Privacy Policy

Effective Date: 23-Dec-2022
Last Updated: 12-Aug-2026

1. Introduction

Marissa Simone respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains what personal information we collect, why we collect it, how it is used and stored, who it may be shared with, how long it is retained and the rights you have in relation to your information.

This policy applies to information collected through our website, enquiries, appointment bookings, client forms, treatment sessions, communications and other interactions with Marissa Simone.

2. Who We Are

Marissa Simone provides Craniosacral Therapy services to babies, children, teenagers and adults.

For the purposes of UK data protection law, Marissa Simone is the data controller responsible for the personal information described in this Privacy Policy.

Email: coach@marissasimone.com
Telephone: 07968 849626
Website: marissasimone.com

If you have any questions about how your personal information is handled, please contact Marissa using the details above.

3. Information We Collect

The information we collect depends upon how you interact with us and the services you receive. We may collect:

• your name, preferred name and date of birth;
• address, email address and telephone number;
• appointment and booking information;
• payment and transaction information;
• emergency contact details;
• parent or guardian details and relationship to a child or young person;
• information you provide when making an enquiry;
• correspondence and communications with us;
• information provided on booking, intake, consent or other client forms;
• treatment notes and records relating to your sessions; and
• other information that you choose to provide and that is relevant to providing or administering our services.

We only seek to collect information that is reasonably necessary for the purposes described in this policy.

4. Health and Special Category Information

In order to assess whether Craniosacral Therapy is appropriate and to provide treatment safely and effectively, we may need to collect information about your health.

This may include information concerning:

• medical conditions and diagnoses;
• medication;
• allergies;
• pregnancy;
• previous illnesses, operations and hospital treatment;
• accidents and injuries;
• physical or emotional wellbeing;
• disabilities or additional needs;
• sensory, communication or mobility needs;
• treatment or support received from other healthcare or relevant professionals; and
• other health information relevant to your treatment.

Health information is classed as special category personal data under UK data protection law and receives additional protection.

Where we process information concerning your health, we do so where necessary for the provision of Craniosacral Therapy and the management of your treatment records, relying on the appropriate lawful basis under Article 6 of the UK GDPR and, where the applicable requirements are met, Article 9(2)(h) of the UK GDPR. Health and treatment information is treated confidentially and is subject to professional and legal duties of confidence.

We may also process or retain health information where necessary for the establishment, exercise or defence of legal claims, including responding to complaints or insurance matters, in accordance with Article 9(2)(f) of the UK GDPR.

Where another special category condition is appropriate for a particular purpose, such as safeguarding, we will rely upon that condition as permitted by law.

Consent to receive Craniosacral Therapy is separate from consent used as a lawful basis under data protection legislation.

5. Information About Babies, Children and Young People

As Marissa Simone works with babies, children and teenagers, we may collect personal and health information relating to people under the age of 18.

Depending upon the child’s age and circumstances, this information will normally be provided by a parent or legal guardian and may include:

• pregnancy and birth history;
• early development;
• feeding and digestive information;
• sleep;
• sensory processing;
• developmental information;
• emotional and behavioural wellbeing;
• diagnosed or suspected neurodevelopmental conditions;
• information concerning assessments;
• information about other professionals supporting the child; and
• other information relevant to understanding and supporting the child.

A parent or legal guardian will normally be asked to provide appropriate authorisation before treatment of a child or young person begins.

Children have data protection rights in their own right. We take particular care when collecting and using children’s personal information and will take account of the child’s age, understanding, wishes, wellbeing and best interests where appropriate.

6. How We Collect Your Information

We may receive personal information:

• directly from you;
• from a parent or legal guardian;
• through our website;
• through telephone or email enquiries;
• through our online appointment booking system;
• through booking, intake, consent or other client forms;
• during consultations and treatment sessions;
• through payment providers; and
• where appropriate and with a suitable lawful basis, from another person or professional involved in your or your child’s care.

