Privacy Policy
Last updated: 29 June 2026Introduction
Welcome to the privacy policy for Teresa Johnston Counselling. Teresa Johnston Counselling is operated by Teresa Johnston and is available online through the website sunriseholistic.co.uk. We respect your privacy and are committed to handling your personal information carefully, respectfully and securely. This privacy policy explains how we collect, use, store and share your personal information when you visit our website, contact us, book an appointment, receive counselling or mindfulness services, subscribe to our newsletter, or purchase an online course or digital product. It also explains your rights under UK data protection law and how to contact us if you have questions or concerns about how we use your information. Our counselling services, online courses and website are intended for adults aged 18 and over. We do not knowingly collect personal information from anyone under the age of 18.Important information and who we are
Who is responsible for your personal information?
Teresa Johnston, trading as Teresa Johnston Counselling, is the controller responsible for your personal information. In this privacy policy, “we”, “us” and “our” refer to Teresa Johnston Counselling.Contact details
If you have any questions about this privacy policy, our privacy practices or your rights, please contact us using the details below:- Name: Teresa Johnston Counselling
- Email: hello@sunriseholistic.co.uk
- Telephone: 01324 503771
- Postal address: Callendar House, Callendar Road, Falkirk, FK1 1YR
Data protection registration
Teresa Johnston Counselling is registered with the Information Commissioner’s Office as a data controller. ICO registration number: ZB747272 You can check this entry on the Information Commissioner’s Office public register.Data protection complaints
If you have concerns about how we handle your personal information, please contact us first at hello@sunriseholistic.co.uk. We will acknowledge your complaint within 30 days, investigate it without undue delay, keep you informed of progress where appropriate, and tell you the outcome. You also have the right to make a complaint at any time to the Information Commissioner’s Office, the UK supervisory authority for data protection matters. You can find further information or make a complaint through the Information Commissioner’s Office website.Keeping your information accurate
Please let us know if your personal information changes while you are receiving services from us or have an active customer relationship with us.Third-party websites
Our website may contain links to third-party websites, services or platforms, including Counselling Directory, TidyCal, Payhip and social media platforms. We do not control these third parties and are not responsible for their privacy practices. Please read their privacy notices before providing them with personal information.The personal information we collect
Personal information means information that identifies you or could reasonably be used to identify you. We may collect, use, store and share the following types of information.Identity and contact information
This may include your name, email address, telephone number, postal address and any other contact details you choose to provide.Enquiry, booking and communication information
This may include the contents of your enquiry, appointment preferences, booking information, correspondence with us and information you provide when requesting a free introductory call, counselling session or other service.Counselling and wellbeing information
If you become a counselling client, we may collect information needed to provide counselling safely and appropriately. This may include information about your wellbeing, health, life circumstances, relationships, goals, safeguarding concerns, risks, session notes and relevant communications. Some information you provide may be special-category personal data. This includes information about your physical or mental health, racial or ethnic origin, religious or philosophical beliefs, sexual orientation, or other sensitive information you choose to share with us. Please avoid including detailed health or other sensitive information in an initial website enquiry unless it is necessary.AI-assisted note information
Where you have separately agreed to the use of Heidi, an AI-enabled note-support tool, we may process spoken content from a counselling session to help prepare a draft written note. The tool may create a draft transcript, summary or note from the session content. Teresa Johnston reviews any output and remains responsible for the final clinical record. Artificial intelligence is not used to diagnose you, assess you, make decisions about you or determine the care or support provided to you. You can choose not to use Heidi, or withdraw your agreement to its use, at any time. If you do, ordinary manual note-taking will be used instead. Choosing not to use the tool will not prevent you from receiving counselling.Course, customer and transaction information
If you buy an online course, digital product or other item through Payhip, we may receive or process information including your name, email address, order details, course enrolment and access information, customer-service communications, refunds and limited transaction information. We do not receive or store your full payment-card details. Payments are processed by Payhip and the payment provider available at checkout.Marketing information
This may include your preferences for receiving newsletters, updates, course information and offers, together with records of your consent, objections or unsubscribe requests.Technical and website-use information
When you use our website, we may collect technical information such as your IP address, browser type, device type, operating system, approximate location, pages visited, referral source and information collected through cookies or similar technologies.How we collect your personal information
Information you provide directly
You may provide personal information when you:- complete our website contact form;
- contact us by email, telephone, text message or another agreed method;
- book an appointment through TidyCal;
- attend counselling, mindfulness or related services;
- agree to the use of Heidi during a counselling session;
- subscribe to our newsletter;
- purchase or access an online course or digital product through Payhip; or
- provide feedback, make a complaint or ask a question.
