1. Introduction

Soul and Remedy Ltd (“we”, “our”, “us”) is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our website and services (“Services”).

We are the data controller for the personal data described in this Policy. Soul and Remedy Ltd is registered in England and Wales with company number 13400434, with its registered office at 2nd Floor College House, 17 King Edwards Road, Ruislip, London, HA4 7AE. We are registered with the Information Commissioner’s Office (ICO) under registration number ZCO11271.

If you have any questions about this Policy or how we handle your data, contact us at hello@soulandremedy.com.

2. What Information We Collect

If you are a client

• Account information — name, email address, telephone number, date of birth, postal address.

• Application and intake information — your application form, pre-session reflections, questionnaire responses, and anything you choose to tell us about what you are seeking.

• Health information — symptoms and health background you submit, diagnostic test results, laboratory reports, Personalised Results Summaries, and wellness plans we prepare for you.

• Practitioner summaries — where you have consented, a short written summary from your practitioner used to inform your wellness plan.

• Booking and consultation information — the offering you purchased, appointment dates and times, attendance and completion records.

• Payment information — transaction records and payment status. We never see or store your full card details — these are handled by Stripe.

• Communications — emails, chat messages, and call notes, kept to assist with customer service and to improve our services.

If you are a practitioner

Name, business and company details, qualifications, professional registrations, insurance certificates and evidence of premium payment, location permissions, payment and invoicing details, headshot photograph, biography, and communications with us.

If you are a website visitor

IP address, browser and device information, cookie identifiers, and usage data. See Section 9.

3. How We Use Your Information and Our Legal Basis

We use your personal data for the purposes below. Each purpose is followed by the legal basis we rely on under UK GDPR.

• Create and manage your account, so you can access the platform. Legal basis: performance of a contract.

• Process orders, take payment, and manage bookings, to deliver what you bought. Legal basis: performance of a contract.

• Share the information your practitioner needs to prepare for and deliver your work, to deliver what you bought. Legal basis: performance of a contract; our legitimate interest in delivering the offering purchased.

• Process your health information, test results, and wellness plans, to provide diagnostics and results interpretation. Legal basis: explicit consent (UK GDPR Article 9(2)(a)).

• Ask your practitioner for a short summary to inform your wellness plan, so the plan is useful and joined-up. Legal basis: explicit consent (Article 9(2)(a)) — we ask you first and you can decline.

• Provide customer support and handle complaints, to resolve issues. Legal basis: performance of a contract; legitimate interests.

• Send you service messages such as booking confirmations and results notifications, to keep you informed about your purchase. Legal basis: performance of a contract.

• Send you marketing and updates, to tell you about our work. Legal basis: consent — you can opt out at any time.

• Vet, verify, and pay practitioners, to operate our platform safely. Legal basis: performance of a contract; legal obligation.

• Meet accounting, tax, and regulatory obligations, because we have to. Legal basis: legal obligation.

• Improve our services and website, to make things better. Legal basis: legitimate interests.

Explicit consent for health data. We process health data only with your explicit consent. You can withdraw that consent at any time by emailing hello@soulandremedy.com. Withdrawing consent does not affect processing carried out before you withdrew it, and may mean we can no longer deliver parts of your service.

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.

4. Sharing Your Information

We do not sell your data. We share it only as set out below.

With practitioners

Practitioners who deliver services through Soul + Remedy are independent professionals and independent controllers of their own records. They are not our processors, and we are not joint controllers with them. Each of us is responsible for the data we hold.

What we send to your practitioner:

• Your name

• Your contact details (email address and, where you provided it, telephone number)

• Your application form and any pre-session reflection you submitted through us

• The offering you purchased and its scheduled dates

• Scheduling information through our booking system

What we do not send to your practitioner:

• Your diagnostic test results

• Your laboratory reports

• Any other health record we hold about you

Those come to you, not to them. If you decide to share your results with a practitioner directly, that is entirely your choice. Once you do, that material forms part of their records, held by them as controller under their own privacy notice and retention policy, and we are not responsible for it.

What your practitioner holds themselves. Your practitioner keeps their own practice records — session notes, integration records, and photographs taken as part of your Presencing Experience. These are their records, kept under their own systems, security measures, and retention periods. We do not have access to them. If you want to know how a practitioner handles your data, ask them for their privacy notice, or ask us and we will put you in touch.

What your practitioner sends back to us. Where you have consented, your practitioner may provide us with a short written summary about your work together, so that we can prepare a wellness plan that is useful to you. It contains no more than is necessary for that purpose. It does not include their session notes or their wider practice records. They also confirm to us that you attended and completed your offering. If you would prefer no summary to be shared, tell us and none will be requested.

Photographs. Photographs taken at the place associated with your Presencing Experience belong to your practitioner and are shared privately with you. No photograph in which you are identifiable will be used publicly by us or by your practitioner without your separate, explicit written consent. You are never obliged to give it.

With our laboratory and clinic partner

We share the information necessary for One Day Tests to schedule your appointment, take your sample, and return your results to us.

Your results come back to us, and we send them on to you by a secure method. At present that is a password-protected document with the password provided by a separate channel; we may move to a secure online portal, in which case that provider would act as our processor and would be bound by the terms described under With service providers below. We hold your results and your wellness plan under the security measures described in Section 6 and the retention periods in Section 8.

With service providers

We use third parties to help us run the business — website hosting, booking and scheduling, email delivery, payment processing (Stripe), and customer support tools. They act on our instructions as processors and may only use your data for the purposes we set.

Where required by law

We may share your information if required by law or in response to legal process, such as a court order, or to establish, exercise, or defend legal claims.

Business transfer

If our business is sold or reorganised, your data may transfer to the acquiring entity. We will notify you and this Policy will continue to apply until you are told otherwise.

5. International Transfers

Some of our service providers process data outside the UK. Where they do, we ensure appropriate safeguards are in place — an adequacy decision, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. You can request details of the safeguards used by emailing hello@soulandremedy.com.

6. Data Security

We implement appropriate technical and organisational measures to protect your personal data from unauthorised access, loss, alteration, or misuse. These include access controls and role-based restrictions, encryption in transit and at rest, restricted access to health data, secure third-party payment processing, and regular review of the measures we use.

Practitioners are contractually required to have equivalent measures in place for the records they hold, appropriate to the sensitivity of the data.

We and our practitioners are each required to notify the other, without undue delay and within 24 hours of becoming aware, of any personal data breach affecting data shared between us. Where a breach is likely to result in a high risk to your rights and freedoms, we will notify you and the ICO as required by law.

No system is entirely secure, and we cannot guarantee absolute security.

7. Your Rights

Under UK GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you

• Rectification — have inaccurate or incomplete data corrected

• Erasure — request deletion of your data, in certain circumstances

• Restriction — ask us to limit how we use your data

• Portability — receive your data in a structured, machine-readable format, or have it sent to another controller

• Object — object to processing based on legitimate interests, and object to direct marketing at any time

• Withdraw consent — where we rely on consent, withdraw it at any time

• Complain — lodge a complaint with the Information Commissioner’s Office

To exercise any of these rights, email hello@soulandremedy.com. We will respond within one month. There is no charge, unless a request is manifestly unfounded or excessive.

Requests that involve your practitioner. Because your practitioner holds their own records as an independent controller, a request to us covers only the data we hold. If your request also concerns their records — session notes, for example — we will tell you, refer the relevant part to them, and help them respond. You can also go to them directly.

Complaining to the ICO. Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Helpline: 0303 123 1113. ico.org.uk. We would appreciate the chance to resolve your concern first.

8. Retention

We keep personal data only as long as we need it:

• Account and contact data — duration of your account, then 2 years.

• Health data, test results, and wellness plans — 8 years from your last service, in line with health record retention practice, unless you ask us to delete sooner.

• Booking and attendance records — 6 years.

• Payment and transaction records — 6 years after the end of the financial year (HMRC).

• Practitioner records and insurance evidence — duration of engagement, then 6 years.

• Marketing consent records — until you withdraw consent, then 2 years as proof of withdrawal.

• Website and cookie data — up to 26 months.

Your practitioner applies their own retention periods to their own practice records. Those periods are set by them, and may be governed by their professional body.

9. Cookies

We use cookies and similar technologies to operate the website, remember your preferences, and understand how the site is used. Non-essential cookies are used only with your consent, which you can give or withdraw through our cookie banner at any time. See our Cookie Policy for detail.

10. Third-Party Links

Our website may contain links to third-party websites, including practitioners’ own websites. We are not responsible for the privacy practices or content of these external sites, and we encourage you to read their privacy notices.

11. Children

Our services are for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe we have, contact us and we will delete it.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated date. Where changes are material, we will notify you directly.

13. Contact Us

If you have any questions or concerns about this Privacy Policy, or wish to exercise your rights, please contact us at:

Email: hello@soulandremedy.com

Post: Soul and Remedy Ltd, 2nd Floor College House, 17 King Edwards Road, Ruislip, London, HA4 7AE