Privacy Policy
1. Who I am
I am Dr. Jacqueline Nonweiler, a sole trader based in the United Kingdom, trading under the names Dr. Jacqueline Nonweiler and Sanctuary Healing Centre. I am the data controller for the personal data described in this policy, which means I decide how and why it is used.
Contact: jackie@sanctuaryhealingcentre.com Correspondence address: Flat 15, Halesworth Court, 7 Alfred Street, London E3 2BE
This policy explains what personal data I collect about you, why, what I do with it, how long I keep it, and what rights you have. It forms part of my Terms and Conditions and applies to jacquelinenonweiler.com, jacquelinenonweiler.as.me, and to all sessions, classes, courses, memberships and digital products I provide.
2. Important context
I am a research psychologist and a certified practitioner within the Modern Mystery School lineage. I am not a clinician, and my practice is not a regulated healthcare service. The records I keep are therefore not NHS or clinical health records, they are not held under a statutory clinical records framework, and they are not accessible to or shared with the NHS. This is explained more fully in Sections 3 and 4 of my Terms and Conditions.
3. What personal data I collect
When you enquire or book: your name, email address, telephone number, the Service booked, appointment date and time, and anything you choose to write in a booking or intake form.
When you pay: the amount, date, currency and a transaction reference. I do not see or hold your full card number. Card data is captured and stored by my payment providers on their own secure systems. Where you have a membership, a recurring booking or a payment plan, your card details are held on file by those providers, under your authorisation, so scheduled payments can be taken.
When we work together: intake and consultation information, including what you tell me about your circumstances, relationships, wellbeing, history, goals and current support; and my own brief session notes.
When you contact me: the content of emails, messages, WhatsApp messages and voice notes, and my replies.
When you subscribe: your name, email address, subscription preferences, and engagement data from my email platform (such as whether an email was opened or a link clicked).
When you use the Website: IP address, device and browser type, pages visited, and referral source, collected through cookies and similar technologies. See Section 10.
If you give me a testimonial or take part in content: whatever you provide, and your written permission for its use.
4. Health and other sensitive information
4.1 In the course of working with me you may tell me things that count as special category data under the UK GDPR — most often information about your mental or physical health. You may also mention your religious or philosophical beliefs, your sexual orientation, or other sensitive matters.
4.2 You are never required to tell me any of this. You share what you choose to share.
4.3 Where I process special category data, I do so on the basis of your explicit consent (UK GDPR Article 9(2)(a)), which you give through my intake and consent process and which you may withdraw at any time. Where I need to process it to establish, exercise or defend a legal claim, I rely on Article 9(2)(f). Where there is a risk of serious harm, I may rely on Article 9(2)(c) — protecting someone's vital interests.
4.4 Withdrawing consent stops future processing. It does not undo processing already carried out lawfully, and it does not by itself require me to delete records I am entitled to retain under Section 7.
5. Why I process your data, and on what legal basis
| What for | Legal basis |
|---|---|
| Arranging, delivering and following up on sessions and courses | Performance of a contract with you |
| Taking payment, managing payment plans and chasing unpaid sums | Performance of a contract; legitimate interests (recovering sums owed) |
| Keeping session notes so I can work with you competently and consistently | Legitimate interests; explicit consent for any special category content |
| Keeping accounting and tax records | Legal obligation |
| Retaining records in case of a future complaint, dispute or claim | Legitimate interests; Article 9(2)(f) for special category content |
| Sending you marketing emails and my newsletter | Consent (you may withdraw it at any time) |
| Sending practical information about a Service you have booked | Performance of a contract |
| Running and improving the Website | Legitimate interests; consent for non-essential cookies |
| Responding to safeguarding or serious risk concerns | Vital interests; legal obligation |
Where I rely on legitimate interests, I have considered whether my interest is overridden by your rights, and I have concluded it is not. You may object at any time — see Section 8.
6. Who I share your data with
I do not sell your personal data, and I do not share it for anyone else's marketing.
