Privacy Policy

1. Introduction

Last updated: 17 October 2026

Soul and Remedy Ltd (“we”, “our”, “us”) is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our website and services (“Services”).

We are the data controller for the personal data described in this Policy. Soul and Remedy Ltd is registered in England and Wales with company number 13400434, with its registered office at 2nd Floor College House, 17 King Edwards Road, Ruislip, London, HA4 7AE. We are registered with the Information Commissioner’s Office (ICO) under registration number ZCO11271.

If you have any questions about this Policy or how we handle your data, contact us at hello@soulandremedy.com.

2. What Information We Collect

If you are a client

Account information — name, email address, telephone number, date of birth, postal address.

Application and intake information — your application form, pre-session reflections, questionnaire responses, and anything you choose to tell us about what you are seeking.

Health information — symptoms and health background you submit, diagnostic test results, laboratory reports, Personalised Results Summaries, and wellness plans we prepare for you.

Practitioner summaries — where you have consented, a short written summary from your practitioner used to inform your wellness plan.

Booking and consultation information — the offering you purchased, appointment dates and times, attendance and completion records.

Clinical referral information — where we arrange a private GP review or a specialist consultation for you, the details needed to arrange it, such as the type of appointment, the order reference and the date it was arranged. We do not receive the GP’s or specialist’s consultation notes.

Results delivery records — the password for each password-protected results document we send you, the date it was sent and the method used to send the password, kept so that we can help if you lose access to your results.

Payment information — transaction records and payment status. We never see or store your full card details — these are handled by Stripe.

Communications — emails, text messages, chat messages, and call notes, kept to assist with customer service and to improve our services.

If you are a practitioner

Name, business and company details, qualifications, professional registrations, insurance certificates and evidence of premium payment, location permissions, payment and invoicing details, headshot photograph, biography, and communications with us.

If you are a website visitor

IP address, browser and device information, cookie identifiers, and usage data. See Section 9.

3. How We Use Your Information and Our Legal Basis

We use your personal data for the purposes below. Each purpose is followed by the legal basis we rely on under UK GDPR.

Create and manage your account, so you can access the platform. Legal basis: performance of a contract.

Process orders, take payment, and manage bookings, to deliver what you bought. Legal basis: performance of a contract.

Share the information your practitioner needs to prepare for and deliver your work, to deliver what you bought. Legal basis: performance of a contract; our legitimate interest in delivering the offering purchased.

Process your health information, test results, and wellness plans, to provide diagnostics and results interpretation. Legal basis: explicit consent (UK GDPR Article 9(2)(a)).

Arrange a private GP review or specialist consultation , where it is part of your offering or you ask us to, so you can discuss your results with a qualified clinician. Legal basis: performance of a contract; explicit consent (Article 9(2)(a)) for any health information shared to arrange it.

Deliver your results to you securely, including sending your results document by email and its password separately, either by text message or in a separate email. Legal basis: performance of a contract; explicit consent (Article 9(2)(a)).

Keep a secure record of the passwords for your results documents, so we can help you if you lose access. Legal basis: legitimate interests — helping you access your own results safely.

Ask your practitioner for a short summary to inform your wellness plan, so the plan is useful and joined-up. Legal basis: explicit consent (Article 9(2)(a)) — we ask you first and you can decline.

Provide customer support and handle complaints, to resolve issues. Legal basis: performance of a contract; legitimate interests.

Send you service messages such as booking confirmations, results notifications and results document passwords, by email or text message, to keep you informed about your purchase. Legal basis: performance of a contract.

Send you marketing and updates, to tell you about our work. Legal basis: consent — you can opt out at any time.

Vet, verify, and pay practitioners, to operate our platform safely. Legal basis: performance of a contract; legal obligation.

Meet accounting, tax, and regulatory obligations, because we have to. Legal basis: legal obligation.

Improve our services and website, to make things better. Legal basis: legitimate interests.

