Privacy Policy

The data controller is Danielle Sands trading as Reach 4 The Stars.

Email: [email protected]
Telephone: 07719 614 701

If you have any questions about how we handle your data, please contact us at the address or email above before raising a concern with the regulator.

We collect data in three ways: information you give us directly, data generated by your use of our services, and data passed to us by third-party payment processors.

Information you provide

• Contact details — name, email address, and telephone number, collected when you make a booking.
• Session preferences — whether you prefer in-person, online, or telephone sessions.
• Voluntary health notes — any information you choose to share in the booking form's “anything you'd like me to know” field. This field is optional. If you share sensitive health information here, we treat it with the highest level of confidentiality.
• Terms acceptance — the date and time at which you accepted our Terms & Conditions, recorded for legal compliance.

Payment data

Payments are processed by Stripe. We never see or store your card number, expiry date, or CVV. Stripe sends us a confirmation of payment and a payment reference. See Stripe's Privacy Policy for full details of how they handle payment data.

Technical data

When you visit our website we may collect your IP address and basic browser information for security and analytics purposes. We use privacy-friendly analytics and do not build advertising profiles.

We retain your data for the minimum period necessary for the purposes described above:

• Therapy and session records — 7 years from your last appointment, in line with standard professional practice for adult clients in the UK.
• Payment records — 6 years from the date of payment, as required by HMRC for tax purposes.
• Marketing communications — We do not send marketing emails without your explicit consent. If you consent and later withdraw it, we will stop within 30 days and delete marketing contact data promptly.

After retention periods expire, data is securely deleted or anonymised.

We only share your data with third parties where necessary to provide the service, and only with providers who meet UK/EU data protection standards:

• Stripe (payment processing) — regulated and PCI-DSS compliant.
• Microsoft (Outlook calendar and email) — used to manage appointment scheduling and send you emails. Microsoft complies with UK GDPR under standard contractual clauses.
• Supabase (database hosting) — your booking and account data is stored in EU-hosted infrastructure. Supabase is SOC 2 compliant.
• Twilio (SMS appointment reminders, where enabled) — used only to send your telephone number a reminder message. Twilio complies with UK GDPR.

We do not sell your data. We do not share it with third parties for their own marketing purposes.

In exceptional circumstances, we may be required to share information where there is a serious risk of harm to you or to another person, or where we are legally obligated to do so (for example, by a court order). In therapy, these circumstances are rare and we will ordinarily discuss them with you first wherever it is safe to do so.

Under UK GDPR you have the following rights:

• Access — you may request a copy of the personal data we hold about you.
• Rectification — you may ask us to correct inaccurate data.
• Erasure — you may ask us to delete your data, subject to any legal obligation to retain it.
• Restriction — you may ask us to limit how we use your data while a dispute is resolved.
• Portability — you may request your data in a structured, machine-readable format.
• Objection — you may object to processing based on legitimate interests.
• Withdrawal of consent — where processing is based on consent (such as voluntary health notes), you may withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please email [email protected] with the subject line “Data Subject Request”. We will respond within one calendar month.

Our website uses essential cookies needed for the booking system to function (for example, to maintain your session as you move through the booking steps). These are always on, because the site cannot work without them.

Anything beyond that is your choice, made in the cookie banner and changeable at any time. Analytics cookies help us understand how the site is used. Marketing cookies allow measurement of campaigns.

Some pages can also show content hosted by other companies. Loading an embed like that sends your IP address and browser details to the company hosting it, and allows them to set their own cookies.

The map on our venue page is a Google Maps embed. We do not load it until you ask us to — either by accepting marketing cookies in the banner, or by choosing to load the map on the page itself. Until then you see the address and an ordinary link instead, and nothing is requested from Google.

Our stories of hope page has space for a video alongside each written story, hosted by YouTube. As with the map, we do not load one until you ask us to. Until then you see a short explanation and a button instead, and nothing is requested from Google.

Asking for a single map or video on the page is not the same as accepting marketing cookies, and we do not treat it as though it were. That choice covers only the embeds you asked for, lasts for your current browsing session, and is forgotten when you close the browser.

If you are unhappy with how we have handled your data, please contact us first so we have the opportunity to put things right.

You also have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner's Office (ICO):

ico.org.uk/make-a-complaint — Helpline: 0303 123 1113

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. We encourage you to review this page periodically. Continued use of our services after a change constitutes acceptance of the updated policy.