DATA PROTECTION AND PRIVACY POLICY
Suzan J Wells trading as ElementalHeart Healing & Yoga
Updated: July 2026
Professional insurance: Balens
ICO Registration Number: ZA373475
THE PURPOSE OF THIS POLICY
This Privacy Policy explains what personal information I collect, why I collect it, how it is used, how it is stored, how long it is kept, and your rights in relation to your personal information.
I am the Data Controller for the purposes of the UK General Data Protection Regulation, UK GDPR, and the Data Protection Act 2018.
This policy applies to my work through ElementalHeart Healing & Yoga, including yoga classes, yoga therapy, therapeutic movement, sound healing, voice work, energy healing, one-to-one sessions, online sessions, events, retreats, sharing circles and transformational workshops.
I only collect information that is relevant to providing my services safely, appropriately and professionally.
PERSONAL DATA I COLLECT
Personal data means information that can identify you as an individual.
I may collect some or all of the following information:
Your name, email address, phone number and contact details.
Information you provide when enquiring about, booking or attending classes, sessions, events, retreats, sharing circles or workshops.
Information provided on health forms, client questionnaires, booking forms, intake forms or consent forms.
Relevant health and wellbeing information, which may include information about pain, fatigue, mobility, medical conditions, medication, stress, trauma history, emotional wellbeing, access needs, pregnancy or other personal circumstances.
Brief notes relating to one-to-one sessions, where relevant.
Appointment, attendance and payment records.
Emails, text messages or other communications relating to enquiries, bookings, appointments, sessions, classes or events.
Marketing preferences, including whether you have chosen to join my mailing list.
Feedback, testimonials, photographs or recordings, but only where these are given voluntarily and with appropriate consent.
WHY I COLLECT YOUR PERSONAL DATA
I collect and use your personal data so that I can:
Respond to enquiries.
Arrange bookings, appointments, classes, sessions, events and workshops.
Provide yoga, yoga therapy, movement, sound, voice and healing therapies safely and appropriately.
Understand any relevant health, mobility, wellbeing or access needs.
Adapt sessions, classes or practices where needed.
Keep accurate records for professional, insurance, safeguarding and legal reasons.
Manage payments and basic administration.
Send newsletters or updates where you have chosen to receive them.
Respond to complaints, requests or concerns about your personal data.
Keep in touch about services, classes, events, offers or changes, where there is a lawful basis to do so.
LAWFUL BASIS FOR PROCESSING
Under UK GDPR, I need a lawful basis for using your personal data.
Depending on the situation, I may rely on:
Contract: where I need to use your information to provide a class, session, event, workshop or other service you have booked or asked to book.
Legitimate interests: where I need to use your information for reasonable administration, responding to enquiries, keeping records, managing my practice, or communicating with existing clients about relevant services.
Consent: where you have chosen to join my mailing list, given a testimonial, agreed to the use of an image, or given permission for a particular use of your information.
Legal obligation: where I am required to keep or share information for legal, tax, safeguarding, insurance or regulatory reasons.
Vital interests: where it is necessary to protect someone’s life or safety in an emergency.
SPECIAL CATEGORY DATA
Some of the information you give me may be special category data under UK GDPR. This may include information about your physical health, mental health, medical conditions, medication, disability, trauma history, pregnancy, emotional wellbeing or other sensitive personal circumstances.
I collect this information only where it is relevant to providing safe and appropriate support through yoga, yoga therapy, movement, sound, voice, healing therapies, one-to-one sessions, classes, events, workshops or sharing circles.
The lawful basis for processing this information is usually that it is necessary in order to provide the service you have requested, and that you have given explicit consent by completing a health form, client questionnaire, intake form or other relevant form.
In some circumstances, special category data may also be processed where necessary for legal claims, insurance purposes, safeguarding concerns, or to protect someone’s vital interests.
If you choose not to provide relevant health or wellbeing information, I may not be able to offer the most appropriate support, and in some circumstances I may not be able to provide the service safely.
CONFIDENTIALITY
I treat personal information with care and confidentiality.
Information shared in one-to-one sessions is treated as confidential, except where disclosure is required by law, safeguarding, insurance, legal obligation, court order, serious risk of harm, or to prevent serious crime.
Where possible, I will discuss any necessary disclosure with you beforehand.
For group classes, sharing circles, workshops, retreats and events, I ask all participants to respect the confidentiality of others. However, because group settings involve other people, I cannot guarantee how other participants may handle what they hear. You are encouraged to share only what feels appropriate for you.
SHARING YOUR INFORMATION
I do not sell your personal data.
I do not share your personal data for unrelated marketing.
However, in order to run my practice, your information may be processed by trusted third-party providers. These may include:
Email and website providers.
Mailchimp or another mailing list provider, if you subscribe to my mailing list.
Online meeting platforms such as Zoom, where sessions or classes are held online.
Payment providers, banks, accountants or bookkeepers.
Booking or administration systems, if used.
Professional advisers.
My professional insurer, Balens, if information is needed for insurance, complaint, legal or claim-related reasons.
Legal, safeguarding or regulatory bodies where disclosure is required.
I only share or allow processing of information where there is a proper reason to do so, and I take reasonable steps to use providers that have appropriate data protection arrangements in place.
