Privacy Policy 

Business name: Heartwood Healing

Data controller: Sharon Chapman

Address: St Albans, Hertfordshire, England, United Kingdom

Telephone: 07711 825504

Email: sharonchapman10@gmail.com

Website: www.heartwoodhealing.co.uk

Last updated: July 2026

1. Introduction

This Privacy Policy explains how Sharon Chapman, trading as Heartwood Healing (“I”, “me”, “my”), collects, uses, stores, and protects your personal information when you visit my website, contact me, book a session or course, or join my mailing list.

I am committed to protecting your privacy and handling your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Please read this policy carefully. If you have any questions, you can contact me at the details above.

2. What Personal Information I Collect

Depending on how you interact with me, I may collect the following types of personal information:

Contact and identity information

• Your name

• Your email address

• Your telephone number

• Your postal address (if provided)

Health and wellbeing information

• Health history and relevant medical information you share with me as part of 

                a consultation or treatment (this is sensitive personal data and is handled 

                with the utmost care)

• Information about your wellbeing, lifestyle, or circumstances that you choose  

                to share during sessions or in correspondence

Booking and course information

• Details of sessions, treatments, or courses you have booked or enquired   

                about

• Payment records (note: I do not store your full card details — payments are 

                processed securely through third-party providers)

Website and communication information

• Your email address if you subscribe to my mailing list

• Messages you send via the contact form on my website

• Information collected automatically when you visit my website (see Section 7  

                on Cookies)

3. How I Collect Your Information

I collect personal information in the following ways:

• When you complete the contact form on my website

• When you email, telephone, or message me directly

• When you book a session, workshop, or course

• When you complete a consultation form before a treatment

• When you subscribe to my mailing list through my website or via Kit (formerly 

                ConvertKit)

• When you attend a session, workshop, or retreat and provide information 

                verbally or in writing

4. Why I Use Your Information and the Legal Basis

Under UK GDPR, I must have a lawful basis for processing your personal data. The table below explains why I use your information and the legal basis I rely on.

To respond to your enquiries and provide the services you have requested

Legal basis: Contractual necessity

To maintain client records and provide ongoing care

Legal basis: Contractual necessity and legitimate interests

To store health consultation information for the purpose of safe and appropriate treatment

Legal basis: Contractual necessity and, for health data, your explicit consent

To send you booking confirmations and appointment reminders

Legal basis: Contractual necessity

To send you my newsletter, Reiki inspiration, workshop invitations, and free resources

Legal basis: Your consent (given when you subscribe)

To comply with professional body requirements (AOR, CNHC, Reiki Council) regarding record-keeping

Legal basis: Legal obligation and legitimate interests

To improve my website and services

Legal basis: Legitimate interests

5. Health Information

Health and wellbeing information is sensitive personal data under UK GDPR. I collect this information only where it is necessary to provide you with safe and appropriate treatment or training.

I will always ask for your explicit consent before collecting health information. You have the right to withdraw this consent at any time, though this may affect my ability to provide certain services.

Health records are stored securely and are never shared with third parties without your explicit consent, except where I am legally required to do so (for example, in a safeguarding situation).

6. Who I Share Your Information With

I do not sell, rent, or trade your personal information. I may share your information only in the following limited circumstances:

Kit (formerly ConvertKit) — I use Kit to manage my mailing list and send newsletters. When you subscribe to my mailing list, your name and email address are stored securely by Kit. Kit’s privacy policy is available at kit.com/privacy.

GoDaddy — My website is hosted by GoDaddy. GoDaddy may process certain technical data as part of website hosting. GoDaddy’s privacy policy is available at godaddy.com/legal/agreements/privacy-policy.

Professional bodies — I am a member of the Association of Reflexologists (AOR), the Complementary and Natural Healthcare Council (CNHC), and hold Verified Practitioner status with the Reiki Council. These bodies may require me to maintain certain records as a condition of membership, but I do not share your personal details with them without your consent.

