Privacy Policy
Last updated: 7 September 2026
This policy is reviewed annually, or sooner if my practice or the law changes.
Wellness Within UK ("I", "me", "my") is committed to protecting your privacy. This policy explains what personal information I collect, why, how it's used, and your rights under UK data protection law (UK GDPR and the Data Protection Act 2018).
Data controller: Niki Baggs, trading as Wellness Within UK
2A Northbrook Court, Park Street, Newbury, Berkshire RG14 1EA
info@wellnesswithin.uk
1. What information I collect
Information you give me directly:
- Name, email address and phone number (contact form, booking, email)
- Enquiry details and reason for contact
- Information you share during a Discovery Call, therapy, coaching or EMDR sessions — this may include health information, mental health history and other sensitive ("special category") data relevant to your support
Information collected automatically:
- Basic website usage data (see Cookies, below)
Information from third parties:
- Booking and scheduling details via Setmore (my booking platform)
- Video session data via Zoom and, where used, Bilateral Base
2. Why I use your information and my legal basis
| Purpose | Legal basis |
|---|---|
| Responding to enquiries | Legitimate interests |
| Booking and delivering sessions | Contract / legitimate interests |
| Keeping clinical/session notes | Health/social care purposes carried out by a professional under a duty of confidentiality (UK GDPR Article 9(2)(h)) |
| Sending appointment reminders or admin emails | Contract / legitimate interests |
| Meeting legal and professional obligations (e.g. safeguarding, professional body requirements) | Legal obligation |
I do not use your information for marketing without your separate, explicit consent, and you can withdraw that consent at any time.
I do not use automated decision-making or profiling in a way that produces legal or similarly significant effects on you.
3. Session notes and confidentiality
Notes from our work together are kept securely and confidentially, in line with the professional and ethical standards of the National Counselling and Psychotherapy Society (NCPS) and Addiction Professionals. As an NCPS member, I also work within the NCPS Code of Ethics. Confidentiality has some limits: I may need to break confidentiality where there is a serious risk of harm to you or someone else, where required by law, or in line with my professional body's safeguarding requirements. This is explained further at the start of our work together.
4. Who I share information with
I don't sell or rent your information. I share it only with:
- Service providers who help me run the practice: Setmore (booking), Zoom and Bilateral Base (online sessions), Yola (website hosting and email)
- Clinical supervisor, on an anonymised or pseudonymised basis, as required for safe, ethical practice
- Relevant authorities, only where legally required or necessary to protect someone's safety
Some third-party providers (e.g. Zoom) may process data outside the UK/EEA. Where this happens, appropriate safeguards (such as standard contractual clauses) are in place.
5. How long I keep your information
- Contact form / enquiry data not leading to a booking: 12 months
- Client session records (adults): 7 years after the end of therapy, in line with professional body guidance
- Records relating to a minor client: 18 years
6. Your rights
Under UK GDPR, you have the right to:
- Access the personal data I hold about you
- Ask me to correct inaccurate data
- Ask me to delete your data (subject to my professional record-keeping obligations)
- Restrict or object to certain processing
- Data portability, where applicable
- Withdraw consent at any time where processing relies on consent
To exercise any of these rights, contact info@wellnesswithin.uk. If you're unhappy with how your data has been handled, you also have the right to complain to the Information Commissioner's Office (ICO) — ico.org.uk.
7. Cookies
This website uses cookies to support essential site functionality and, where you consent, to understand how the site is used. You can control or withdraw cookie consent at any time via your browser settings or the cookie preferences link on this site. Declining non-essential cookies does not affect your ability to use the site or contact me.
8. Security
I take reasonable technical and organisational steps to protect your information, including secure storage and limiting access to those who need it. No online system can be guaranteed completely secure, and this is also explained on the Online & In-Person Services page.
9. Changes to this policy
I may update this policy from time to time. The "last updated" date at the top will reflect the most recent version.
10. Contact
Questions about this policy or your data can be sent to info@wellnesswithin.uk or 07521 970788.