Privacy Policy
Privacy Policy
Organisation: From the Heart Energy Healing
Practitioner / Designated Safeguarding Lead (DSL): Emma Randell, practising professionally as Emma Hunt
Professional Body: The International Institute of Complementary Therapists (IICT)
Membership Number: GB2597957191
Effective Date: 19 October 2026
Review Date: 18 October 2027
Welcome to From the Heart Energy Healing (referred to in this document as ‘From the Heart’). From the Heart Energy Healing is operated by Emma Randell, practising professionally as Emma Hunt, as a sole trader. In these terms, “From the Heart”, “we”, “us” and “our” refer to Emma Randell trading as From the Heart Energy Healing.
We respect your privacy and we are committed to protecting your personal data, as well as the data of your children and animals. This Privacy Policy explains how we collect, use, store, process, and safeguard your personal information when you book a remote energy healing session, use our services, visit our website, or communicate with us.
1. Important Information and Who We Are
1.1: Data Controller: Emma Randell, practising professionally as Emma Hunt and trading as From the Heart Energy Healing, is the data controller responsible for your personal data.
1.2. Contact Details: If you have any questions about this Privacy Policy, including any requests to exercise your legal rights, please contact Emma using the details below:
• Full Name of Practitioner: Emma Randell, practising professionally as Emma Hunt.
• Business Name: From the Heart Energy Healing
• Email Address: emma@from-the-heart.uk
• Telephone Number: +44 (0) 7470 262434
• Website: www.from-the-heart.uk
2. The Data We Collect About You
2.1 Personal Data: Personal data means information relating to an identified or identifiable living individual. Information about an animal is not personal data in itself, but it may be personal data where it identifies or relates to an identifiable owner, carer or other individual. We collect, use, store and transfer the categories of personal data described below about adult clients, children and young people, parents and guardians, animal owners and carers, and other relevant individuals.
2.2 Identity Data:
• For Adults: First name, surname, age, and date of birth.
• For Children & Young People (Under 18) Minors: Child’s first name, child’s surname, age, and date of birth, where reasonably necessary to identify the child, apply the appropriate consent and safeguarding arrangements, administer the service and manage relevant record retention requirements.
• For Parents/Legal Guardians: Parent/legal guardian first name, parent/legal guardian surname, and legal relationship to the child (Parent or Legal Guardian).
• For Animal Owners/Other Authorised Individuals to Consent to Their Care: Owner/authorised individual’s first name, owner/authorised individual’s surname, and legal relationship to the animal (Owner or Other with legal permission to consent to their care).
• For Animals: Animal’s name, species/breed, age, and date of birth.
2.3 Contact Data:
• For Adults & Parents/Legal Guardians: Billing address, home address (adult and/or child), email addresses, and mobile telephone number.
• For Animal Owners/Carers: Primary email address and mobile telephone number.
2.4 Safety & Emergency Data:
• Adult Emergency Contact: Named emergency contact, their relationship to you, their telephone number, and optional GP practice name and telephone number.
• Child Emergency & Protective Contact: Named emergency contact if parent/legal guardian is unavailable during a session, emergency contact telephone number, child's mandatory GP practice name and telephone number, and the first name of the parent/guardian who will be physically present during the child’s remote session.
2.5 Special Category Data & Case Metrics (Health, Wellbeing, & Intuitive Data):
• Session Preferences: Chosen session type and session format (e.g., live video or remote email session).
• Focus & Scaling Metrics: Up to three primary session focuses, accompanied by a client-submitted daily life impact score scaled from 1 to 10.
• Qualitative Case Profiles: Open-text fields containing client-provided health summaries, supplementary holistic history, intuitive energy observations, session notes, and written post-session summaries.
2.6 Safeguarding, Health Conditions, & Legal Verifications (Children):
• Statutory Authority: Written declarations regarding court orders or legal arrangements affecting who holds statutory authority to consent for the child.
• Health Conditions & Additional Needs: Disclosures regarding the child’s specific health conditions and/or additional needs.
• Other Professionals: Disclosures regarding other multi-agency professionals currently supporting the child.
• Timestamped Records: Timestamped audit records of parental safeguarding checkmarks acknowledging the limits of confidentiality under our Safeguarding Children & Young People Policy.
