Privacy Policy

Effective date: 15 March 2026
Business name: Angel Flow Holistic Therapy
Practitioner: Judit Vasne Budahazi
Address: New Ash Green (details private due to home address)
Email: privacy@angel-flow.co.uk
Telephone: +44 330 133 2280

1. Introduction

This Privacy Policy explains how I collect, use, store and protect your personal data when you:

  • Visit my website
  • Contact me by email, phone or WhatsApp
  • Book through my website booking flow or another booking channel
  • Complete an intake form
  • Book or attend a Functional Kinesiology session

I am committed to protecting your privacy and handling your data transparently and in accordance with UK data protection law.

2. Who I Am (Data Controller)

I am the data controller for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

If you have any questions about this policy or your personal data, or if you want to raise a privacy concern or complaint, please contact me using the existing contact details above.

3. What Information I Collect

Depending on how you interact with me, I may collect:

A. Identity and Contact Data

  • Full name
  • Address
  • Email address
  • Telephone number
  • Emergency contact details
  • Parent or guardian details and consent records where relevant

B. Health Information (Special Category Data)

  • Medical history
  • Symptoms
  • Lifestyle information
  • Medication details
  • Nutritional information
  • Session notes and muscle testing results

C. Website Data

  • Booking details, appointment history, and payment status
  • Contact form submissions
  • Basic technical data such as IP address, browser and device information, and security-related request data processed via hosting and website security providers
  • Spam and abuse prevention data processed through Cloudflare Turnstile when you submit the contact form
  • Booking and payment information processed through Square when you use the website booking flow or buy a gift card

D. Premises Security Footage

  • Images captured by an outdoor security camera covering the arrival area outside the practice premises
  • Footage may include clients or visitors approaching or arriving for appointments

E. Communication Records

  • Emails
  • WhatsApp messages
  • Appointment confirmations

4. Lawful Basis for Processing

Under UK GDPR, I rely on the following lawful bases:

For providing therapy services:

  • Article 6(1)(b) -- Contract (to provide the service you request)
  • Article 9(2)(h) -- Provision of health care (for processing health information)

For administrative purposes:

  • Article 6(1)(c) -- Legal obligation
  • Article 6(1)(f) -- Legitimate interests

For website enquiries:

  • Article 6(1)(a) -- Consent (where applicable)

For premises security:

  • Article 6(1)(f) -- Legitimate interests (to help protect clients, visitors, the practitioner, and the practice premises)

5. How I Use Your Information

Your information is used to:

  • Provide Functional Kinesiology sessions
  • Assess whether the service is suitable and record informed consent where needed
  • Maintain client records
  • Manage bookings and communicate regarding appointments
  • Process payments and gift card purchases
  • Help keep the practice premises, clients, visitors, and property safe through the use of an outdoor security camera
  • Meet legal and professional obligations
  • Respond to complaints, concerns, or safeguarding issues
  • Improve services

I do not sell your data or use it for automated decision-making.

6. How Your Information Is Stored

Your data may be stored:

  • On a password-protected computer
  • In encrypted cloud storage (if applicable)
  • Locally on the outdoor camera recording system, where security footage is stored only on local equipment and not in cloud storage
  • In locked filing cabinets (if paper records are kept)

Reasonable technical and organisational measures are in place to protect your data.

As this is a home-based practice, records may be securely stored at my practice address.

7. Data Sharing

Your information will not be shared with third parties unless:

  • Required by law
  • Necessary to protect your vital interests
  • Necessary for safeguarding reasons or to reduce a serious risk of harm
  • You provide explicit consent

Limited data may be shared with:

  • Booking and payment providers, including Square and any bank provider used
  • Website hosting and infrastructure providers
  • Website security and spam prevention providers, including Cloudflare Turnstile
  • Professional advisers (e.g., accountant)
  • Relevant authorities or safeguarding bodies where disclosure is required by law or necessary to protect someone from serious harm

These providers process data in accordance with data protection law.

8. Data Retention

Client records are typically retained for:

  • 7 years after your last appointment

Where the client is a child, records may be kept for longer where appropriate, including for 7 years after the child reaches age 18, in line with professional and insurance expectations.

This aligns with professional practice standards and insurance requirements.

Outdoor security camera footage is stored locally only and is automatically deleted after 30 days, unless it needs to be kept for longer to investigate an incident, protect someone from harm, or comply with a legal obligation.

After this period, data will be securely deleted or destroyed.

9. Your Rights

Under UK GDPR, you have the right to:

  • Access your personal data
  • Request correction of inaccurate data
  • Request erasure (where applicable)
  • Restrict processing
  • Object to processing
  • Data portability

You can exercise these rights by contacting me using the existing contact details listed at the top of this page.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO):
https://www.ico.org.uk

10. Website Analytics

This website uses Cloudflare Web Analytics to understand how visitors use the site and to help improve its content and performance. Cloudflare Web Analytics is privacy-first and does not use cookies or track visitors across different websites.

Analytics is enabled by default on the website. You can change this preference at any time; your choice is stored only in your browser and applies when you visit other pages on this website.

Website analytics

Allow privacy-first, cookie-free Cloudflare Web Analytics.

11. Website Cookies

This website does not currently use advertising cookies.

The website may use strictly necessary cookies and similar technologies provided by hosting, security, and anti-spam services to keep the site secure and functioning correctly. This includes Cloudflare cookies and Cloudflare Turnstile technologies used to protect the contact form and prevent spam or abusive submissions.

These cookies or similar technologies are used only for security and technical operation, not for personalised advertising.

If non-essential cookies are introduced in future, such as analytics cookies, this policy will be updated and consent will be requested where required by law before those cookies are used.

12. Changes to This Policy

This policy may be updated from time to time. The latest version will always be published on this website.