Privacy Policy

1. Introduction

Kirin Tora Reiki — Celestial Tiger is a Usui Reiki healing and training practice based in Prestwich, Greater Manchester, operated by Louise Forrest, Usui Reiki Master Teacher.

I am committed to protecting your personal information and to being transparent about what data I collect, why I collect it, and how I use it. This Privacy Policy explains my practices in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Please read this policy carefully. By contacting me, booking a session, signing up to my newsletter, or using my website, you confirm that you have read and understood this policy.

2. Who I Am

Data Controller:

Louise Forrest
Trading as: Kirin Tora Reiki — Celestial Tiger
Location: Prestwich, Greater Manchester, United Kingdom
Data protection enquiries: privacy@kirintorareiki.com
General enquiries: hello@kirintorareiki.com
Telephone: +44 7557 019994
Website: kirintorareiki.com

If you have any questions about this policy or about how I handle your personal data, please contact me using the details above.

3. What Personal Data I Collect

3.1 Information you give me directly

• Your name, email address, and telephone number when you complete my contact or booking form, or when you contact me by telephone or in person.
• The nature of your enquiry or any details you provide about the services you are seeking.
• Health information you voluntarily share as part of a pre-treatment or pre-course consultation, which I treat as special category data under UK GDPR.
• Payment details: please note that I do not store payment card information; any card payments are processed by a third-party payment provider.
• Your email address if you sign up to my newsletter.

3.2 Information collected automatically

• When you visit my website, standard technical information may be collected by hosting or analytics services, including your IP address, browser type, pages visited, and the time and date of your visit.
• If you complete my contact form, Google reCAPTCHA is used to prevent automated abuse. Your use of reCAPTCHA is also subject to Google's Privacy Policy and Terms of Service.

3.3 Clients under 16

Where a client is under 16, I collect their personal and health data only with the written consent of a parent or guardian, who must be present throughout any session. Records for clients under 16 are retained as set out in section 9.

4. How I Use Your Personal Data

I use the personal data I collect for the following purposes:

• To respond to your enquiries and to arrange appointments, sessions or courses.
• To provide Reiki treatments and training services to you safely and appropriately, including conducting pre-treatment health consultations.
• To send you information about your appointment or course, including joining instructions and aftercare guidance.
• To send you my newsletter, where you have given your consent to receive it.
• To keep records of treatments or training undertaken, for continuity of care and professional purposes.
• To comply with any applicable legal obligations.

I will not use your data for any purpose other than those listed above, and I will never sell your personal data to any third party.

5. Legal Basis for Processing

Under UK GDPR, I rely on the following legal bases for processing your personal data:

• Contract: Processing is necessary to fulfil my service to you, for example to manage your appointment or course booking.
• Legitimate interests: For business administration, record-keeping, and responding to general enquiries.
• Consent: Where you have signed up to my newsletter, or where you have provided health information as part of a consultation. You may withdraw your consent at any time.
• Legal obligation: Where I am required to retain records by applicable law.

6. Special Category (Health) Data

If you share health information with me as part of a pre-treatment consultation, this is classified as special category data under UK GDPR and is given additional protection. I collect this data only where you have given your explicit consent and only to the extent necessary to ensure your treatment is safe and appropriate.

Health information is stored securely, shared only where strictly necessary (for example, if I need to refer you to another practitioner with your permission), and is never disclosed to third parties for marketing or commercial purposes.

7. Newsletter and Marketing

If you sign up to my newsletter, I will use your email address to send you occasional updates about courses, events, and Reiki insights. I will only contact you in this way where you have given your explicit consent.

You may unsubscribe from my newsletter at any time by clicking the unsubscribe link in any email I send, or by contacting me directly. Withdrawing consent will not affect the lawfulness of any processing carried out prior to your withdrawal.

8. Who I Share Your Data With

I do not sell or rent your personal data. I may share it only in the following limited circumstances:

• Service providers: I use third-party services to operate my website and accept bookings (for example, website hosting providers, email newsletter platforms, and payment processors). These providers are required to handle your data in accordance with UK GDPR.
• Google reCAPTCHA: My contact form is protected by Google reCAPTCHA. Data submitted through the form may be processed by Google in accordance with Google's own privacy policy.
• Legal requirements: I may disclose your data where required to do so by law, or to protect the rights, property or safety of Kirin Tora Reiki, my clients, or others.

Any third parties with whom I share data are required to keep it confidential and to use it only for the specific purpose for which it was shared.

9. How Long I Keep Your Data

I retain personal data only for as long as is necessary for the purposes for which it was collected, or as required by law:

• Client records and consultation notes are retained for eight years from the date of the last session, in line with the UK Reiki Federation Code of Ethics and Professional Practice.
• Where the client is a child, records are retained until their 25th birthday, or their 26th birthday if they were 17 when treatment ended.
• Enquiry data where no appointment or course was booked is retained for no longer than twelve months.
• Newsletter subscriber data is retained for as long as you remain subscribed. On unsubscribing, your data will be removed from my mailing list within 28 days.

When data is no longer required, it is securely deleted or anonymised.

10. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access: You may request a copy of the personal data I hold about you.
• Right to rectification: You may ask me to correct any inaccurate or incomplete data.
• Right to erasure: In certain circumstances, you may ask me to delete your data.
• Right to restriction: You may ask me to limit how I use your data while a concern is being resolved.
• Right to object: You may object to me processing your data based on legitimate interests.
• Right to data portability: Where processing is based on consent and is carried out by automated means, you may ask me to provide your data in a commonly used electronic format.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact me at the details given in Section 2. Data protection requests should be sent to privacy@kirintorareiki.com. I will respond to all requests within one calendar month. I may ask you to verify your identity before processing your request.

If you are not satisfied with how I have handled your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office · ico.org.uk · 0303 123 1113

11. Cookies and Website Analytics

My website may use cookies (small text files placed on your device) to enable certain functions and to help me understand how visitors use the site. These may include:

• Essential cookies: Required for the website to function (for example, form submission and security).
• Analytics cookies: Used to understand visitor behaviour in aggregate, so I can improve the site. Where analytics are used, no personally identifying information is collected without your knowledge.

Where required by law, I will ask for your consent before placing non-essential cookies. You may withdraw or manage your cookie preferences at any time through your browser settings.

12. Data Security

I take the security of your personal data seriously and take appropriate technical and organisational measures to protect it against unauthorised access, loss, or disclosure. These measures include paper records held in a locked cabinet, password-protected electronic files, and use of reputable third-party platforms with appropriate security credentials.

Whilst I take every reasonable precaution, no data transmission over the internet can be guaranteed as completely secure. If you have any concerns about the security of your data, please contact me immediately.

13. Links to Third-Party Websites

My website may contain links to external websites. This Privacy Policy applies only to Kirin Tora Reiki and my own website. I am not responsible for the privacy practices or content of any third-party sites, and I encourage you to read the privacy policies of any site you visit.

14. Changes to This Privacy Policy

I may update this Privacy Policy from time to time. Any changes will be posted on my website with a revised 'Last updated' date at the top of the page. I encourage you to review this policy periodically to remain informed about how I protect your data.

15. Questions and Contact

If you have any questions about this Privacy Policy, or wish to exercise any of your rights, please contact:

Louise Forrest

Kirin Tora Reiki — Celestial Tiger
privacy@kirintorareiki.com
Telephone: +44 7557 019994

I am happy to discuss any aspect of this policy with you and aim to respond to all queries within one working day.