Privacy Policy

Carbon Sun respects your privacy and recognises the particular sensitivity of information shared in connection with psychotherapy and reflective practice. This policy explains what information is collected, why it is used, how it is protected and the rights available to you.

1. Who is responsible for your information?

Carbon Sun, operated by Chris Woodruff, is the data controller for personal information collected through this website and in the delivery of Carbon Sun services.

Contact: Chris Woodruff
Email: chriswoodruff@carbon-sun.com
Website: carbon-sun.com

2. Information that may be collected

Depending on how you engage with Carbon Sun, the following information may be collected:

• Identity and contact information, including your name, email address, telephone number, postal address and employer or professional role where relevant.
• Enquiry information, including information you provide through a contact form, email, telephone call or initial conversation.
• Appointment information, including the service selected, location, date, time, booking history, cancellations and attendance.
• Payment and transaction information. Card details are processed by the payment provider and are not stored directly by Carbon Sun.
• Therapeutic and reflective-practice information, including relevant background information, correspondence and confidential clinical notes. This may include health information and other special-category personal data.
• Organisational-service information, including professional contact details, contractual information and material relevant to an agreed organisational engagement.
• Technical information, such as IP address, browser type, device information and essential cookie data generated when you use the website.

Please avoid including detailed or highly sensitive clinical information in the website contact form. This can be discussed through an appropriate confidential channel.

3. How your information is obtained

Most information is provided directly by you when you make an enquiry, create an account, book or pay for an appointment, communicate with Carbon Sun or take part in a service. Information may also be provided by an organisation arranging or funding an engagement, where there is an appropriate basis to do so and the respective confidentiality arrangements have been explained.

4. Why information is used and the lawful bases

Personal information is used only where there is a lawful basis. Depending on the circumstances, this may include:

• Taking steps at your request and performing a contract — to respond to an enquiry, arrange and provide services, manage appointments and take payment.
• Legal obligation — to maintain appropriate financial, tax, safeguarding or regulatory records.
• Legitimate interests — to administer and protect the practice, maintain appropriate records, improve services and establish, exercise or defend legal claims, provided those interests do not override your rights.
• Consent — where consent is the appropriate basis, including for non-essential cookies or particular optional communications. Consent can be withdrawn at any time.

Therapeutic information may constitute special-category data. Where such information is processed, Carbon Sun identifies both an Article 6 lawful basis and an appropriate Article 9 condition under the UK GDPR. Depending on the circumstances, the relevant condition may include health or social care, explicit consent, substantial public interest in the provision of confidential counselling, or the establishment, exercise or defence of legal claims.

5. Confidentiality and sharing

Information shared in psychotherapy and reflective practice is treated as confidential. It will not normally be disclosed without your knowledge and, where appropriate, your consent.

Confidentiality is not absolute. Information may need to be disclosed where required by law, where there is a serious and immediate concern about safety, for safeguarding purposes, or for the establishment, exercise or defence of legal claims. Wherever it is safe and lawful to do so, this would normally be discussed with you first.

Professional supervision may be used to support safe and ethical practice. Client identity is protected as far as reasonably possible, and supervisors are bound by professional confidentiality.

Information may also be shared with carefully selected service providers acting on Carbon Sun’s instructions, but only to the extent necessary to provide and administer the service.

6. Service providers

Carbon Sun may use the following types of provider:

• LatePoint to manage appointment booking and the customer dashboard.
• Stripe to process secure card payments.
• Zoom to provide secure video appointments where selected.
• Google Calendar to support appointment scheduling and availability.
• Microsoft 365 for business email, calendar and document administration.
• Website hosting, security, backup and technical-support providers.
• Professional advisers, accountants, insurers or regulators where necessary.

These organisations process information under their own privacy terms or under contractual obligations requiring appropriate confidentiality and security.

7. International transfers

Some technology providers may process or store information outside the United Kingdom. Where this occurs, Carbon Sun takes reasonable steps to ensure that an appropriate legal safeguard is in place, such as UK adequacy regulations, the UK International Data Transfer Agreement or an approved UK addendum to standard contractual clauses.

8. How information is protected

Appropriate technical and organisational measures are used to protect personal information against accidental loss, unauthorised access, alteration or disclosure. These include access controls, password protection, secure systems, encrypted connections where available, appropriate backups and limiting access to those with a genuine need to know.

No internet or email system can be guaranteed to be completely secure. If you have concerns about sending sensitive information electronically, please make initial contact without including clinical detail.

9. How long information is retained

Information is retained only for as long as it is reasonably needed for the purpose for which it was collected and to meet professional, insurance, legal and financial obligations.

• Initial enquiries that do not proceed are normally retained for no longer than 12 months.
• Appointment, contractual and clinical records are normally retained for seven years after the work ends, unless a different period is justified by legal, safeguarding, insurance or professional considerations.
• Financial and transaction records are normally retained for six years after the end of the relevant financial period.
• Technical logs and cookie information are retained according to their operational purpose and the applicable cookie settings.

Information is securely deleted or anonymised when it is no longer required.

10. Your rights

Depending on the circumstances, you may have the right to:

• ask for access to your personal information;
• ask for inaccurate information to be corrected;
• ask for information to be erased;
• ask for processing to be restricted;
• object to processing based on legitimate interests;
• receive certain information in a portable format;
• withdraw consent where processing relies on consent; and
• complain to the Information Commissioner’s Office.

These rights are not absolute. For example, information may need to be retained where there is a legal, regulatory, safeguarding or professional reason to do so. To exercise a right, email chriswoodruff@carbon-sun.com. Reasonable evidence of identity may be requested.

11. Complaints

If you have a concern about how your information has been handled, please contact Carbon Sun first so that the matter can be considered.

You also have the right to complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or by telephoning 0303 123 1113.

12. Cookies and external links

The website uses essential cookies required for security, appointment booking and core operation. Non-essential analytics or marketing cookies should be used only in accordance with the choices made through the website’s cookie controls. Further information should be provided in the separate Cookie Policy.

The website may contain links to third-party websites. Carbon Sun is not responsible for the privacy practices or content of those external websites.

13. Changes to this policy

This policy may be updated to reflect changes in services, technology, professional practice or the law. The latest version will always be published on this page with its revision date.