Privacy Policy
Effective Date: June 2026
At The Oya Energy (accessible from www.theoyaenergy.co.uk), your privacy is of the utmost importance to us. This Privacy Policy outlines how we collect, use, store and protect your personal data, including sensitive information such as medical history, in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
This policy applies to all personal data collected through our website, booking and intake forms, email communications, online sessions and any offline interactions including paper consent forms and session notes.
WHO WE ARE
The Oya Energy is a breathwork practice operated by Stefanie Helene, based in Colchester, UK. For the purposes of data protection law, Stefanie Helene is the Data Controller of your personal information.
Contact: stefanie@theoyaenergy.co.uk
Website: www.theoyaenergy.co.uk
WHAT INFORMATION WE COLLECT
We may collect and process the following categories of information:
Personal identifiers: full name, email address, telephone number and contact details.
Medical and health information: medical history, current medications, relevant physical or mental health conditions, and any other health information submitted via the intake form prior to a session. This is special category data under UK GDPR and is collected and processed only with your explicit consent.
Session information: notes and records made during or after breathwork sessions, including observations relevant to your wellbeing and progress.
Financial information: payment records including the amount paid, date and service type. We do not store your payment card details. Card transactions are processed by Stripe, which is PCI-DSS compliant.
Booking and scheduling data: appointment details, date and time of sessions, and correspondence related to bookings, collected via Acuity Scheduling.
Communications: emails and messages exchanged with us in relation to enquiries, bookings or session follow-up, stored in Google Workspace.
Newsletter data: your name and email address if you subscribe to Soul's Whisper, our newsletter, via Squarespace Email Campaigns.
Website and technical data: browser type, device information, IP address and pages visited, collected via Squarespace's built-in analytics. IP addresses are anonymised where possible. This data is used solely to understand how our website is used and to improve it.
Safeguarding records: where required, factual records of any disclosure or concern that arises during a session, retained in accordance with our safeguarding protocol and insurance requirements.
WHY WE COLLECT YOUR DATA
We collect and process your personal data in order to:
- Provide you with safe, tailored breathwork facilitation
- Assess your suitability for sessions based on your medical history and health needs
- Maintain accurate records for legal, regulatory and insurance purposes as required by our insurer, Balens
- Communicate with you regarding bookings, sessions and follow-up
- Process payment for services
- Send you Soul's Whisper, our newsletter, if you have opted in
- Fulfil our safeguarding obligations if a concern arises during a session
You may unsubscribe from the newsletter at any time via the unsubscribe link in any issue or by emailing stefanie@theoyaenergy.co.uk. Unsubscription requests are processed within 30 days.
LEGAL BASIS FOR PROCESSING
Under the UK GDPR, we rely on the following lawful bases depending on the type of data and purpose:
Explicit consent: for the collection and processing of special category data, including medical history and health information. You provide this consent by completing the intake form prior to your first session. You may withdraw this consent at any time, though withdrawal may mean we are unable to continue providing services safely.
Contract: processing necessary to fulfil our service agreement with you, including booking, scheduling and payment administration.
Legitimate interests: keeping accurate business records, responding to enquiries and improving the quality of our services, where this does not override your rights and interests.
Legal obligation: retaining records for the periods required by our insurance provider and by HMRC.
Vital interests: in exceptional circumstances, we may need to process or disclose information to protect your life or the life of another person.
We will never use your data for automated decision-making or profiling.
HOW WE COLLECT YOUR DATA
Personal data is collected through the following routes:
- Squarespace intake and booking forms submitted via our website
- Acuity Scheduling, used for booking appointments and discovery calls
- Email correspondence via Google Workspace
- Online sessions conducted via Google Meet
- Squarespace Email Campaigns, for newsletter subscribers
- Payment processing via Stripe through Squarespace
- Offline: paper consent forms, verbal disclosures during sessions and handwritten session notes where applicable
THIRD-PARTY DATA PROCESSORS
We use a small number of trusted third-party services to operate this business. Each acts as a data processor on our behalf and is contractually required to handle your data securely and in accordance with UK GDPR. These are:
Squarespace (United States): website hosting, booking forms, email campaigns and payment processing. Squarespace's servers are located outside the UK. Data transfers are protected through standard contractual clauses approved under UK GDPR.
Acuity Scheduling (United States, owned by Squarespace): appointment booking and scheduling. Holds your name, contact details and appointment history.
Stripe (United States): payment card processing. Stripe does not share your card details with us. Stripe is PCI-DSS compliant.
Google Workspace (United States): email and document storage. Holds correspondence related to your enquiry, booking and sessions. Google LLC participates in the UK-US data bridge.
Google Meet (United States): delivery platform for online sessions. Google's own privacy policy applies to data processed during calls. We do not record sessions without your explicit prior consent.
Google Analytics (United States, operated by Google LLC): used to analyse website traffic and understand how visitors use our site. Google Analytics collects anonymised data including pages visited, time on site and general location. IP addresses are anonymised before storage. Google LLC participates in the UK-US data bridge. You can opt out of Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on, available at tools.google.com/dlpage/gaoptout.