2.7 Veterinary Compliance Data (Animals):
• Veterinary Practice Details: We may collect the name and contact details of your animal’s veterinary practice where this is relevant to the proposed service or the animal’s welfare. We will contact the practice only where you have authorised us to do so, where this is reasonably necessary to protect the animal’s welfare, or where disclosure is otherwise required or permitted by law.
• Veterinary Information: Where provided by you, we may record information relating to your animal’s veterinary care, including information concerning current veterinary investigations or medical condition, where relevant to the services provided.
• Consent Records: Where you provide consent for us to contact your veterinary practice, we may retain a record of that consent, including the time and date it was provided
2.8 Compliance Data: Electronic signatures, IP addresses at booking, and logged metadata proving checkout checkbox acceptances for our Terms & Conditions and any separate consent given for optional processing of special-category data, recordings or marketing.
2.9 Marketing Data: Your explicit opt-in preferences for receiving our quarterly newsletters and digital communication updates.
3. How We Collect Your Personal Data
3.1 Methods: We use different methods to collect data from and about you including through:
• Direct Interactions: You give us your identity, contact, and compliance data by filling out forms on our booking platform, completing our intake questionnaires, or by corresponding with us by email, telephone, WhatsApp message, text message or Instagram.
• Automated Technologies: As you interact with our website, we may automatically collect technical data about your equipment, browsing actions, and patterns via cookies.
4. How We Use Your Personal Data & Lawful Bases
4.1 Lawful Bases: We will only process personal data where we have identified a lawful basis under Article 6 UK GDPR. Where the information includes health data or another category of special-category personal data, we will also identify a separate condition under Article 9 UK GDPR. The applicable bases and conditions depend on the purpose of the processing, as explained below.
a. Performance of a Contract: We rely on Article 6(1)(b) UK GDPR where processing is necessary to take steps at your request before you book a service or to perform the contract with you. This includes administering enquiries and bookings, delivering the booked service, communicating with you about the appointment, and managing payments, cancellations and refunds. This basis does not by itself authorise the processing of special-category personal data.
b. Legitimate Interests: We rely on Article 6(1)(f) UK GDPR where processing is necessary for our legitimate interests or those of a third party and those interests are not overridden by your interests, rights or freedoms. This may include maintaining accurate service and business records, securing and administering our systems, responding to complaints, preventing or investigating misuse, and establishing, exercising or defending legal claims. We consider the necessity and impact of the processing before relying on this basis, particularly where a child’s data is involved.
c. Safeguarding and Protection from Harm: We may process or disclose personal data where this is necessary to protect an individual from harm, respond to a safeguarding concern, contact emergency services or make a referral to an appropriate authority. Depending on the circumstances, the applicable Article 6 basis may be compliance with a legal obligation, protection of vital interests or our legitimate interests. Where special-category data is involved, we will also identify an applicable Article 9 condition or another provision of the Data Protection Act 2018. We will disclose only information that is necessary and proportionate in the circumstances.
d. Legal Obligations: We rely on Article 6(1)(c) UK GDPR where processing is necessary to comply with a specific legal obligation that applies to us, including applicable tax, accounting, regulatory, safeguarding or court requirements. Professional-body, insurer and record-keeping requirements that are not imposed by law will not be described as legal obligations; where relevant, we will ordinarily assess them under legitimate interests or another applicable lawful basis.
e. Special-Category Data: Where we process information concerning a person’s physical or mental health or wellbeing, we will identify both an Article 6 lawful basis and an Article 9 condition. We may rely on explicit consent under Article 9(2)(a) UK GDPR where the processing is optional and the consent is specific, informed, freely given and capable of being withdrawn. We may rely on Article 9(2)(f) where processing is necessary for the establishment, exercise or defence of legal claims. Withdrawal of consent will not affect processing already carried out lawfully and will not require deletion where another lawful basis and Article 9 condition apply to continued retention.
f. Booking, Cancellation and Payment Administration: We use booking, payment, cancellation, attendance and correspondence records to confirm appointments, administer rescheduling and refunds, calculate any cancellation charge in accordance with the Terms & Conditions, respond to payment disputes or chargebacks, and recover amounts lawfully due. Depending on the activity, we rely on Article 6(1)(b) UK GDPR for necessary pre-contract steps and performance of the contract, Article 6(1)(c) where a specific legal obligation applies, and Article 6(1)(f) for our legitimate interests in maintaining accurate transaction records and establishing, exercising or defending legal claims.