I use the following service providers, who process data on my behalf under written terms:
- Squarespace — website hosting and forms
- Acuity Scheduling — bookings, appointment records and intake forms
- Stripe — payment processing
- Flodesk — email marketing and newsletters
- Zoom — online sessions
- WhatsApp (Meta) — messaging and, where you choose it, sessions
- Google Workspace — email, calendar and document storage
- Substack — my publication, where you subscribe to it
- My accountant / bookkeeper — financial records only
About WhatsApp: message content is end-to-end encrypted, but Meta processes metadata about your use of the service on its own account, as a separate controller under its own privacy policy. If you would prefer not to use WhatsApp, tell me and we will use another method.
I may also disclose your data where I am required to by law, court order or a regulator, or where I reasonably believe disclosure is necessary to prevent serious harm to you or to another person, as described in Section 11 of my Terms and Conditions.
Modern Mystery School does not receive your data. Where a session takes place at premises associated with the Modern Mystery School, that is a venue arrangement only. Your records are held by me, and MMS has no access to them.
7. How long I keep your data
| Record | Retention period |
|---|---|
| Session notes and intake records | 8 years from the date of our final session |
| Booking and appointment records | 7 years |
| Financial and transaction records | 7 years (HMRC requirement is 6 years from the end of the tax year) |
| Email and message correspondence | 7 years |
| Marketing subscriber data | Until you unsubscribe, then a suppression record only |
| Website analytics data | As set out in Section 10 |
At the end of the applicable period, records are securely deleted or destroyed.
8. Your rights
Under the UK GDPR you have the right to:
- be informed about how your data is used — this policy;
- access a copy of the data I hold about you;
- rectify data that is inaccurate or incomplete;
- erase your data in certain circumstances ("the right to be forgotten");
- restrict processing in certain circumstances;
- data portability — receive certain data in a machine-readable format;
- object to processing based on legitimate interests, and to direct marketing at any time;
- withdraw consent at any time where consent is the basis for processing.
These rights are not absolute. I may need to keep some records despite an erasure request — for example to meet a legal obligation, or to defend a potential legal claim. If that applies, I will tell you which records and why.
To exercise any right, email jackie@sanctuaryhealingcentre.com. I will respond within one month. There is no charge in ordinary circumstances.
If you are unhappy with how I have handled your data, please tell me first so I can put it right. You also have the right to complain to the Information Commissioner's Office: ico.org.uk, or 0303 123 1113.
9. Security and storage
9.1 I keep your data on password-protected, encrypted devices and accounts, with two-factor authentication enabled where the provider offers it. Session notes are stored separately from marketing and booking data, and paper notes, where any exist, are kept locked.
9.2 Your data is stored within the UK and the European Economic Area wherever possible. Some of my providers are based in, or transfer data to, the United States. Where that happens, transfers are made under the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another safeguard approved under UK data protection law.
9.3 No system is completely secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, I will notify the ICO within 72 hours and will tell you directly where the risk is high.
10. Cookies
10.1 The Website uses cookies and similar technologies. Essential cookies are needed for the site to work and are set without consent. Analytics and marketing cookies are set only if you accept them through the cookie banner.
10.2 You can change or withdraw your cookie choices at any time through the banner or your browser settings. Blocking essential cookies may stop parts of the site working.
10.3 The cookies used on this site fall into the following categories:
| Category | Purpose | Set without consent? |
|---|---|---|
| Strictly necessary | Security, page delivery, remembering your cookie choices, and keeping any checkout or form session working | Yes — the site cannot function without them |
| Analytics | Understanding how many people visit, which pages they read and how they arrived, so I can improve the site | No — only if you accept |
| Marketing | Measuring whether an advert or email link led to a visit or a booking | No — only if you accept |
A full, current list of the individual cookies set on this site, including their names and how long each one lasts, is available through the cookie settings link in the footer.
11. Children
My Services are for adults aged 18 and over. I do not knowingly collect data from anyone under 18. If you believe a child has provided me with personal data, contact me and I will delete it.
12. Changes to this policy
I may update this policy from time to time. The current version is always the one published on the Website. Where changes are significant and I hold your contact details, I will tell you.
13. Contact
Dr. Jacqueline Nonweiler Email: jackie@sanctuaryhealingcentre.com Website: jacquelinenonweiler.com Bookings: jacquelinenonweiler.as.me