Privacy Policy

1. Who we are

A Calm Place (“we”, “us”, “our”) is the trading name of Rebecca Tonkinson, a sole trader based near Welshpool, Powys, offering CBT therapy, mindfulness courses and yoga classes. For the purposes of data protection law, Rebecca Tonkinson is the data controller for personal information collected through this website.

We are registered with the Information Commissioner's Office (ICO) as a data controller. Registration reference: ZB596303. You can view the public entry at ico.org.uk. The registration was made on 14 September 2023 and currently expires on 13 September 2026.

2. What we collect

Enquiry form data. When you use the contact form, we collect your name, email address, optional phone number, the topic of your enquiry, and the content of your message.

Session and clinical information. If you go on to book therapy, mindfulness or yoga sessions, further information — such as session notes, health-related information you choose to share, and attendance records — is collected separately as part of that professional relationship, under the ethical frameworks of the BABCP and BAMBA. This is special category data under Article 9 UK GDPR and is processed on the basis of your explicit consent, given at the start of that working relationship, and is handled with a higher standard of confidentiality than general website enquiries.

Technical data. Standard data collected automatically when you visit the site (such as pages viewed and device/browser type) only where you have consented to non-essential cookies — see our Cookie Policy.

3. Why we collect it and our lawful basis

• To respond to your enquiry — lawful basis: legitimate interests in running the practice and responding to prospective clients, or steps taken at your request prior to entering a contract.
• To provide therapy, mindfulness or yoga sessions — lawful basis: performance of a contract for the general information you provide, and explicit consent for any special category (health-related) information shared during sessions.
• To meet legal and accounting obligations — lawful basis: compliance with a legal obligation (for example, retaining financial records for HMRC purposes).
• With your consent, for non-essential cookies — see our Cookie Policy.

4. Who we share it with

• Clinical supervisor. As required by professional ethical frameworks, anonymised or de-identified information about casework may be discussed in regular clinical supervision, to support safe and effective practice.
• Service providers. Third parties that support running this website and the enquiry form — such as hosting and email delivery providers — under arrangements that limit their use of your data strictly to providing that service.
• Legal or safeguarding requirements.Where required by law, or where there is a serious and immediate risk to your safety or someone else's — this is one of the standard, narrow exceptions to confidentiality explained at the start of any therapeutic relationship.

We do not sell personal information, and we do not use it for advertising profiling.

5. International transfers

Some service providers we rely on for hosting and email delivery may process data outside the UK. Where this happens, we rely on appropriate safeguards recognised under UK GDPR, such as standard contractual clauses or an adequacy decision covering that country.

6. Data retention

Enquiry form messages that don't lead to a booking are typically kept for a limited period sufficient to respond to and resolve them, then deleted. Clinical and session records are kept for the period recommended by professional guidance (typically several years after the end of the working relationship), after which they are securely destroyed.

7. Your rights

Under UK GDPR, you have the right to:

• access the personal information we hold about you;
• ask us to correct inaccurate or incomplete information;
• ask us to erase your information, in certain circumstances;
• restrict or object to certain processing;
• request a portable copy of information you provided to us.

To exercise any of these rights, contact us via the Contact page or support@acalmplace.com. If you're not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

8. Children's privacy

This website is intended for adults enquiring about adult services and is not directed at children. Enquiries relating to a child or young person should be made by a parent or guardian.

9. Security

We use reasonable technical and organisational measures to protect the information we hold, including secure storage of clinical records separate from general website enquiries. No online service can guarantee absolute security; if a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify affected individuals and the ICO in line with our legal obligations.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by an updated effective date at the top of this page.

11. Contact us

Questions about this policy or your data: Contact page or support@acalmplace.com.