A note on care
Your privacy and confidentiality matter to me. I collect only the information I reasonably need, handle it with care and aim to be clear about how it is used.
Between Breaths is a website created and operated by Steve Hartley. I, Steve Hartley, am responsible for the personal information described in this notice.
If you have any questions or requests concerning your information, you can contact me at:
Information I may collect
Depending on how you use the website and whether we work together, I may collect:
- Your name and contact details
- Information you include in a website enquiry or correspondence
- Your preferences for arranging sessions
- An optional emergency contact
- Information about what brings you to me and what you hope may change
- Information you choose to share about your health, wellbeing, safety or circumstances
- Brief notes supporting continuity, reflection and safe practice
- Booking, attendance, access or participation information relating to training, workshops or group activities
- Administrative and payment records
- Technical information used to operate and protect the website, such as your IP address, browser information and security-check results
I aim to collect only what is relevant and proportionate.
If you provide someone else’s details as an emergency contact, please make sure they know you have done so.
Why I use information
I may use personal information to:
- Respond to an enquiry
- Arrange and provide individual sessions, training, workshops, groups or other agreed support
- Maintain appropriate continuity and boundaries
- Communicate about practical arrangements
- Manage bookings, attendance and access or participation needs
- Keep necessary administrative and financial records
- Protect the website and contact form from spam, misuse and security threats
- Meet legal or safeguarding responsibilities where applicable
The lawful bases I generally rely upon are:
- Taking steps at your request before entering into an agreement
- Fulfilling an agreement with you
- Complying with legal obligations
- My legitimate interests in running a safe, secure and responsible practice
Where I need to use health information or other sensitive personal information, I will normally rely on your explicit consent. In exceptional circumstances, another legal condition may apply—for example, where processing is necessary to protect someone’s vital interests or meet a legal responsibility.
You may withdraw consent at any time. This will not affect processing that took place before consent was withdrawn, although it may affect whether I can continue working with you safely and appropriately.
Confidentiality and its limits
What you share with me is treated as confidential.
Very occasionally, responsible and safe practice—or a legal or safeguarding responsibility—may require me to act if I have reasonable grounds to believe there is a serious risk to your safety or someone else’s. This may include sharing relevant information with an appropriate person or service.
Wherever it is safe and lawful to do so, I would normally tell you first and discuss the action I believe needs to be taken. There may be rare circumstances in which this is not possible, particularly if doing so could increase the risk or prevent necessary protective action.
Any information shared would be limited to what is necessary in the circumstances.
Working with people under 18
If I agree to work with someone under 18, I may also collect contact or consent information relating to a parent or guardian where appropriate.
Before the work begins, I will explain—as clearly as possible and in a way appropriate to the young person’s age and understanding—how their information will be used, how confidentiality will work, what may be shared with a parent or guardian and the circumstances in which safeguarding or legal responsibilities may require me to act.
Training, workshops and group activities
When you book or take part in training, a workshop, circle, group meditation or another group activity, I may collect the information needed to arrange and safely provide that activity. This may include booking and attendance details, payment information and any access, dietary, health or safety information you choose to provide.
If an organisation arranges the activity, it may provide me with your name or contact details and may receive confirmation of your attendance or completion. I will not normally disclose what you say or contribute during the activity without your agreement, except where a legal or safeguarding responsibility applies.
Participants will be encouraged to respect one another’s privacy. However, I cannot guarantee that another participant will keep confidential what is shared within a group. You are therefore encouraged to share only what feels appropriate and safe for you.
Online activities may use an online-meeting platform such as Zoom. The platform will process the limited information needed to provide the service.
I do not record individual or group sessions unless this has been discussed and agreed in advance, with clear information about why the recording is being made, how it will be used, who will have access to it and how long it will be retained.
How information is protected
Session notes and confidential working files are stored locally in an encrypted digital vault. They are not synchronised with general cloud-storage services.
Access is limited to me. The vault is opened only when needed and closed when not in use. Encrypted backups are stored separately on a hardware-encrypted USB device.
I do not use email or messaging apps to record session notes. Please avoid sending sensitive personal information through ordinary email or messaging services.
Information sent through the website or by email necessarily passes through the relevant hosting, email and security services.
Website, email and security providers
I use Hostinger, CleanTalk and Cloudflare to operate and protect the website. Hostinger provides the website hosting and email service. CleanTalk checks contact-form submissions and website activity for spam and security threats. Cloudflare Turnstile helps confirm that a contact-form submission is being made by a person rather than an automated bot.
These services process limited technical information needed to perform those functions. I do not routinely download or retain separate copies of their security records. Cloudflare states that Turnstile does not access, store or transmit information entered into the contact form. CleanTalk states that it retains collected information for up to 45 days, depending on the service plan.
Further information is available in the privacy policies published by Hostinger, CleanTalk and Cloudflare.
Where we agree to meet online or you make a payment, the online-meeting platform, telephone provider, bank or payment service involved will necessarily process the limited information needed to provide that service.
I never sell, rent or trade personal information. I share it only where necessary to provide an agreed service, operate and protect the website, or meet a legal or safeguarding responsibility, as described in this notice.
The providers identified above may process limited information outside the United Kingdom. Their privacy policies explain the safeguards used when this happens.
Cookies and similar technologies
The website uses cookies or similar technologies needed for its operation, security and spam prevention.
I do not currently use Google Analytics. If non-essential analytics or similar tracking is introduced, this notice will be updated and consent will be requested where required.
How long information is kept
I keep personal information only for as long as it remains reasonably necessary and review what I hold periodically.
- Enquiries that do not lead to us working together are normally deleted six months after our last contact
- Adult client intake information and brief session notes are normally retained for six years after our work ends
- Records relating to work with someone under 18 are normally retained until six years after their 18th birthday, or six years after our work ends if later
- Workshop, training and group booking or attendance records are normally retained for 12 months after the activity, unless they form part of a contractual, financial or safeguarding record that needs to be kept for longer
- Information collected specifically about access, dietary or participation needs is deleted after the activity unless it remains necessary for an ongoing programme or in relation to an incident
- Financial records are retained for the period required by law
Information may sometimes need to be retained for longer where a legal or safeguarding responsibility requires it. When information is no longer required, it is securely deleted or destroyed.
Your rights
Depending on the circumstances, you may have the right to:
- Ask what personal information I hold about you
- Request a copy of that information
- Ask for inaccurate information to be corrected
- Request deletion where the right applies
- Ask me to restrict how information is used
- Object to certain uses of your information
- Request transfer of information where the right applies
- Withdraw consent where processing is based on consent
Some rights are not absolute, and legal or safeguarding responsibilities may affect what can be deleted or disclosed.
Please contact me if you wish to exercise any of these rights. I will respond as promptly as possible and within the timescale required by data-protection law.
If you remain concerned, you also have the right to raise the matter with the Information Commissioner’s Office at ico.org.uk.
ICO registration
I am registered with the Information Commissioner’s Office.
ICO registration reference: ZC064156
Scope of my work
My work supports health and wellbeing, recovery and prevention, alongside personal and professional development.
I am not a doctor, psychologist, psychiatrist or other medical or psychiatric professional. I do not provide or advise on:
- Medical assessment or diagnosis
- Psychiatric assessment or diagnosis
- Prescribing medication, or beginning, changing or stopping prescribed medication
- Emergency or crisis services
If something falls outside my scope, I will say so and may suggest seeking appropriate professional support.
Contact
If you have questions about privacy, confidentiality, the information I hold or how I work, please contact me directly:
Last reviewed: September 2026