Information from third parties
We may receive limited information from TidyCal when you make a booking, Payhip and its payment providers when you purchase a course or digital product, and Counselling Directory when you contact us through its platform. We may also receive information from another person or organisation where you have asked them to contact us on your behalf, or where you have authorised a referral or sharing of information.Information collected automatically
As you use our website, we may collect technical and usage information through cookies, server logs and similar technologies. Please see our Cookie Policy for further information.How we use your personal information
We will only use your personal information where the law allows us to do so.To respond to enquiries and arrange appointments
We use your name, contact details and enquiry information to respond to you, arrange introductory calls and appointments, and take steps at your request before entering into a counselling agreement. Our lawful basis is taking steps at your request before entering into a contract and, where appropriate, our legitimate interests in responding to enquiries and managing our practice.To provide counselling and mindfulness services
We use relevant personal information to provide counselling safely and effectively, manage appointments, communicate with you, maintain appropriate records, handle payments and meet professional and ethical responsibilities. Our lawful basis is performance of a contract and our legitimate interests in running a safe and professional counselling practice. Where we process special-category personal data, we will use an appropriate additional condition under data protection law. This will normally include your explicit consent where required. We will explain the counselling consent process separately when you begin counselling. You may withdraw consent at any time, although this may mean that we are unable to continue to provide some or all of the service safely or appropriately.To use Heidi for AI-assisted note support
We use Heidi only where you have separately and explicitly agreed to its use. The purpose is to help Teresa Johnston prepare a draft written note so that she can focus more fully on the counselling session rather than taking extensive notes while you are speaking. Our lawful basis for using Heidi is your consent. Where special-category personal data is processed, we rely on your explicit consent. We will not use Heidi to make automated decisions about you. Teresa Johnston reviews any draft output, decides what is appropriate to retain as part of the clinical record and remains responsible for all professional judgement.To protect you or others and meet legal obligations
We may use or share relevant information where necessary to protect you or someone else from serious harm, respond to safeguarding concerns, comply with a legal obligation, respond to a court order, establish or defend legal claims, or meet professional and regulatory responsibilities. We will only share information in these circumstances where this is necessary and proportionate.To process online-course and digital-product purchases
We use customer, transaction and course-access information to provide the course or product you have purchased, manage access, respond to customer-service requests, process refunds where appropriate, prevent fraud and maintain financial records. Our lawful basis is performance of a contract, compliance with legal obligations and our legitimate interests in operating and protecting our business.To send service communications
We may send essential messages needed to provide our services, confirm bookings, administer course access, respond to enquiries, notify you about important changes or manage our relationship with you. You cannot opt out of essential service communications while you have an active booking, counselling relationship, course account or customer relationship with us.To send marketing communications
We may send newsletters, updates, course information and offers by email where you have actively chosen to receive them. We use Mailchimp to manage and send newsletter communications. We will not add you to our marketing list simply because you contact us, book an appointment or purchase a course unless you have clearly agreed to receive marketing communications. You can unsubscribe at any time by using the unsubscribe link in any marketing email or by contacting us at hello@sunriseholistic.co.uk.To improve and protect our website and services
We may use technical and website-use information to maintain website security, prevent misuse, resolve technical problems and understand how visitors use our website. Where Google Analytics or similar non-essential analytics tools are used, we will only collect analytics information after you have given consent through our cookie banner.Marketing choices
We will not sell your personal information or share it with third parties for their own direct-marketing purposes. You can withdraw consent to marketing or object to direct marketing at any time. We may keep a limited record of your objection so that we can ensure we do not contact you with marketing in future.How we share your personal information
We may share personal information with trusted third parties where necessary to provide our services, run our practice, meet legal obligations or protect people from serious harm. These third parties may include:- website-hosting, website-support, email, cloud-storage and IT-security providers;
- Elementor, which provides website form and website-functionality services;
- TidyCal, which provides online booking services;
- Mailchimp, which provides newsletter and email-marketing services;
- Payhip and payment providers used at checkout, which provide online course, digital-product and payment services;
- Google Analytics or other analytics providers, but only where you have accepted non-essential analytics cookies;
- video-conferencing providers, such as Microsoft Teams or Zoom, where an online session has been agreed;
- Heidi Health, which provides AI-enabled note-support services where you have explicitly agreed to its use;
- professional supervisors, normally using anonymised or pseudonymised information wherever possible;
- accountants, insurers, legal advisers and other professional advisers where required;
- emergency services, safeguarding bodies, regulators, professional bodies, law-enforcement agencies or other authorities where required by law or necessary to protect someone from serious harm; and
- another practitioner or appropriate professional where necessary to ensure continuity of care and where appropriate.
