Select Page

Privacy Policy

Effective Date: 21st July 2026

Last Updated: [Date]

At Soul Steps ([https://soulsteps.co.uk](https://soulsteps.co.uk)), we are committed to protecting your personal data and upholding your privacy. This policy outlines how we collect, use, store, and protect your information when you visit our website or book a session with us.

1. Who We Are

Under UK Data Protection Law (UK GDPR), Natalie / Soul Steps operates as the Data Controller for personal information collected through this website and booking platform.

2. Information We Collect

We may collect and process the following data:

  • Contact Information: Name, email address, phone number, and location when you make an enquiry or book a session.
  • Health & Wellbeing Information: Details provided in pre-session intake forms, intake consultations, or booking notes (e.g., medical conditions, physical/emotional goals, or trauma history relevant to energy, breathwork, or sound therapy). Note: This is classified as Special Category Data under UK GDPR and is processed with your explicit consent.
  • Booking & Payment Data: Information processed securely when scheduling via our embedded booking platform (Acuity Scheduling). We do not store raw credit/debit card numbers on our website servers.
  • Technical Data: IP address, browser type, device information, and browsing behaviour collected automatically via cookies and site analytics.

3. How We Use Your Information

We process your data for the following lawful reasons:

  • To Deliver Services (Contract): Scheduling and delivering 1:1 sessions, group sessions, sound baths, and retreats, as well as sending appointment confirmations and reminders.
  • Consent: Collecting sensitive health/wellbeing information to ensure safe practice during holistic, energy, or breathwork sessions.
  • Legitimate Interests: Responding to enquiries, improving website performance, and maintaining business operations.
  • Legal Compliance: Retaining necessary accounting and business records in line with UK tax regulations.

4. Third-Party Services We Use

We share data only with trusted third-party platforms required to operate our service securely:

  • Scheduling & Booking: Acuity Scheduling / Squarespace (for appointment booking and calendar integration).
  • Payment Processors: [Stripe / PayPal] for processing session fees.
  • Email & Hosting: WordPress / site hosting provider and secure email service.

Each third-party service provider operates under its own privacy policy and maintains strict security standards in compliance with UK GDPR.

5. Data Retention & Confidentiality

  • Session Notes & Intake Forms: Kept strictly confidential and stored securely for [e.g., 7 years] following your last appointment, in accordance with professional therapy insurance requirements, after which they are securely destroyed.
  • Enquiry & Marketing Data: Kept until you request deletion or unsubscribe.

6. Your Rights Under UK GDPR

You have the right to:

  • Request access to the personal data we hold about you.
  • Request corrections to inaccurate or incomplete information.
  • Request the erasure of your personal data (where legal or insurance retention obligations do not apply).
  • Withdraw consent for processing sensitive health data or marketing at any time.

To exercise any of these rights, please contact us at natalie@soulsteps.co.uk. If you believe your data has been handled improperly, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) (ico.org.uk).