g. Record Retention: We retain session notes and related records for the periods stated in Section 5 where retention is necessary for our legitimate interests in maintaining an appropriate record of the services provided, managing complaints and safeguarding matters, complying with applicable professional and insurance requirements, and establishing, exercising or defending legal claims. Where a specific legal obligation requires retention, we rely on Article 6(1)(c) UK GDPR. Where retained records contain special-category personal data, continued retention must also satisfy an applicable Article 9 condition, which may include Article 9(2)(f) where the information is necessary for the establishment, exercise or defence of legal claims. We review whether continued retention remains necessary and lawful throughout the applicable period.
5. Data Retention & Storage Timelines
5.1 Retention Criteria: We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including providing the service, handling complaints or claims, meeting safeguarding responsibilities and complying with applicable legal, accounting, professional and insurance requirements.
The retention periods for each record category, and the reasons for them, are reviewed periodically:
5.2 Adults and Animal Client Records: We securely retain session notes and related records concerning adult and animal clients for 10 years from the date of the appointment to which the record relates. Session notes may contain personal data and, where they include information about a person’s physical or mental health or wellbeing, special-category personal data. We retain these records to maintain an appropriate record of the services provided, comply with applicable professional and insurance requirements, manage complaints and safeguarding matters, and establish, exercise or defend legal claims. At the end of the applicable retention period, the records will be securely deleted or anonymised unless there is a documented lawful reason to retain them for longer
5.3 Children & Young People (Under 18): We securely retain session notes and related records concerning children and young people until the child’s 25th birthday, or until their 26th birthday if they were aged 17 at the date of their final appointment.
5.4 Timelines: At the end of an applicable retention period, we review the information and securely delete or anonymise it unless there is a documented lawful reason to retain particular information for longer. Deletion from backups may occur through the normal secure back up process.
5.5 Audio Recordings: We do not record sessions as standard. If an audio recording is separately proposed and agreed in advance in accordance with the Terms & Conditions, we will explain its purpose, lawful bases, access arrangements, security measures and retention period before recording begins. If there are any encrypted audio recordings related to your energy healing session, we implement a strict data separation system:
5.6 Pseudonymisation: All audio files and session records are detached from your personal identity and stored using a unique alphanumeric client reference code rather than your name. Because a separate record can link the code back to the client, the files remain personal data and are protected accordingly.
5.9 Data Security and Pseudonymisation: Pseudonymised files are held in a secure cloud-based practice management platform using robust enterprise-grade encryption both in transit and at rest (AES-256). Access is restricted to authorised persons and controlled through appropriate account and key-management measures. Although these rigorous safeguards reduce risk, no storage or digital communication system can be guaranteed to prevent all unauthorised access.
5.10 Master Key Security: The master list linking your name to your unique client code is stored completely separately in a locally password-protected document that only the practitioner can access.
5.11 Audio and Related Record Retention: We securely retain any agreed audio recording and the related session records for 10 years from the date of the appointment to which they relate. These records may contain personal data and, where they include information about a person’s physical or mental health or wellbeing, special-category personal data. We retain them to maintain an appropriate record of the services provided, comply with applicable professional and insurance requirements, manage complaints and safeguarding matters, and establish, exercise or defend legal claims. At the end of the applicable retention period, the recording, related digital files and corresponding entry on the master key list will be securely deleted or anonymised unless there is a documented lawful reason to retain them for longer.
6. Digital Platform Security & Infrastructure
6.1 Measures: We take data security very seriously and have implemented appropriate technical and organisational measures to prevent your data from being lost, altered, or accessed without authority:
6.2 Email Correspondence: All intake forms, session summaries, and digital communications sent via Gmail are managed within an encrypted, password-protected account restricted solely to the practitioner. Session notes are sent via encrypted PDF, with the password sent separately.
6.3 Mobile Messaging (WhatsApp & Text Message): Any communication or updates transmitted via WhatsApp or text message are kept on a secure, PIN-locked mobile device. WhatsApp chats are protected by native end-to-end encryption. We do not accept or process health or other sensitive information via WhatsApp. Any such information must be shared via our secure consultation channels.
6.4 Cloud Storage: Master tracking indexes, databases, and client folders are backup-protected on cloud servers utilising mandatory Two-Factor Authentication (2FA).