7. How and Why We Use Your Information

We may use personal information to:

• respond to enquiries;
• arrange, confirm, change and manage appointments;
• communicate with you about your appointments;
• assess whether Craniosacral Therapy is appropriate;
• understand your or your child’s needs;
• provide Craniosacral Therapy;
• maintain appropriate client and treatment records;
• monitor treatment and relevant changes in health or circumstances;
• process and administer payments;
• maintain appropriate financial and business records;
• manage the professional relationship between you and Marissa Simone;
• deal with complaints, queries or concerns;
• meet safeguarding responsibilities;
• establish, exercise or defend legal claims where necessary;
• comply with legal, regulatory, insurance or professional obligations;
• maintain the security and operation of our website and systems; and
• understand how our website is being used where website analytics are enabled.

We will not use personal information for purposes that are incompatible with the purposes for which it was originally collected unless permitted or required by law.

8. Our Lawful Bases for Processing

Under UK data protection law, we must have a lawful basis for using personal information. Depending upon the purpose, we may rely upon:

Contract – where processing is necessary to provide services you have requested or to take steps at your request before providing those services.

Legal obligation – where we need to process information to comply with a legal requirement.

Legitimate interests – where processing is reasonably necessary for operating and administering the practice, maintaining appropriate records, communicating with clients, protecting the practice and providing an effective service, provided those interests are not overridden by your rights and interests.

Consent – where we specifically ask for and rely upon your consent for a particular use of your information.

Where special category information such as health information is processed, an additional condition under Article 9 of the UK GDPR must also apply. The relevant conditions are described in the Health and Special Category Information section above.

9. Appointment Booking and Payments

We use third-party service providers to help manage online appointment bookings and process payments.

When you make an online booking, information such as your name, contact details, appointment information and information necessary to administer the booking may be processed by the booking provider.

Where you make a payment, the payment provider will process the information necessary to complete and administer that transaction. We do not need to retain your complete payment card details ourselves.

Third-party providers process personal information in accordance with their own privacy obligations and, where they process information on our behalf, appropriate data protection arrangements are required.

10. Calendar and Appointment Information

An electronic calendar may be used to help manage appointments.

Only limited appointment information, such as the client’s name, appointment date and time, is placed in the calendar. Health information and treatment notes are not intentionally recorded in calendar entries.

11. Email and Communications

Email is provided through a third-party email hosting provider whose hosting infrastructure is located in Germany.

Emails you send to us may contain personal information. We therefore recommend that you do not include unnecessary sensitive health information in ordinary email communications.

Where sensitive information needs to be recorded as part of your treatment record, it may be transferred to the secure client record system where appropriate.

12. Client and Treatment Records

Client information and treatment records may be stored electronically using a secure cloud-based patient administration and clinical record system.

Appropriate technical and organisational measures are used to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

Access to treatment records is restricted to those who have an appropriate need to access them.

We select service providers with regard to the nature and sensitivity of the information being processed and require appropriate data protection and security arrangements.

13. Who We May Share Your Information With

We do not sell your personal information.

Where necessary, information may be shared with organisations that help us provide and administer our services, including:

• appointment booking providers;
• payment processors;
• secure patient administration and clinical record providers;
• website hosting and technology providers;
• email providers;
• calendar providers;
• website analytics providers;
• accountants, insurers, legal advisers or other professional advisers where appropriate; and
• the police, regulatory bodies, public authorities or other organisations where disclosure is required or permitted by law.

Only information reasonably necessary for the relevant purpose will be shared.

Health or treatment information will not ordinarily be shared with another healthcare or support professional without an appropriate reason and lawful basis.

14. Safeguarding and Legal Disclosures

There may be exceptional circumstances where information needs to be disclosed without consent. This may include circumstances involving the safety or welfare of a child or individual at risk, the prevention or detection of serious wrongdoing, a legal requirement, court order or the establishment, exercise or defence of legal claims.

Where such disclosure is necessary, we will seek to disclose only information that is relevant and proportionate to the circumstances.

15. Website Forms

Forms on our website may be used to submit enquiries or contact details.