Legal requirements — I may disclose your information if required to do so by law, or if I believe disclosure is necessary to protect the safety of you or others.

I do not use your personal data for automated decision-making or profiling.

7. Cookies

My website uses cookies — small text files placed on your device when you visit. Cookies help the website function correctly and allow me to understand how visitors use the site.

The types of cookies used on my website include:

• Essential cookies — necessary for the website to function (for example, 

                remembering your cookie preferences)

• Analytics cookies — used to understand how visitors interact with the 

                website (for example, which pages are most visited). This data is anonymous 

                and aggregated.

You can control and manage cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the website.

By continuing to use my website after the cookie notice has appeared, you consent to the use of cookies as described in this policy.

8. How Long I Keep Your Information

I retain your personal information for as long as is necessary for the purpose for which it was collected, and in accordance with my professional obligations.

Client treatment records (including health information)

Retained for 7 years from the date of the last treatment. For records relating to minors, retained until the individual reaches the age of 25.

Course and training records

Retained for 7 years from the date of completion.

Mailing list subscriptions

Retained until you unsubscribe or request removal.

General correspondence and enquiries

Retained for 2 years from the date of last contact.

Website analytics data

Retained as determined by the analytics provider (typically 26 months).

After the relevant retention period, your information will be securely deleted or anonymised.

9. How I Keep Your Information Safe

I take the security of your personal data seriously and use appropriate technical and organisational measures to protect it, including:

• Storing physical records securely and limiting access to them

• Using password-protected devices and accounts

• Using reputable, secure third-party services (Kit, GoDaddy) that comply with 

                data protection law

• Not sharing your information with unauthorised parties

No method of transmission over the internet or electronic storage is 100% secure. While I strive to protect your personal data, I cannot guarantee absolute security.

10. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

The right to access — You can request a copy of the personal data I hold about you.

The right to rectification — You can ask me to correct any inaccurate or incomplete information I hold about you.

The right to erasure — You can ask me to delete your personal data in certain circumstances (for example, if you withdraw consent and there is no other lawful basis for processing).

The right to restrict processing — You can ask me to limit how I use your data in certain circumstances.

The right to data portability — You can ask me to provide your data in a structured, commonly used, machine-readable format.

The right to object — You can object to my processing of your data where I rely on legitimate interests as the legal basis.

The right to withdraw consent — Where I process your data based on your consent (such as for the mailing list), you can withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of processing before the withdrawal.

To exercise any of these rights, please contact me at sharonchapman10@gmail.com or by telephone on 07711 825504. I will respond within one month of receiving your request.

11. Mailing List and Newsletter

When you subscribe to the Heartwood Healing mailing list, you are giving your consent to receive occasional emails including Reiki inspiration, workshop invitations, free resources, and seasonal reflections.

Your subscription is managed through Kit (formerly ConvertKit). Every email I send includes an unsubscribe link. You can unsubscribe at any time and your details will be removed from the mailing list promptly.

I will never send you marketing emails without your consent, and I will never share your email address with third parties for marketing purposes.

12. Third-Party Links

My website may contain links to other websites, including social media platforms (Facebook, Instagram, LinkedIn) and professional body websites. This Privacy Policy applies only to my website. I am not responsible for the privacy practices of any third-party websites, and I encourage you to read their privacy policies.

13. Children’s Privacy

My services are intended for adults. I do not knowingly collect personal data from children under the age of 16 without the explicit consent of a parent or guardian. If you believe I have inadvertently collected information from a child, please contact me immediately.

14. Changes to This Policy

I may update this Privacy Policy from time to time to reflect changes in my practice, the services I offer, or legal requirements. The most current version will always be available on my website. The date at the top of this policy indicates when it was last updated.

15. How to Make a Complaint

If you have a concern about how I have handled your personal data, please contact me in the first instance at sharonchapman10@gmail.com and I will do my best to resolve the matter.

If you remain unhappy, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s data protection supervisory authority:

Information Commissioner’s Office

Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Telephone: 0303 123 1113

Website: ico.org.uk