Some service providers, such as mailing list or online platform providers, may process data outside the UK. Where this happens, I use providers that state they have appropriate safeguards in place.
EMAIL, TEXT AND ELECTRONIC COMMUNICATION
Email, text messages and online communication are convenient, but they cannot be guaranteed to be completely secure.
I usually ask that email and text are used for practical communication, such as enquiries, booking, changing appointments or sharing necessary information.
If confidential or sensitive information needs to be shared electronically, we can discuss the most appropriate way to do this.
By choosing to communicate by email, text or online message, you acknowledge the small inherent security risks of these methods.
ONLINE SESSIONS, CLASSES AND RECORDINGS
I do not audio-record or video-record one-to-one sessions, sharing circles or transformational workshops without the prior knowledge and explicit consent of everyone involved.
Participants must not record any class, session, sharing circle, event or workshop without prior permission.
If an online class, event or workshop is ever recorded, I will make this clear beforehand and explain how the recording will be used, stored, shared and deleted. You will be given information about your choices before any recording takes place.
PHOTOGRAPHS, TESTIMONIALS AND PUBLICITY
I will only use photographs, testimonials, feedback or personal stories for publicity, website, social media, newsletter or marketing purposes where you have given consent.
You may withdraw consent for future use at any time. Please be aware that it may not always be possible to remove material that has already been printed, published, shared or archived, but I will take reasonable steps where possible.
MAILING LIST AND MARKETING
If you choose to join my mailing list, I may send you newsletters, updates, articles, class information, event details or information about services that may be of interest.
My mailing list is managed through Mailchimp or another email marketing provider.
You can unsubscribe at any time by clicking the unsubscribe link at the bottom of any marketing email, or by contacting me directly.
If you unsubscribe, a minimal record may be kept to make sure you are not contacted again by mistake.
You will not be added to my mailing list simply because you attend a class, session or event, unless you have chosen to subscribe or there is another lawful basis for contacting you.
STORAGE AND SECURITY
I take reasonable steps to protect your personal information.
Paper records are kept securely.
Electronic records are stored on password-protected devices or secure systems.
Where appropriate, electronic documents may be encrypted or otherwise protected.
I take reasonable steps to protect personal information against unauthorised access, loss, misuse, disclosure, alteration or destruction.
No method of storage or communication is completely risk-free, but I aim to handle your information carefully, respectfully and responsibly.
RETENTION OF RECORDS
As required by my insurers, Balens, client records, health forms, questionnaires and relevant session records may be kept for at least seven years after the final occasion on which I provide a service to you.
This may include records relating to one-to-one sessions, yoga therapy, therapeutic movement, sound healing, voice work, energy healing, classes, events, retreats, workshops or sharing circles.
Payment and financial records are kept as required for accounting, tax, legal and insurance purposes.
Initial enquiries that do not lead to a booking are normally deleted within 12 months, unless there is a clear reason to keep them longer or you have asked to stay in touch.
Mailing list information is kept until you unsubscribe or ask to be removed.
Records are securely deleted, shredded or destroyed when they are no longer required.
YOUR RIGHTS
Under UK GDPR, you have rights in relation to your personal data.
These may include the right to:
Be informed about how your data is used.
Request access to the personal data I hold about you.
Ask for inaccurate information to be corrected.
Ask for your information to be deleted, where this right applies.
Ask for processing to be restricted, where this right applies.
Object to certain processing, where this right applies.
Request data portability, where this right applies.
Withdraw consent, where consent is the lawful basis for processing.
Please be aware that some rights are not absolute. For example, I may need to keep certain information for legal, insurance, safeguarding, complaint or accounting reasons.
SUBJECT ACCESS REQUESTS
You may ask for a copy of the personal data I hold about you.
Requests should be made in writing, and I may ask for proof of identity before releasing information.
I will usually respond within one calendar month, unless an extension is permitted under data protection law.
If a request is complex or involves information about another person, I may need more time or may need to withhold or redact certain information.
COMPLAINTS ABOUT HOW YOUR DATA IS HANDLED
If you have a concern or complaint about how I collect, use, store or handle your personal data, please contact me first:
Suzan J Wells
Email: suzan@suzanjoywells.co.uk
Telephone: 07795 517157
I will acknowledge your complaint within 30 days of receiving it.
I will take appropriate steps to investigate your complaint without undue delay and will keep you informed about the progress and outcome.
If you remain dissatisfied, you have the right to complain to the Information Commissioner’s Office, also known as the ICO.
Information Commissioner’s Office
Telephone: 0303 123 1113
Website: ico.org.uk
DATA BREACHES
If a data breach occurs, I will take appropriate steps to assess and respond to it.
Where required by law, I will report a relevant breach to the ICO and/or to affected individuals.
CHANGES TO THIS POLICY
This policy may be updated from time to time to reflect changes in legislation, professional guidance, insurance requirements or the way I run my practice.
The most current version will be available on request and may also be made available through my website.
Significant changes will be brought to your attention where appropriate.
HOW TO CONTACT ME
If you have any questions about this policy, how your personal data is used, or your rights under UK GDPR, please contact:
Suzan J Wells
ElementalHeart Healing & Yoga
Email: suzan@suzanjoywells.co.uk
Telephone: 07795 517157
Policy reviewed: July 2026
