How we work, and what you can expect
Privacy Notice for Therapy Clients
Beauty for Ashes Therapies | Beauty for Ashes Wellbeing Group Ltd
Effective 22 October 2026 • Review by 22 October 2027 • Version 1.0
1. About this notice
This notice explains how Beauty for Ashes Wellbeing Group Ltd collects, uses, stores and protects personal information when you contact or receive services from Beauty for Ashes Therapies. It covers enquiries, consultations, assessments, online CBT and face-to-face CBT appointments in Willenhall, WV13.
We handle information with care and use it only for clear purposes connected with providing safe therapy, running the service, meeting our legal and professional responsibilities, and responding to you.
2. Who is responsible for your information
Beauty for Ashes Wellbeing Group Ltd is the data controller. This means we decide why and how your personal information is used. Beauty for Ashes Therapies is a service of the company.
For privacy questions or to exercise your rights, contact us at hello@beautyforasheswellbeing.co.uk, call +44 7309 041155, or write to Beauty for Ashes Wellbeing Group Ltd, 1-3 Market Place, Willenhall, WV13 2AA.
3. Information we collect
Depending on your contact with us, we may collect:
- Identity and contact details, such as your name, date of birth, address, email address and telephone number.
- Appointment and service information, including booking history, attendance, cancellations, payment status and communications with us.
- Health and clinical information that you choose or need to share, including your reasons for seeking support, symptoms, relevant medical history, medication, risk information, goals, assessments, outcome measures and therapy records. Health information is special category personal data.
- Emergency contact details and information about your GP or other health professionals where relevant.
- Payment and invoice information. Card payments are handled by the payment provider; we do not intentionally place full card details in clinical notes.
- Technical and account information needed to operate the client portal, forms, appointments and online sessions.
You can choose what to tell us, but if you do not provide information needed to assess suitability, manage safety or deliver therapy, we may be unable to provide some or all of the service.
4. How we obtain information
We usually collect information directly from you when you enquire, book, complete a form, attend a consultation or therapy session, or contact us. We may also receive relevant information from a person who refers you, your GP or another health professional when you ask us to obtain it or authorise them to share it. Payment providers may confirm whether a payment has been made.
5. Why we use information and our lawful bases
We identify a lawful basis for each purpose. For health information, we also need an additional UK GDPR condition because it is special category data.
| Purpose | Lawful basis |
|---|---|
| Respond to enquiries, arrange appointments, assess suitability and provide agreed therapy. | UK GDPR Article 6(1)(b): steps requested before a contract and performance of our contract with you. |
| Use relevant health information to assess, plan and deliver therapy, maintain clinical records and support professional care. | UK GDPR Article 6(1)(b) where applicable, together with Article 9(2)(h) and the Data Protection Act 2018, Schedule 1, Part 1, paragraph 2, for health care provided by a professional subject to duties of confidentiality. |
| Manage invoices, accounts, tax records and other legal or regulatory duties. | UK GDPR Article 6(1)(c): compliance with a legal obligation. |
| Protect the service, manage accounts, maintain security, respond to concerns and keep appropriate business records. | UK GDPR Article 6(1)(f): our legitimate interests in operating a safe and effective therapy service, balanced against your rights. |
| Respond to an urgent threat to life or serious harm where you cannot give consent. | UK GDPR Article 6(1)(d) and, where applicable, Article 9(2)(c): protection of vital interests. |
| Send optional news or marketing about our services or resources. | Consent where required. You can withdraw it at any time. We do not make marketing consent a condition of therapy. |
We do not use your clinical information to make decisions about you solely by automated means.
6. Confidentiality and when we may share information
We keep information about your therapy confidential. We may share only relevant information when you ask us to, give permission, or when disclosure is necessary or permitted by law. This may include a serious risk of harm to you or someone else, a safeguarding concern, a court order or another legal duty. Where it is safe and appropriate, we will discuss a necessary disclosure with you first.
Your therapist may discuss clinical work in professional supervision to support safe and effective practice. We will anonymise information wherever reasonably possible and limit what is shared.
We may share information with service providers who help us run the service, such as Zanda for client records, forms, booking and telehealth; Stripe or another payment provider for payments; and Microsoft 365 for business email and administration. These providers act under contractual data-protection obligations. We may also share necessary information with professional advisers, insurers, regulators, law enforcement or emergency services where a lawful basis applies.
If an employer or another organisation funds your therapy, we will not routinely share your therapy notes or session content with them. We may share limited administrative information, such as attendance or service use, where this has been explained and agreed. We share clinical information only with your informed permission or where a lawful exception applies.
7. Where information is stored and how we protect it
We use practice-management, email, payment and telehealth systems to support appointments and records. We apply access controls and appropriate security measures, and we limit access to people who need information for their role. Please protect your portal login details and use a private device and connection for online sessions where possible.
Some providers may use approved subprocessors or process information outside the United Kingdom. Where a restricted international transfer applies, we use an approved transfer mechanism and appropriate safeguards. You can contact us for further information about relevant safeguards.
8. How long we keep information
We keep information only for as long as needed for the purposes described in this notice and in line with our retention schedule. Adult clinical records are generally retained for seven years after the last appointment. We may keep relevant records longer when required for safeguarding, a complaint, a legal claim, insurance, professional obligations or another legal requirement. We securely delete or destroy information when it is no longer needed.
We retain financial and business records for the period required by law. Enquiry information where no service begins is normally deleted within 12 months unless we need it to resolve a concern or meet a legal obligation. We do not keep marketing consent after you withdraw it, except for a minimal record that helps us respect your choice.
9. Your data protection rights
Depending on the circumstances and the lawful basis, you can ask us to:
- provide a copy of your personal information;
- correct information that is inaccurate or incomplete;
- erase information, restrict its use or object to certain processing;
- provide certain information in a portable format; and
- stop using your information for direct marketing at any time.
These rights are not absolute. For example, we may need to keep clinical records to meet legal, professional, safeguarding or claims obligations. If we rely on consent for a particular use, you can withdraw that consent at any time; this does not affect processing already carried out lawfully.
To make a request, email hello@beautyforasheswellbeing.co.uk or write to us at the address in section 2. We may ask for information to verify your identity and will respond within the time required by data-protection law.
10. Complaints
Please contact us first at hello@beautyforasheswellbeing.co.uk if you have a concern about how we use your information. You also have the right to complain to the UK Information Commissioner’s Office (ICO): www.ico.org.uk/make-a-complaint/data-protection-complaints/ or telephone 0303 123 1113.
11. Cookies and website use
This notice covers information used to deliver Beauty for Ashes Therapies. If you visit our public website, separate cookie information may explain how the website uses cookies or similar technologies.
12. Changes to this notice
We may update this notice when our services, systems or legal responsibilities change. We will make the current version available and tell clients about material changes where appropriate.
Beauty for Ashes Wellbeing Group Ltd | Company no. 17451584 | Registered office: 1-3 Market Place, Willenhall, WV13 2AA