We do not share your personal data with any other third parties unless required to do so by law or a regulatory authority. We never sell, rent or trade your personal information.
DATA RETENTION
We retain personal data for the following periods:
Client intake forms and session records: 7 years from the date of your last session, as required by our professional insurance provider, Balens.
Records relating to clients who were under 18 at the time of their sessions: retained until the individual reaches the age of 18 and for a further 7 years thereafter.
Safeguarding records: retained for the same period as all other client records — 7 years from the date of the last session — in accordance with our insurance requirements and safeguarding obligations.
Payment records: 6 years from the date of the transaction, as required for HMRC self-assessment purposes.
Discovery call contacts who do not proceed to a booking: contact details are deleted within 90 days of the call if no booking is made.
Newsletter subscriber data: retained for as long as you remain subscribed. Removed within 30 days of unsubscription.
After the relevant retention period, your data will be securely deleted or destroyed.
HOW WE STORE AND PROTECT YOUR DATA
Client records, intake forms and session notes are stored in encrypted cloud storage (Google Drive), accessible only to Stefanie Helene.
Email correspondence containing personal or medical data is reviewed on receipt, transferred to secure storage and managed in accordance with this policy.
All platforms used to operate this business are secured with strong, unique passwords and two-factor authentication (2FA) where available.
We take appropriate technical and organisational measures to protect your data against unauthorised access, loss or disclosure. Access to your personal information is limited solely to Stefanie Helene as the sole operator of The Oya Energy.
In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of it and will inform you without undue delay where required by law.
WORKING WITH CLIENTS UNDER 18
The Oya Energy primarily offers services to adults. We do work with clients under the age of 18 on occasion and take additional care in these cases.
For clients under 18, written consent from a parent or guardian is required before any session takes place. This consent is separate from and additional to the intake form completed by the young person. The parent or guardian's contact details are held on file for the duration of the professional relationship and are retained as part of the client record.
For data protection purposes, we do not rely on a young person under 13 to provide their own consent for data processing. Consent is obtained from the parent or guardian in all cases where the client is under 13.
For clients aged 13 to 17, consent is obtained from both the young person and their parent or guardian.
If you believe a child has submitted personal information to us without appropriate parental consent, please contact us at stefanie@theoyaenergy.co.uk and we will take prompt action to review and, where appropriate, delete the data.
CONFIDENTIALITY AND ITS LIMITS
All personal information shared during a session is held in strict confidence. We do not discuss client sessions with third parties, share your information without your consent or use identifiable client experiences in any public-facing content.
Confidentiality has one limit. If we have a genuine concern that you or another person, including a child, is at serious risk of harm, we may need to seek guidance or take action beyond the session. Where it is safe to do so, we will discuss this with you first. This limit is disclosed in our intake form and Terms of Business before any session takes place.
This is a high threshold. A client expressing grief, fear, sadness or past trauma is not automatically a safeguarding concern. The threshold is genuine, current, serious risk of harm.
COOKIES
Our website uses cookies to support site functionality and to collect anonymised visitor data via Squarespace's built-in analytics and Google Analytics. These cookies do not collect personally identifiable information. IP addresses collected through Google Analytics are anonymised before storage.
When you first visit our website, you are presented with the option to accept or decline non-essential cookies. If you decline, non-essential cookies will not be set. You may also adjust your cookie preferences at any time through your browser settings.
You can opt out of Google Analytics tracking specifically by installing the Google Analytics Opt-out Browser Add-on at tools.google.com/dlpage/gaoptout.
We do not use advertising cookies or share cookie data with third parties for marketing purposes.
YOUR DATA PROTECTION RIGHTS
Under UK GDPR, you have the following rights:
Right of access: to request a copy of the personal data we hold about you.
Right to rectification: to request correction of any inaccurate or incomplete information.
Right to erasure: to request deletion of your data, subject to our legal obligations to retain certain records.
Right to restriction: to request that we limit how we process your data in certain circumstances.
Right to object: to object to processing based on legitimate interests.
Right to data portability: to receive your data in a commonly used, machine-readable format where technically feasible.
Right to withdraw consent: where processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
To exercise any of these rights, please contact us at stefanie@theoyaenergy.co.uk. We will respond within one calendar month.
If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
Website: ico.org.uk
Helpline: 0303 123 1113
CHANGES TO THIS POLICY
We review this Privacy Policy annually and whenever there is a material change to how we collect or process personal data. The effective date at the top of this page will be updated to reflect any changes. We recommend checking this page periodically.
If any changes significantly affect how we handle your data, we will notify you by email where we hold a current email address for you.
CONTACT
If you have any questions about this Privacy Policy or about how we handle your personal data, please contact:
Stefanie Helene
The Oya Energy
Email: stefanie@theoyaenergy.co.uk
Website: www.theoyaenergy.co.uk