Explicit consent for health data. We process health data only with your explicit consent. You can withdraw that consent at any time by emailing hello@soulandremedy.com. Withdrawing consent does not affect processing carried out before you withdrew it, and may mean we can no longer deliver parts of your service.

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects. Where we use software tools to help prepare your Personalised Results Summary, a member of our team reviews it before it is sent to you.

4. Sharing Your Information

We do not sell your data. We share it only as set out below.

With practitioners

Practitioners who deliver services through Soul + Remedy are independent professionals and independent controllers of their own records. They are not our processors, and we are not joint controllers with them. Each of us is responsible for the data we hold. GPs and clinical specialists we arrange for you are covered separately below.

What we send to your practitioner:

• Your name

• Your contact details (email address and, where you provided it, telephone number)

• Your application form and any pre-session reflection you submitted through us

• The offering you purchased and its scheduled dates

• Scheduling information through our booking system

What we do not send to your practitioner:

• Your diagnostic test results

• Your laboratory reports

• Any other health record we hold about you

Those come to you, not to them. If you decide to share your results with a practitioner directly, that is entirely your choice. Once you do, that material forms part of their records, held by them as controller under their own privacy notice and retention policy, and we are not responsible for it.

What your practitioner holds themselves. Your practitioner keeps their own practice records — session notes, integration records, and photographs taken as part of your Presencing Experience. These are their records, kept under their own systems, security measures, and retention periods. We do not have access to them. If you want to know how a practitioner handles your data, ask them for their privacy notice, or ask us and we will put you in touch.

What your practitioner sends back to us. Where you have consented, your practitioner may provide us with a short written summary about your work together, so that we can prepare a wellness plan that is useful to you. It contains no more than is necessary for that purpose. It does not include their session notes or their wider practice records. They also confirm to us that you attended and completed your offering. If you would prefer no summary to be shared, tell us and none will be requested.

Photographs. Photographs taken at the place associated with your Presencing Experience belong to your practitioner and are shared privately with you. No photograph in which you are identifiable will be used publicly by us or by your practitioner without your separate, explicit written consent. You are never obliged to give it.

With our laboratory and clinic partner

We share the information necessary for our laboratory partner, Sussex Pathology Limited (trading as One Day Tests), to schedule your appointment, take your sample, and return your results to us.

Your results come back to us, and we send them on to you by a secure method. At present, we email you a password-protected document and send you the password separately, either by text message or in a separate email. We never send a document and its password in the same message. We may move to a secure online portal, in which case that provider would act as our processor and would be bound by the terms described under With service providers below. We hold your results and your wellness plan under the security measures described in Section 6 and the retention periods in Section 8.

Private GP reviews

Where a private GP review is part of your offering, we place an order for the appointment on your behalf through our laboratory partner once your results are available. To do this, we share the details needed to arrange it, such as your name, contact details and order reference.

Our laboratory partner then sends you a link directly to arrange your appointment. Through that link, you choose a suitable date, upload your results and any supporting files, and answer the GP’s questions. What you upload is your choice.

All communication takes place directly between you and the GP. The GP’s notes are sent to you only. They are not shared with us and are not uploaded to our laboratory partner’s portal. The GP service acts as an independent controller of its consultation records, under its own privacy notice.

Specialist consultations

At your request, we can arrange a consultation with a fertility and/or menopause specialist. We will only do this with your agreement, and we will tell you beforehand exactly what we will share. That will normally be your name, contact details and any results or information you agree to share.

The specialist is an independent professional and an independent controller of their own consultation records, held under their own privacy notice.

With service providers

We use third parties to help us run the business — website hosting, booking and scheduling, email delivery, text messaging (for service messages such as results document passwords), payment processing (Stripe), and customer support tools. They act on our instructions as processors and may only use your data for the purposes we set.

Where required by law

We may share your information if required by law or in response to legal process, such as a court order, or to establish, exercise, or defend legal claims.

Business transfer

If our business is sold or reorganised, your data may transfer to the acquiring entity. We will notify you and this Policy will continue to apply until you are told otherwise.