International transfers and clients outside the United Kingdom
We may provide counselling or other services to clients who are based outside the United Kingdom. Your location does not change our commitment to handling your information in accordance with this privacy policy and applicable UK data protection law. Some of our service providers may process personal information outside the United Kingdom. This can happen where a provider uses overseas servers, support teams or cloud infrastructure. Where we transfer personal information outside the United Kingdom, we will use appropriate safeguards required by law. These may include an adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to standard contractual clauses or another lawful transfer mechanism. Heidi states that, for customers located in the United Kingdom, data is stored in the United Kingdom and processed within the United Kingdom or European Economic Area. If you are based outside the United Kingdom, your country may give you additional mandatory privacy rights. Nothing in this policy is intended to limit rights that apply to you under mandatory local law. You can contact us for more information about the safeguards used for a particular transfer.Data security
We take appropriate technical and organisational measures to protect personal information from accidental loss, unauthorised access, misuse, alteration or disclosure. Access to counselling and client information is restricted to those who genuinely need it. We use reasonable safeguards to protect information stored electronically and in paper form. Where Heidi is used, the information is processed through the provider’s secure platform. Heidi states that it uses encryption and access controls, and that patient data is not used to train, develop or improve its AI models. Please take care when sending personal information electronically. Email and website forms may not be suitable for detailed or highly sensitive information. We do not make or retain audio or video recordings of counselling sessions as part of the clinical record unless this has been discussed with you in advance and you have given explicit consent. Where you agree to use Heidi, spoken session content may be processed to create a draft note, which Teresa Johnston reviews before deciding what should be retained as part of the clinical record.Personal data breaches
A personal data breach is a security incident that leads to the accidental or unlawful loss, destruction, alteration, unauthorised disclosure of, or access to, personal information. We have procedures in place to detect, assess, investigate and respond to personal data breaches. If a personal data breach occurs, we will assess the likely risk to the people affected. Where the law requires it, we will report the breach to the Information Commissioner’s Office without undue delay and, where feasible, within 72 hours of becoming aware of it. Where a breach is likely to result in a high risk to your rights and freedoms, we will also tell you without undue delay. We will explain what has happened, the likely consequences and any steps you can take to protect yourself.How long we keep your personal information
We keep personal information only for as long as necessary for the purposes described in this policy, including legal, accounting, insurance, professional and reporting requirements.- Website enquiries that do not lead to counselling or another service: up to 12 months after our last communication.
- Counselling client records, including relevant communications and session notes: seven years after the final session.
- Booking and appointment administration records: seven years after the final appointment, where they relate to counselling services.
- AI-assisted draft notes and temporary processing information: only for as long as necessary to prepare, review and finalise the appropriate clinical record, subject to the settings and contractual arrangements in place with the provider.
- Online-course customer, payment and transaction records: six years after the end of the financial year in which the transaction took place.
- Course-access information: for as long as your course account remains active and for a reasonable period afterwards where necessary for customer support, fraud prevention or legal purposes.
- Newsletter information: until you unsubscribe or we decide that the newsletter is no longer active.
- Marketing suppression records: for as long as necessary to ensure we honour your request not to receive marketing.
- Analytics information: up to 14 months where Google Analytics is used and you have accepted analytics cookies.
Your legal rights
Under data protection law, you may have the right to:- request access to your personal information;
- request correction of inaccurate or incomplete information;
- request deletion of your personal information;
- request restriction of how your information is used;
- object to processing based on legitimate interests;
- object at any time to direct marketing;
- request transfer of certain information to you or another organisation;
- withdraw consent where we rely on consent; and
- make a complaint to the Information Commissioner’s Office.
Your right to object
You have the right to object at any time to the use of your personal information for direct marketing. You may also object to processing based on our legitimate interests where you have grounds relating to your particular situation. To exercise any of your rights, please contact us at hello@sunriseholistic.co.uk. We may need to ask for information to confirm your identity before acting on a request. We will normally respond within one month. There is usually no fee, although we may charge a reasonable fee or refuse a request where the law allows us to do so, for example where a request is manifestly unfounded or excessive. Some rights are not absolute. For example, we may need to retain certain counselling, financial or legal records, or may be unable to disclose information where doing so would affect another person’s rights or cause serious harm.Automated decision-making and artificial intelligence
We do not make decisions about you solely through automated processing that would have legal or similarly significant effects on you. We do not use artificial intelligence to diagnose you, assess your suitability for counselling, make clinical decisions, determine the support we provide or replace Teresa Johnston’s professional judgement. Where you have explicitly agreed to the use of Heidi, it is used only to support the preparation of notes. Teresa Johnston reviews all output and decides what, if anything, is retained as part of the clinical record. Heidi states that patient data is not used to train, develop or improve its AI models. We will keep our use of AI-enabled tools under review and will update this privacy policy if there is a material change to how your information is processed.Cookies and similar technologies
Cookies are small text files placed on your device when you visit a website. They can help a website function securely, remember preferences and understand how visitors use it. We use strictly necessary cookies to operate and protect our website. We will ask for your consent before placing non-essential cookies, including analytics cookies.You can change or withdraw your consent to non-essential cookies at any time by selecting the CookieYes icon displayed in the bottom-left corner of our website. This will reopen the CookieYes consent panel, where you can update your choices. This will reopen the CookieYes consent panel, where you can update your choices. You can also manage cookies through your browser settings, although blocking some cookies may affect the way the website works.
Please see our separate Cookie Policy for more detailed information about the cookies we use.