Privacy Policy

A legal disclaimer

Last updated: 2 June 2025

This Privacy Policy describes how personal data is collected, used, disclosed and safeguarded when you visit https://claireavriltherapy.com/

The data controller is:
Claire Avril (“I”, “me”, “my”)
Address: 135 Marsland Road, Sale M33 3NZ

Email: support@claireavriltherapy.com

By using or accessing the Site, including the members’ area and online booking/payment system, you agree to the terms of this Privacy Policy. If you do not agree, please do not use the Site.

1. Data I Collect

1.1 Personal Identifiers

When you register for or access my members’ area, book a therapy session, make a payment, or otherwise contact me, I may collect:

Name (first and last)
Date of birth (when required for verification or assessment)
Postal address (optional, for printed correspondence)
Email address
Phone number

1.2 Special Category (Health) Data

As a practising therapist, I may gather sensitive health-related information, including:

Presenting issues (e.g. anxiety, depression, trauma)
Medical or mental-health history
Therapy notes (session summaries, treatment goals, progress records)
Any additional personal details you provide in the course of therapy.
This is classified as “special category” data under UK GDPR and is treated with the highest level of confidentiality.

1.3 Account and Membership Data

Username and password (for members’ area access)
Profile preferences (e.g. language, notification settings)

1.4 Booking and Payment Information

Appointment details: Date, time and type of session (individual, couples, expressive art, animal-assisted therapy, etc.)
Payment confirmation data: Amount, date of transaction and payment status. I do not store full card details; payments are processed via Wix Payments or other third-party providers (e.g. Stripe, PayPal).

1.5 Technical and Usage Data

Collected via cookies and similar technologies (see Section 5):

IP address
Browser type and version
Device type and operating system
Pages visited, time spent, links clicked
Referring/exit pages and timestamps

2. How I Use Your Data

I process personal data for the following purposes and lawful bases:

1. Provision of Therapy Services (Contractual necessity, Article 6(1)(b))

Schedule appointments, manage bookings and send reminders.
Process payments.
Create and maintain therapy records (session notes, treatment plans).
Communicate about your therapy, respond to queries and provide support.

2. Members’ Area Management (Contractual necessity, Article 6(1)(b))*

Authenticate you when you log in, maintain your account and allow access to members-only resources (worksheets, blog content, video material).
Personalise your experience (e.g. saving preferences)

3. Administrative and Legal Compliance (Legal obligation, Article 6(1)(c); Legitimate interests, Article 6(1)(f))

Send administrative notices (e.g. policy updates).
Generate anonymised statistics on Site usage and therapy outcomes to improve services.
Comply with professional record-keeping requirements (e.g. BACP guidelines)
Respond to lawful requests from public authorities (e.g. court orders).

4. Marketing and Communications (Consent, Article 6(1)(a))

If you opt in, I will send newsletters, promotional offers or updates about services, events and blog posts. You may withdraw consent at any time by clicking “unsubscribe” or by contacting support@claireavriltherapy.com

5. Protection of Rights and Safety (Legitimate interests, Article 6(1)(f))

Detect, prevent and address fraud, security or technical issues.
Protect my rights, property or safety, or that of clients or third parties.

2.1 Processing Special Category Data

For any health-related information, I rely on:
Explicit consent (Article 9(2)(a)): You agree that I may process your health data for therapy.
Provision of healthcare (Article 9(2)(h)): Processing is necessary to provide and manage your therapy.
Professional obligations (Article 9(2)(g)): Complying with BACP or other regulatory guidelines for record-keeping and safeguarding.

3. Disclosure of Your Information

I will not sell or rent your personal data. Disclosures may occur only as described below:

3.1 Service Providers

I use trusted third-party providers to operate and maintain the Site, process payments, send emails, and store records. They may only process your data in accordance with this Privacy Policy:
Wix.com, Inc. – Hosts the Site, provides technical infrastructure, backups and security. See Wix’s Privacy Policy https://www.wix.com/about/privacy
Wix Payments, Stripe, PayPal – Process online payments securely. I receive confirmation of payment status (success/failure), transaction date and amount, but not full card details. Consult their respective privacy policies:
Wix Payments Privacy https://support.wix.com/en/article/wix-payments-privacy
Stripe Privacy https://stripe.com/gb/privacy
PayPal Privacy https://www.paypal.com/uk/webapps/mpp/ua/privacy-full
Email/Newsletter Platform (e.g. Mailchimp) – If you subscribe to newsletters, your email and preferences are stored there. See the provider’s privacy policy.
Cloud Storage (e.g. Google Workspace, Dropbox) – Encrypted storage for session notes, intake forms and administrative documents.

3.2 Legal Requirements and Protection of Rights

I may disclose your information if required by law, if necessary to respond to legal processes, or to protect my rights or safety, or that of clients or third parties (e.g. in cases of suspected abuse, court orders, or law-enforcement requests).

3.3 Anonymised or Aggregated Data

I may share de-identified, aggregated statistics (where no individual can be identified) for research, service development, or professional publications.

4. Cookies and Tracking Technologies

My Site uses cookies, web beacons and similar technologies to collect technical and usage data. This enables me to provide and improve the Site. Cookies are small text files placed on your device.