5. International Transfers

Some of our service providers process data outside the UK. Where they do, we ensure appropriate safeguards are in place — an adequacy decision, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. You can request details of the safeguards used by emailing hello@soulandremedy.com.

6. Data Security

We implement appropriate technical and organisational measures to protect your personal data from unauthorised access, loss, alteration, or misuse. These include access controls and role-based restrictions, encryption in transit and at rest, restricted access to health data, secure third-party payment processing, and regular review of the measures we use.

Protecting your results. Results documents we send you are password protected with a unique password for each document. We send the password separately from the document, by text message or in a separate email, and never in the same message. Our record of document passwords is kept in an encrypted file with restricted access. If you lose access to your results, we will normally issue a new protected copy with a new password rather than re-sending an old one.

Practitioners are contractually required to have equivalent measures in place for the records they hold, appropriate to the sensitivity of the data.

We and our practitioners are each required to notify the other, without undue delay and within 24 hours of becoming aware, of any personal data breach affecting data shared between us. Where a breach is likely to result in a high risk to your rights and freedoms, we will notify you and the ICO as required by law.

No system is entirely secure, and we cannot guarantee absolute security.

7. Your Rights

Under UK GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you

• Rectification — have inaccurate or incomplete data corrected

• Erasure — request deletion of your data, in certain circumstances

• Restriction — ask us to limit how we use your data

• Portability — receive your data in a structured, machine-readable format, or have it sent to another controller

• Object — object to processing based on legitimate interests, and object to direct marketing at any time

• Withdraw consent — where we rely on consent, withdraw it at any time

• Complain — lodge a complaint with the Information Commissioner’s Office

To exercise any of these rights, email hello@soulandremedy.com. We will respond within one month. There is no charge, unless a request is manifestly unfounded or excessive.

Requests that involve your practitioner, GP or specialist. Because your practitioner, and any GP or specialist we arrange for you, hold their own records as independent controllers, a request to us covers only the data we hold. If your request also concerns their records — session notes or consultation notes, for example — we will tell you, refer the relevant part to them, and help them respond. You can also go to them directly.

Complaining to the ICO. Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Helpline: 0303 123 1113. ico.org.uk. We would appreciate the chance to resolve your concern first.

8. Retention

We keep personal data only as long as we need it:

• Account and contact data — duration of your account, then 2 years.

• Health data, test results, and wellness plans — 8 years from your last service, in line with health record retention practice, unless you ask us to delete sooner.

• Results document passwords — up to 90 days after the document is sent, then deleted. We keep a record that your results were sent, with the date and method, alongside your health records.

• Clinical referral records — records that we arranged a GP review or specialist consultation for you: 6 years.

• Booking and attendance records — 6 years.

• Payment and transaction records — 6 years after the end of the financial year (HMRC).

• Practitioner records and insurance evidence — duration of engagement, then 6 years.

• Marketing consent records — until you withdraw consent, then 2 years as proof of withdrawal.

• Website and cookie data — up to 26 months.

Your practitioner, and any GP or specialist we arrange for you, apply their own retention periods to their own records. Those periods are set by them, and may be governed by their professional body.

9. Cookies

We use cookies and similar technologies to operate the website, remember your preferences, and understand how the site is used. Non-essential cookies are used only with your consent, which you can give or withdraw through our cookie banner at any time. See our Cookie Policy for detail.

10. Third-Party Links

Our website may contain links to third-party websites, including practitioners’ own websites. We are not responsible for the privacy practices or content of these external sites, and we encourage you to read their privacy notices.

11. Children

Our services are for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe we have, contact us and we will delete it.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated date. Where changes are material, we will notify you directly.

13. Contact Us

If you have any questions or concerns about this Privacy Policy, or wish to exercise your rights, please contact us at:

Email: hello@soulandremedy.com

Post: Soul and Remedy Ltd, 2nd Floor College House, 17 King Edwards Road, Ruislip, London, HA4 7AE