correct inaccurate or incomplete data.

• Right to Erasure ("Right to be Forgotten"): You can request the deletion of your personal data, subject to legal/insurance retention duties.

• Right to Withdraw Consent: Where processing relies on consent (such as health/somatic disclosures), you can withdraw consent at any time.

​

To exercise any of these rights, please contact me at cait@alignedhealth.co.uk

​

​

8. Complaints
 

If you have concerns about how your data is handled, please contact me first so I can resolve it. You also have the right to lodge a complaint with the UK data protection regulator:

​

Information Commissioner’s Office (ICO)

Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Website: www.ico.org.uk

​

​

9. Changes to This Policy
 

This Privacy Policy may be updated periodically to reflect changes in practice or legal requirements. Updated versions will be published on my website with a revised effective date.