Privacy Policy

Privacy Policy

At Soul Project, your privacy and the security of your personal data are our top priority. This Privacy Policy explains how we collect, use, store, and protect your information in accordance with UK GDPR, EU GDPR, and the Data Protection Act 2018.

Data We Collect
We may collect the following personal information:

Identification and contact details (name, email, phone number)

Information about your mental health, treatment needs, and therapy sessions

Records of correspondence and appointments

Any other information you voluntarily provide

Legal Basis for Processing
We process your data under the following lawful bases:

Consent – Where you voluntarily provide personal information for therapy and communication

Contractual necessity – To provide and manage your therapy sessions

Legal obligation – Where required by law (e.g., safeguarding, court orders)

Legitimate interests – For quality assurance, service improvement, and administrative purposes

How We Use Your Data
Your personal data is used solely to:

Deliver and manage CBT services

Communicate with you regarding appointments, updates, or resources

Ensure compliance with professional, ethical, and legal obligations

Conduct internal audits and service quality improvement

Data Storage and Security
We implement strict security measures to protect your personal information:

Data is stored on secure, encrypted servers within the UK or EU

Access is restricted to authorised staff only

Technical and organisational measures prevent unauthorised access, alteration, or disclosure

Data Retention and Deletion

Personal and therapy-related data is retained only for the duration of your treatment

After treatment is completed, your personal data is securely deleted or anonymised in accordance with professional and legal standards

Anonymised data may be retained for research or quality improvement, but it cannot identify you

Sharing Your Data
We do not sell or trade your personal data. Data may only be shared:

With third-party service providers under strict confidentiality agreements

When required by law, including safeguarding concerns or court orders

Your Rights
Under UK and EU GDPR, you have the right to:

Access your personal data (Subject Access Request)

Request correction of inaccurate information

Request deletion or restriction of processing once treatment is completed

Withdraw consent at any time (without affecting service provision already completed)

Object to data processing for legitimate interests or marketing

Receive your data in a portable format

To exercise your rights, please contact us using the details below.

International Data Transfers
Any personal data transferred outside the UK or EU is subject to appropriate safeguards, including standard contractual clauses or other approved mechanisms, to ensure GDPR-compliant protection.

Cookies and Website Tracking
We may use cookies to enhance website functionality and user experience. No personally identifiable information is collected without your consent. You can manage cookies via your browser settings.

Governing Law
This Privacy Policy is governed by the laws of England and Wales and, where applicable, by the European GDPR.