4.1 Types of Cookies Used

Strictly Necessary Cookies: Essential for the Site to function (e.g. session cookies to keep you logged into the members’ area or maintain your booking state). These cannot be disabled unless you block all cookies, which may impair Site functionality.
Performance & Analytics Cookies: Collect anonymous data on how visitors use the Site (e.g. pages viewed, time spent). I use Wix Analytics (or Google Analytics) to monitor traffic trends and improve usability. You may opt out of Google Analytics cookies via https://tools.google.com/dlpage/gaoptout
Functionality Cookies: Remember your choices (e.g. language, region) to enhance your experience.
Targeting/Advertising Cookies: Currently, I do not run targeted ads or remarketing pixels. If I ever do, I will obtain your explicit consent and clearly disclose the specific cookies used.

4.2 Managing Cookies

You can manage cookies through your browser settings (e.g. block third-party cookies, delete cookies on exit, or refuse all cookies). For guidance, visit https://www.aboutcookies.org.uk/. Disabling cookies may prevent some Site features from working properly.

5. Data Security

I take appropriate technical and organisational measures to protect your personal data:

Encryption: All data transmitted between your browser and the Site is encrypted via TLS/SSL (HTTPS).
Secure Access: Only authorised personnel and service providers can access your data. Any third party with access is bound by confidentiality obligations.
Encrypted Storage: Personal and health-related data are stored on GDPR-compliant, encrypted cloud servers, with regular backups.
Strong Passwords. Your members’ area password should be strong and unique. Do not reuse passwords across multiple sites.
Regular Security Audits: I and my providers (e.g. Wix) perform periodic vulnerability assessments to keep systems updated against known threats.
No method of transmission over the internet or electronic storage is 100 percent secure. If you suspect any unauthorised use or breach of your data, please contact me immediately at support@claireavriltherapy.com

6. Data Retention

I retain your personal and health data only as long as necessary for the purposes stated in this Privacy Policy:

Active Therapy: I keep your session notes, intake forms and communication records for the duration of your treatment.
Post-Therapy: In line with professional guidelines (e.g. BACP), I retain client records for a minimum of seven (7) years after the end of therapy, unless you request earlier deletion (subject to legal or ethical constraints).
Members’ Area Accounts: Account credentials, preferences and payment confirmations are kept while your account is active. Accounts with no login activity for 24 months will be deactivated; afterwards, profile and non-therapy data may be deleted. Therapy records remain subject to the seven-year retention rule.
Financial Records: Payment receipts, invoices and transaction logs are stored for at least seven (7) years to comply with HMRC requirements.
When data is no longer required, I will securely delete or irreversibly anonymise it.

7. Your Rights Under UK GDPR

Under the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018, you have the following rights regarding your personal data. To exercise any right, please contact me at [privacy@claireavriltherapy.com](mailto:privacy@claireavriltherapy.com).

Right of Access: You may request a copy of the personal data I hold about you.
Right to Rectification: You may ask me to correct any inaccurate or incomplete information.
Right to Erasure (“Right to be Forgotten”): You may request deletion of your personal data where there is no overriding legal obligation to retain it (e.g. for therapy record-keeping).
Right to Restrict Processing: You may ask to limit how I use your data, for example while a dispute is resolved.
Right to Data Portability: You may request a machine-readable copy of the data you provided, to transfer to another provider.
Right to Object: You may object to processing based on legitimate interests (Article 6(1)(f)) or for direct marketing.
Right to Withdraw Consent: Where processing relies on your consent (e.g. marketing emails), you can withdraw it at any time without affecting prior processing.

I will respond to your request within one month. If more time is needed (up to an additional two months), I will notify you with reasons for the delay. If you remain unsatisfied, you may lodge a complaint with the Information Commissioner’s Office (ICO) at https://ico.org.uk/

8. International Data Transfers

I am based in the UK and store/process data primarily within the UK. However, some service providers (e.g. Wix, Stripe, Google Workspace) may transfer or process data in other countries (including within the European Economic Area or the United States). In such cases, I ensure appropriate safeguards are in place:

Adequacy Decisions: Transfers to countries deemed adequate by the UK government (e.g. EU/EEA countries).
Standard Contractual Clauses (SCCs): Where required, I use UK-approved SCCs with data-importing entities.
Vendor Commitments: I only work with third parties that commit to GDPR-equivalent standards.

If you have questions about data transfers, please contact me at privacy@claireavriltherapy.com

9. Third-Party Links and Services

My Site may contain links to third-party websites or embed content (e.g. social-media feeds, maps, videos). Clicking on such links takes you to that party’s site, which is governed by its own privacy policy. I am not responsible for the content or practices of those third-party sites. I encourage you to review their privacy policies before providing any personal data.

10. Changes to This Privacy Policy

I may update this Privacy Policy from time to time to reflect changes in practices, technology or legal requirements. Any revisions will be posted on this page with an updated “Last updated” date. Your continued use of the Site after changes indicates acceptance of the updated policy.

12. Contact and Complaints

If you have questions, concerns or wish to exercise any of your data-subject rights, please contact:
Claire Avril
Email: support@claireavriltherapy.com
Address: 135 Marsland Road, Sale, M33 3NZ
Telephone: 07717 155634 (Mon–Fri, 9 am–5 pm)

If you believe I have breached data-protection law and are dissatisfied with my response, you may lodge a complaint with the Information Commissioner’s Office (ICO) at https://ico.org.uk/make-a-complaint/

Thank you for trusting me with your personal information. I am committed to protecting your privacy and providing a confidential, professional service.