Eunoia Health Ltd

Last updated: 22 April 2026

1. Introduction

Eunoia Health Ltd ("Eunoia Health", "we", "us", or "our") is committed to protecting your privacy and handling personal information lawfully, responsibly, and confidentially.

This Privacy Policy explains how we collect, use, and protect personal data when you:

• visit our website: www.eunoiahealth.uk

• purchase ebooks or digital resources

• enquire about or receive therapy services

• engage with corporate wellbeing or consultancy services

• subscribe to newsletters or communications

• contact us via forms, email, or other channels

We process personal data in accordance with:

• the UK General Data Protection Regulation (UK GDPR)

• the Data Protection Act 2018

• the Privacy and Electronic Communications Regulations (PECR)

Because some of our services involve psychological support, we may process special category health data, which is handled with enhanced safeguards and strict confidentiality.

2. Data Controller

The Data Controller responsible for your personal data is:

Eunoia Health Ltd, Rookfield Road, Horsham, West Sussex, RH12 0AX
Email: support@eunoiahealth.uk

3. Information We Collect

3.1 Information You Provide

Depending on how you interact with us, we may collect:

• name and contact details (email, phone number, address)

• date of birth (for clinical purposes where relevant)

• information you share in enquiry forms, including a brief description of what brings you to therapy

• payment details (processed securely by our payment provider; we do not store full card details)

• information provided during intake, assessment, and therapy sessions

• correspondence via email, phone, or other channels

• newsletter subscription preferences

• responses to surveys or feedback requests

3.2 Information Collected Automatically

When you visit our website, we may collect limited technical information, including:

• device type, browser type, and operating system

• approximate location (derived from IP address, not precise)

• pages viewed and time spent on our website

• referral source

This information is collected via cookies and similar technologies. See Section 10 for details.

3.3 Special Category Data

Where you engage our therapy services, we will process health data — which is classified as "special category data" under UK GDPR. This includes any information you share about your mental health, physical health, or related matters during enquiry, assessment, or therapy.

Special category data is processed only:

• with your explicit consent; or

• where necessary for the provision of health or social care under the supervision of a qualified professional (Article 9(2)(h) UK GDPR).

Clinical notes are stored in a dedicated, secure clinical records system separate from our CRM. They are not used for marketing and are accessed only by the therapist involved in your care.

4. How We Use Your Information

We use personal data for a range of purposes, each supported by a lawful basis under UK GDPR.

To respond to enquiries and arrange free consultations, we rely on our legitimate interest in responding to people who contact us about our services. Information processed at this stage is limited to what you share in your enquiry.

To provide therapy services, corporate wellbeing, or consultancy services, we rely on our contract with you. Where health data is processed as part of delivering therapy, we additionally rely on Article 9(2)(h) of UK GDPR (provision of health care by a qualified professional).

To send appointment reminders and service-related communications, we rely on our contract with you. These communications are necessary to deliver the service you have engaged us for.

To process payments and maintain financial records, we rely on our contract with you and our legal obligation to keep accurate financial records.

To send newsletters and marketing communications, we rely on your explicit consent. You can withdraw consent at any time via the unsubscribe link in any email or by contacting us directly.

To maintain clinical records, we rely on our legal and professional obligations, along with Article 9(2)(h) of UK GDPR where health data is involved. Clinical records are kept in line with guidance from professional bodies (e.g. BACP).

To improve our website and services, we rely on our legitimate interest in understanding how our services are used and how they can be made better. This includes limited analytics data, processed only with your consent via our cookie banner.

To meet legal, regulatory, and professional obligations, we rely on our legal obligations as a registered company and the professional requirements that apply to psychological therapy services in the UK.

We do not use personal data for any purpose beyond those listed above without first informing you and, where required, obtaining your consent.

5. How We Collect and Transfer Your Information

When you submit an enquiry via our website contact form, your information is transferred via Zapier (a data integration service) to HubSpot (our CRM). This transfer is automated and happens within moments of submission.

If you book a consultation, attend a session, or correspond with us directly, that information is stored in the appropriate system (CRM for lead management, clinical records system for therapy).

We maintain a clear separation between:

• Lead and enquiry data — stored in HubSpot

• Clinical records — stored in a dedicated, secure clinical records system

• Newsletter subscriber data — stored in MailerLite

6. Third Parties and Data Processors

We use trusted third-party service providers to help us deliver our services. These providers process personal data on our behalf under written Data Processing Agreements that require them to maintain appropriate security, confidentiality, and lawful processing standards.