6.5 Practice Management Software: All client details and session notes are securely stored on our GDPR-compliant, password and two-factor authentication protected software management system, Kiku.
6.6 International Data Transfers: Our digital tools (Google Workspace, Kiku, Stripe/PayPal) may store data on secure international servers and process personal data outside the United Kingdom. Where data is transferred outside the UK/EEA, it is protected by statutory UK International Data Transfer Agreements (IDTAs) or European Standard Contractual Clauses (SCCs) to ensure equivalent protection.
7. Disclosures of Your Personal Data
7.1 Confidentiality: Your data is treated with strict confidentiality. It is never sold, traded, or shared with third parties for marketing purposes. We will only share your personal data with:
7.2 Veterinary Practices: We may contact your animal’s veterinary practice or send a basic notification concerning the existence of a session where you have authorised us to do so, where this is reasonably necessary to protect the animal’s welfare, or where disclosure is otherwise required or permitted by law. We will disclose only information that is necessary and proportionate for the relevant purpose. We will not share session notes or other confidential information without an appropriate lawful basis and, where applicable, a condition permitting the processing of any special-category personal data.
7.3 Service Providers: We may share personal data with service providers acting for us, including our booking and practice-management provider, email and cloud-storage providers, video-call and communications providers, payment processors, website and hosting providers, and professional IT or security support. They may process personal data only for the relevant service and subject to appropriate contractual, confidentiality and security requirements. Payment providers process payment-card information under their own privacy terms where they act as independent controllers.
7.4 Personal Data Breaches: We maintain procedures to identify, assess and respond to personal data breaches. Where required by law, we will notify the Information Commissioner’s Office without undue delay and, where a breach is likely to result in a high risk to your rights and freedoms, we will also inform you without undue delay.
8. Your Legal Rights
8.1 Data Protection Laws: Under UK data protection laws (UK GDPR), you have rights including the right to access your personal data, request corrections, or object to processing.
8.2 The Right to Restrict Processing: You have the right to request that we suspend the processing of your personal data in certain scenarios, such as if you want us to establish its accuracy or the reason for processing it.
8.3 Withdrawing Consent: You can withdraw your consent for marketing updates or optional audio recordings at any time by contacting us. We will stop the consent-based processing and delete or anonymise the relevant information unless another lawful basis requires or permits us to retain it.
8.4 ‘Right to be Forgotten’ (Data Erasure): You may ask us to erase your personal data in circumstances provided by data protection law. The right is not absolute. We may retain particular information where continued processing is necessary for a legal obligation, safeguarding purpose, the establishment, exercise or defence of legal claims, or another lawful ground. We will explain any refusal or partial refusal and the lawful basis relied upon. This may include session notes retained during the period specified in Section 5.2, 5.3 and 5.10 where continued retention remains necessary and lawful.
8.5 Exercising Rights/Privacy Concerns: If you wish to exercise any of your rights, or if you have a privacy concern, please contact Emma at emma@from-the-heart.uk and see our Complaints Policy. You also have the right to lodge a complaint at any time with the Information Commissioner’s Office (ICO), the UK’s supervisory authority for data protection.
8.6 Children and Young People: Children have their own data protection rights. Where a child has sufficient understanding, we will provide privacy information in a form appropriate to their age and deal with them directly when they exercise their rights. A parent or person with parental responsibility may act for a child where appropriate, but parental access is not automatic. We will consider the child’s age, understanding, wishes, best interests and the circumstances of the request before disclosing information.
9. Accountability, Roles, and Policy Review
9.1 Designated Lead: The founder and principal practitioner of From the Heart, Emma Randell (practising professionally as Emma Hunt), is responsible for overseeing compliance with this Privacy Policy, responding to data protection enquiries and rights requests, reviewing retention and security arrangements, and coordinating any safeguarding disclosures and statutory referrals.
9.2 Policy Review: This policy will be proactively reviewed annually to ensure alignment with any updates to UK safeguarding legislation, local authority guidelines, and remote digital safety best practices.
Date of Last Review: 19 October 2026
Date of Next Review: 18 October 2027
Signed: Emma Randell [Signed Electronically]
Role: Practitioner & Designated Safeguarding Lead, From the Heart Energy Healing
Date: 19 October 2026