Our general website forms are not intended for submitting detailed medical or health information. Please avoid entering unnecessary sensitive health information into general website enquiry forms.

Information submitted through these forms will be used to respond to your enquiry or provide the service you have requested.

16. Website Analytics and Cookies

We may use website analytics to understand how visitors use our website and to help us improve its performance and content.

Analytics may collect information such as pages visited, approximate location, browser or device information and how visitors interact with the website.

Where analytics or other non-essential cookies require consent, they will only be used in accordance with your cookie preferences and applicable law.

For more information about the cookies used on our website and how you can manage your preferences, please see our Cookie Policy.

17. Marketing Communications

We will not send you electronic marketing simply because you have received treatment or made an enquiry.

If we introduce newsletters or other marketing communications, we will only use your information for those purposes where there is an appropriate lawful basis and, where required, you have chosen to receive them.

You will be able to unsubscribe from marketing communications at any time.

18. International Data Transfers

Some of the service providers we use may process or make personal information accessible outside the United Kingdom.

Where personal information is transferred internationally, we will take reasonable steps to ensure that the transfer complies with applicable UK data protection requirements and that appropriate safeguards are in place where required.

19. How Long We Keep Your Information

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected and to meet applicable legal, professional, insurance and business requirements.

Treatment and clinical records for adults are retained for at least 7 years following the last occasion on which treatment was provided.

Where treatment is provided to a person under the age of 18, treatment and clinical records are retained for at least 7 years after the client reaches the age of 18.

This means that records relating to a child may be retained for a considerable period after treatment has ended.

Financial and transactional records may be retained for the period necessary to comply with applicable accounting and taxation requirements.

Other information, such as general enquiries that do not result in treatment, will not be retained for longer than reasonably necessary.

When personal information is no longer required, it will be securely deleted, anonymised or destroyed as appropriate.

20. Security

We take reasonable and appropriate technical and organisational measures to protect personal information from loss, misuse, unauthorised access, alteration or disclosure.

These measures may include secure cloud-based systems, encryption, password protection, access controls, multi-factor authentication where available, appropriate security measures on devices and accounts, and selecting service providers that provide suitable data-security protections.

Although we take reasonable precautions, no electronic system or method of communication can be guaranteed to be completely secure.

21. Your Data Protection Rights

Depending upon the circumstances, UK data protection law may give you rights including the right to:

• be informed about how your information is used;
• request access to your personal information;
• ask us to correct inaccurate or incomplete information;
• ask us to erase your personal information in certain circumstances;
• ask us to restrict the processing of your information;
• object to certain processing;
• receive certain information in a portable format;
• withdraw consent where processing is based upon consent; and
• complain about the way your personal information has been handled.

Not every right applies in every circumstance. For example, some information may need to be retained despite a request for deletion where there is a lawful reason or obligation to retain it.

To exercise your rights, please contact Marissa at coach@marissasimone.com. We may need to verify your identity before responding to a request.

22. Children’s Data Protection Rights

Personal information concerning a child belongs to the child for data protection purposes, even where it was originally supplied by a parent or guardian.

Depending upon the child’s age, maturity and understanding, a parent or guardian may exercise data protection rights on the child’s behalf, or the child may be able to exercise those rights themselves.

We will consider the individual circumstances, the child’s best interests and applicable data protection requirements when dealing with requests concerning children’s information.

23. Third-Party Websites

Our website may contain links to websites or services operated by other organisations.

We are not responsible for the privacy practices of third-party websites. If you follow a link to another website, we recommend reviewing that organisation’s privacy information.

24. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our services, systems, legal requirements or the way we process personal information.

The current version will be published on our website and the Last Updated date at the top of this policy will be amended when material changes are made.

25. Contact Us and Complaints

If you have questions, concerns or requests relating to this Privacy Policy or the way your personal information is handled, please contact:

Marissa Simone
Email: coach@marissasimone.com
Telephone: 07968 849626
Website: marissasimone.com

If you have a concern about the way your personal information has been handled, please contact Marissa in the first instance so that we have an opportunity to address it.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator.