PRIVACY POLICY

Privacy Notice

Last updated: 7 August 2026

This notice explains what personal information Strength and Soul collects, why we collect it, what we do with it, and what rights you have. We’ve written it in plain language rather than legal boilerplate, because it’s no use to you otherwise.

Who we are

Strength and Soul is a partnership between Joann Buchan and Kevin Buchan, based at The Steading, Elsrickle, South Lanarkshire, ML12 6QZ. We are the data controller for the information described here.

For anything to do with your personal information, email info@strengthandsoul.co.uk. Kevin Buchan is responsible for data protection.

What we collect

If you visit our website: your IP address, browser and device information, and how you move around the site. We collect this through cookies — see the cookies section below.

If you enquire or book: your name, email address, phone number, and postal address where relevant.

If you become a client: health information. Depending on the service, this may include the location, quality and intensity of pain, injuries, diagnoses, medications, allergies, previous treatment, occupation, lifestyle, digestion, sleep, stress levels and your goals. We keep notes of each session.

If you buy from us: a record of what you bought and when. Card details are entered directly with Stripe or PayPal — we never see, record or store them.

If you join our mailing list: your email address and first name, and a record of which topics you’ve told us you’re interested in.

If you’re photographed or recorded: only ever with your separate written agreement, which you can withdraw at any time.

Health information — the important part

Health information is treated as a special category under UK data protection law and given a higher level of protection. Most of what we hold about clients falls into this category — not just named conditions, but anything that says something about your state of health, including the fact that you attended for treatment at all.

We collect and use it on the basis of your explicit consent, which you give when you complete an intake form. You can withdraw that consent at any time.

There’s one thing we should be straightforward about. If you withdraw consent, or stop being a client, we’ll stop using your treatment record — but we’ll continue to hold it for seven years. We have to. It’s a condition of our professional liability insurance, and it’s the record that would protect both of us if a question about your treatment ever arose later. UK data protection law specifically permits keeping records for the establishment or defence of legal claims. During that time the record sits unused: we don’t market to you from it, analyse it, or share it.

Why we use your information

• Taking your booking and delivering your treatment — performing our contract with you
• Assessing you safely and planning your care — your explicit consent
• Taking payment — performing our contract with you
• Sending appointment confirmations, reminders and changes — performing our contract with you
• Sending newsletters and marketing — your consent
• Keeping tax and accounting records — legal obligation
• Keeping treatment records after you stop attending — defence of legal claims, and continuity if you return
• Understanding how our services are working overall — our legitimate interests

Who we share it with

We don’t sell your information and we don’t share it for anyone else’s marketing.

Only Joann and Kevin have access to client records. We have no employees and no administrative help.

We use the following services to run the business, and your information passes through them:

• Google Workspace — forms, records and correspondence
• Acuity Scheduling — bookings and appointment history
• Kit — email newsletters
• WordPress and MemberPress — membership accounts
• Stripe and PayPal — payments
• Xero — accounting
• Zoom — online sessions
• Make.com — moving information between the above

Each acts under a data processing agreement and may only use your information to provide their service to us. Some are based in, or transfer data to, the United States, under the safeguards recognised by UK law for international transfers.

We’d only share your information more widely if we were legally required to, or if there were a serious and immediate risk to someone’s safety.

How long we keep it

• Treatment records (adults) — 7 years from your last appointment
• Treatment records (under-18s) — until your 25th birthday
• Booking history — 7 years from your last appointment
• Payment and accounting records — 6 years plus the current tax year
• Mailing list — while you’re subscribed; we review inactive subscribers every two years
• Enquiries that don’t lead to a booking — 12 months
• Photographs and recordings — until you withdraw consent, or the end of the period above

After that, records are securely deleted or shredded.

If you unsubscribe from our emails, we keep a record of your email address on a suppression list so that we don’t accidentally email you again. That’s the only thing we keep for that purpose. If you’re also a client, unsubscribing doesn’t affect your treatment record, which is held for the period above.

Cookies

Our website uses cookies. Essential cookies make the site work. Others help us understand how the site is used and support our marketing. Non-essential cookies are only set if you agree through the banner when you first visit, and you can change your mind at any time through your browser settings.

Marketing

We only send marketing emails to people who’ve asked for them. Every email has an unsubscribe link, and unsubscribing is immediate and permanent.

If you’re a client, we’ll still contact you about your appointments — those aren’t marketing, and they’ll continue while you’re booked in with us.

Your rights

You can ask us to:

• give you a copy of everything we hold about you
• correct anything that’s wrong
• delete your information
• stop using your information while a query is sorted out
• send your information to you or someone else in a portable format
• stop processing where we’ve relied on legitimate interests
• withdraw consent you’ve given

Email info@strengthandsoul.co.uk. We’ll respond within one month, and there’s no charge. We may ask you to confirm your identity first.

The one limit is the treatment record retention explained above. Everything else we delete on request.

Complaints

If you’re unhappy with how we’ve handled your information, please tell us — info@strengthandsoul.co.uk, or write to us at The Steading, Elsrickle, South Lanarkshire, [postcode]. We’ll acknowledge your complaint within 30 days and respond fully within three months, usually much sooner.

You also have the right to complain to the Information Commissioner’s Office at any point, whether or not you’ve come to us first:

Information Commissioner’s Office Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF Helpline: 0303 123 1113 ico.org.uk/make-a-complaint

[Once you’re registered, add here: “We are registered with the Information Commissioner’s Office, registration number XXXXXXX.”]

Changes

We review this notice every year and whenever we change how we work. The date at the top tells you when it was last updated.