Privacy Policy

1. Introduction

Kirin Tora Reiki — Celestial Tiger is a Usui Reiki healing and training practice based in Prestwich, Greater Manchester, operated by Louise Forrest, Usui Reiki Master Teacher.

We are committed to protecting your personal information and to being transparent about what data we collect, why we collect it, and how we use it. This Privacy Policy explains our practices in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Please read this policy carefully. By contacting us, booking a session, signing up to our newsletter, or using our website, you confirm that you have read and understood this policy.

2. Who We Are

Data Controller:

Louise Forrest
Trading as: Kirin Tora Reiki — Celestial Tiger
Address: 20 Mount Road, Manchester, M25 2QQ
Telephone: +44 75570 19994
Website: kirintoraReiki.co.uk

If you have any questions about this policy or about how we handle your personal data, please contact us using the details above.

3. What Personal Data We Collect

3.1 Information you give us directly

• Your name, email address, and telephone number when you complete our contact or booking form, or when you contact us by telephone or in person.
• The nature of your enquiry or any details you provide about the services you are seeking.
• Health information you voluntarily share as part of a pre-treatment or pre-course consultation, which we treat as special category data under UK GDPR.
• Payment details — please note that we do not store payment card information; any card payments are processed by a third-party payment provider.
• Your email address if you sign up to our newsletter.

3.2 Information collected automatically

• When you visit our website, standard technical information may be collected by hosting or analytics services, including your IP address, browser type, pages visited, and the time and date of your visit.
• If you complete our contact form, Google reCAPTCHA is used to prevent automated abuse. Your use of reCAPTCHA is also subject to Google's Privacy Policy and Terms of Service.

3.3 Information we do not collect

We do not knowingly collect personal data from children under the age of 16 without the consent of a parent or guardian. We do not collect sensitive data beyond the health information described above, and we do not engage in any form of automated profiling or decision-making.

4. How We Use Your Personal Data

We use the personal data we collect for the following purposes:

• To respond to your enquiries and to arrange appointments, sessions or courses.
• To provide Reiki treatments and training services to you safely and appropriately, including conducting pre-treatment health consultations.
• To send you information about your appointment or course, including joining instructions and aftercare guidance.
• To send you our newsletter, where you have given your consent to receive it.
• To keep records of treatments or training undertaken, for continuity of care and professional purposes.
• To comply with any applicable legal obligations.

We will not use your data for any purpose other than those listed above, and we will never sell your personal data to any third party.

5. Legal Basis for Processing

Under UK GDPR, we rely on the following legal bases for processing your personal data:

• Contract: Processing is necessary to fulfil our service to you — for example, to manage your appointment or course booking.
• Legitimate interests: For business administration, record-keeping, and responding to general enquiries.
• Consent: Where you have signed up to our newsletter, or where you have provided health information as part of a consultation. You may withdraw your consent at any time.
• Legal obligation: Where we are required to retain records by applicable law.

6. Special Category (Health) Data

If you share health information with us as part of a pre-treatment consultation, this is classified as special category data under UK GDPR and is given additional protection. We collect this data only where you have given your explicit consent and only to the extent necessary to ensure your treatment is safe and appropriate.

Health information is stored securely, shared only where strictly necessary (for example, if we need to refer you to another practitioner with your permission), and is never disclosed to third parties for marketing or commercial purposes.

7. Newsletter and Marketing

If you sign up to our newsletter, we will use your email address to send you occasional updates about courses, events, and Reiki insights. We will only contact you in this way where you have given your explicit consent.

You may unsubscribe from our newsletter at any time by clicking the unsubscribe link in any email we send, or by contacting us directly. Withdrawing consent will not affect the lawfulness of any processing carried out prior to your withdrawal.

8. Who We Share Your Data With

We do not sell or rent your personal data. We may share it only in the following limited circumstances:

• Service providers: We use third-party services to operate our website and accept bookings (for example, website hosting providers, email newsletter platforms, and payment processors). These providers are required to handle your data in accordance with UK GDPR.
• Google reCAPTCHA: Our contact form is protected by Google reCAPTCHA. Data submitted through the form may be processed by Google in accordance with Google's own privacy policy.
• Legal requirements: We may disclose your data where required to do so by law, or to protect the rights, property or safety of Kirin Tora Reiki, our clients, or others.

Any third parties with whom we share data are required to keep it confidential and to use it only for the specific purpose for which it was shared.

9. How Long We Keep Your Data

We retain personal data only for as long as is necessary for the purposes for which it was collected, or as required by law:

• Client records and consultation notes are retained for a minimum of seven years following the conclusion of treatment, in line with standard complementary therapy practice guidance.
• Enquiry data where no appointment or course was booked is retained for no longer than twelve months.
• Newsletter subscriber data is retained for as long as you remain subscribed. On unsubscribing, your data will be removed from our mailing list within 28 days.

When data is no longer required, it is securely deleted or anonymised.

10. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access: You may request a copy of the personal data we hold about you.
• Right to rectification: You may ask us to correct any inaccurate or incomplete data.
• Right to erasure: In certain circumstances, you may ask us to delete your data.
• Right to restriction: You may ask us to limit how we use your data while a concern is being resolved.
• Right to object: You may object to us processing your data based on legitimate interests.
• Right to data portability: Where processing is based on consent and is carried out by automated means, you may ask us to provide your data in a commonly used electronic format.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at the details given in Section 2. We will respond to all requests within one calendar month. We may ask you to verify your identity before processing your request.

If you are not satisfied with how we have handled your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office · ico.org.uk · 0303 123 1113

11. Cookies and Website Analytics

Our website may use cookies — small text files placed on your device — to enable certain functions and to help us understand how visitors use the site. These may include:

• Essential cookies: Required for the website to function (for example, form submission and security).
• Analytics cookies: Used to understand visitor behaviour in aggregate, so we can improve the site. Where analytics are used, no personally identifying information is collected without your knowledge.

Where required by law, we will ask for your consent before placing non-essential cookies. You may withdraw or manage your cookie preferences at any time through your browser settings.

12. Data Security

We take the security of your personal data seriously and take appropriate technical and organisational measures to protect it against unauthorised access, loss, or disclosure. These measures include secure storage of paper records, password-protected electronic files, and use of reputable third-party platforms with appropriate security credentials.

Whilst we take every reasonable precaution, no data transmission over the internet can be guaranteed as completely secure. If you have any concerns about the security of your data, please contact us immediately.

13. Links to Third-Party Websites

Our website may contain links to external websites. This Privacy Policy applies only to Kirin Tora Reiki and our own website. We are not responsible for the privacy practices or content of any third-party sites, and we encourage you to read the privacy policies of any site you visit.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Any changes will be posted on our website with a revised 'Last updated' date at the top of the page. We encourage you to review this policy periodically to remain informed about how we protect your data.

15. Questions and Contact

If you have any questions about this Privacy Policy, or wish to exercise any of your rights, please contact:

Louise Forrest

Kirin Tora Reiki — Celestial Tiger
20 Mount Road, Manchester, M25 2QQ
Telephone: +44 75570 19994

We are happy to discuss any aspect of this policy with you and aim to respond to all queries within one working day.