Privacy policy

MÍMIR WELLBEING · Last updated 10 November 2026

Who I am

This website belongs to MÍMIR WELLBEING. I'm responsible for the personal information you give me through it, which makes me the "data controller" under UK data protection law (the UK GDPR and the Data Protection Act 2018). If you have any questions about your information, email andrew.spain1@outlook.com.

What I collect

• When you book: your first name, email address and phone number, the time and type of session, and any note you add.
• The questions form before your first session: what you'd like help with, some background, and a few health questions so I can make sure holistic therapy is right for you. This includes health information, which the law treats as especially sensitive.
• If you send an enquiry: what you write and your contact details.
• If you leave feedback after a session: your answers, which I see without your name attached. If you choose to leave a public review, the first name or initials you choose to show.
• If you buy something from my shop: your name, email address and what you bought. Payment is handled by PayPal; I never see your card details.
• If you join an online session: the time you pressed the Join button, as a record that the session took place.

Why I use it, and the legal basis

• To arrange and provide your sessions, and to send your confirmation, reminders and questions form. The legal basis is that it's needed to provide the service you asked for (a contract).
• Your health information is used only to keep your sessions safe and suitable. I ask for your explicit consent to this on the questions form, and you can withdraw it at any time.
• To keep proper records of my work, as my professional body and insurer expect. The legal basis is my legitimate interests and legal obligations.
• To publish a review, only if you choose to leave one. The legal basis is your consent.

I don't sell your information, and I don't use it for marketing unless you've asked me to.

Who else handles it

I use a few trusted services to run my practice. They can only use your information to provide their service to me:

• My website, booking system and records are provided by Practitioner (practitioner.org.uk), which hosts them in the UK.
• Emails are sent through my website's email service.
• If you pay online, PayPal processes the payment.
• Online sessions take place on the video service I use (such as Zoom or Google Meet), which has its own privacy policy.
• If I use the writing tool on my platform to prepare a session script, it is processed within the UK and EU and includes only your first name and session details, never your contact details.

I would only share your information with anyone else if the law requires it, or if I believed someone was at serious risk of harm.

How long I keep it

I keep booking records and session notes for 7 years after your last session, which is common practice for therapy records, and then delete them. Records for clients who were under 18 may be kept longer. Copies of emails I've sent you are deleted after 6 months, and if you send me a message through my website but don't go on to book, it is deleted after 12 months.

Keeping it safe

Your questions form answers are stored encrypted, the website uses a secure (https) connection, and my account is password protected. Access to your information is limited to me, and to the platform's technical support only where needed to keep things running.

Your rights

You have the right to see the information I hold about you, to have it corrected, to have it deleted, to object to how it's used, and to take it elsewhere. To ask, just email andrew.spain1@outlook.com. I'll reply within one month. There's no charge.

If you're unhappy with how I've handled your information, please tell me first so I can put it right. You can also complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).

Cookies

This website only uses the small cookies it needs to work, such as keeping your place while you book. It doesn't use advertising or tracking cookies, so there's nothing to accept or decline. Fonts on this site are loaded from Google Fonts, which means Google receives your device's internet address when a page loads.

Changes

I may update this policy from time to time. The date at the top shows when it last changed.

Read the terms · What to expect in a session