HubSpot, Inc. — Customer Relationship Management (CRM) We use HubSpot to manage enquiries, contact information, and communications with current and prospective clients. Data processed includes your name, email address, phone number, enquiry details, and communication history. HubSpot is certified under the EU–US and UK–US Data Privacy Framework. Privacy notice: https://legal.hubspot.com/privacy-policy

Zapier, Inc. — Data Integration We use Zapier to transfer enquiry data from our website to HubSpot. Zapier processes data only as needed to complete each transfer and does not retain personal data beyond this. Privacy notice: https://zapier.com/privacy

Soloist — Website Hosting Our website is hosted on Soloist. Soloist processes basic technical data (such as IP addresses) when visitors access the site. Privacy notice: [Insert link to Soloist's privacy policy]

Google LLC (Google Workspace) — Email and Productivity We use Google Workspace for email, document storage, and calendars. Data shared via email may be processed by Google. Privacy notice: https://policies.google.com/privacy

MailerLite — Newsletter Delivery If you subscribe to our newsletter, your email address and engagement data are processed by MailerLite. You can unsubscribe at any time via the link in any newsletter. Privacy notice: https://www.mailerlite.com/legal/privacy-policy

Google Analytics (GA4) — Website Analytics We use Google Analytics to understand how visitors use our website. Analytics cookies are only set if you consent via our cookie banner.

Stripe — Payments We use [Processor] to process payments for our services. Card details are handled directly by [Processor] and are not stored on our systems.

We do not sell your personal data to any third party under any circumstances. We only share data with processors where necessary to deliver our services, and always under appropriate contractual safeguards.

7. International Transfers

Some of our processors (including HubSpot, Zapier, and Google) are based in the United States. Where personal data is transferred outside the UK, we rely on appropriate safeguards, including:

• the UK Extension to the EU–US Data Privacy Framework, where the provider is certified

• the UK International Data Transfer Agreement or EU Standard Contractual Clauses, where required

• contractual Data Processing Agreements with each provider

We take reasonable steps to ensure your personal data receives an equivalent level of protection as it does under UK law.

8. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, and to comply with our legal, regulatory, and professional obligations. Our retention periods are as follows:

Enquiry data — where you contacted us but did not proceed to therapy, your information is retained for 12 months from your last point of contact. After this period, the data is deleted or anonymised.

Client contact and billing records — for clients who engaged our services, contact and billing records are retained for 7 years from the end of the engagement, in line with HMRC requirements for financial record-keeping.

Clinical records — retained for 7 years from the end of therapy, in line with guidance from professional bodies. Records involving minors may be retained for a longer period where required by professional guidance.

Newsletter subscriber data — retained until you unsubscribe. If you unsubscribe, your email is removed from active mailing lists, though we may retain a suppression record to ensure we do not contact you again.

Website analytics data — retained for a maximum of 14 months, after which it is automatically deleted.

After the applicable retention period expires, data is securely deleted or fully anonymised so that it can no longer be linked to you.

9. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

• Right to be informed — about how your data is used (this policy)

• Right of access — to request a copy of the data we hold about you

• Right to rectification — to correct inaccurate or incomplete data

• Right to erasure — to request deletion ("right to be forgotten") in certain circumstances

• Right to restrict processing — to limit how we use your data

• Right to data portability — to receive your data in a portable format

• Right to object — to certain kinds of processing, including direct marketing

• Rights related to automated decision-making — we do not use automated decision-making or profiling that produces legal or significant effects

To exercise any of these rights, email support@eunoiahealth.uk. We will respond within one month.

If you are unhappy with how we have handled your personal data, you have the right to complain to the Information Commissioner's Office (ICO): www.ico.org.uk / 0303 123 1113.

10. Cookies

Our website uses cookies and similar technologies. When you first visit our site, you will see a cookie banner allowing you to accept, reject, or manage your preferences.

Strictly necessary cookies — required for the website to function; cannot be disabled.

Analytics cookies — help us understand how visitors use our site (Google Analytics). Only set with your consent.

Marketing cookies — currently we do not use marketing cookies. If this changes, we will update this policy and seek appropriate consent.

You can withdraw cookie consent at any time by clearing your browser cookies or revisiting the cookie preferences on our site.

11. Marketing Communications

We only send marketing communications (such as our newsletter) if you have explicitly opted in.

You can unsubscribe at any time by:

• clicking the unsubscribe link in any newsletter email

• emailing support@eunoiahealth.uk

Unsubscribing will not affect service-related communications (such as appointment reminders or billing).

12. Security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. Measures include:

• encryption of data in transit and at rest

• access controls and authentication on all systems

• separation of clinical records from lead data

• regular review of processor compliance and security practices

• staff training on data protection

No method of transmission over the internet is 100% secure, but we take reasonable steps to safeguard your information.

13. Children

Our services are not directed at children under 18. If a young person wishes to access therapy, we ask that a parent or guardian make the initial enquiry. We do not knowingly collect personal data from children via our website.

14. Changes to This Policy

We may update this policy from time to time to reflect changes in our services, legal requirements, or processor arrangements. The "Last updated" date at the top will always indicate when the policy was most recently revised. Material changes will be communicated to active clients by email.

15. Contact Us

If you have questions about this policy or how we handle your personal data:

Eunoia Health Ltd Rookfield Road, Horsham, West Sussex RH12 0AX Email: support@eunoiahealth.uk