Privacy and Data Protection Policy

Privacy and Data Protection Policy

Quantum Buddha  ·  Owner: Virr-Krishan Haria  ·  Version 1.0

Effective from: 21 October 2026  ·  Next review: October 2027

1. About this policy

Quantum Buddha (“I”, “me”, “my”) is a trauma-informed coaching practice run by Virr-Krishan Haria, a Certified Trauma Healing Coach. I offer coaching and nervous-system support sessions, mainly online, to clients in the UK and worldwide.

This policy explains what personal information I collect, why I collect it, how I keep it safe, who I share it with, how long I keep it, and the rights you have. I follow the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Where I work with clients in the EU, I also aim to meet the EU GDPR.

2. Who is responsible for your data

I am the “data controller” for the personal information described in this policy.

• Business name: Quantum Buddha (sole trader: Virr-Krishan Haria)
• Address: Flat 16, 4 Arneil Drive, Edinburgh, EH5 2GR
• Email: help@quantumbuddha.co.uk
• Website:co.uk
• ICO registration number: ZC281022

3. What information I collect

INFORMATION YOU GIVE ME

• Contact details: your name, email address, phone number and, where needed, postal address.
• Booking details: the date and time of sessions and any answers you give on booking forms (for example via Calendly).
• Payment details: what you bought, invoices and payment status. I do not see or store your full card details; these are handled by my payment provider.
• Session information: notes about what we discuss, your goals, your progress, and anything you choose to share about your emotional wellbeing, life events or health. Some of this is “special category” data under UK GDPR, so I treat it with extra care.
• Session recordings: audio and video recordings of our sessions, and any transcripts made from them, if you consent to recording.
• Emergency contact details, if you choose to give them, for use only in the situations described in my Health and Safety Policy.
• Messages you send me by email, social media direct message or other channels.
• Answers you give to my Stress Pattern quiz or other forms on my website.

INFORMATION COLLECTED AUTOMATICALLY

• When you visit quantumbuddha.co.uk, basic technical data (such as IP address, browser type and pages visited) may be collected through cookies and similar tools. See section 10.
• When you open my emails, my email provider may record opens and link clicks so I can understand what is useful.

4. Why I use your information, and my lawful basis

PROVIDING COACHING SESSIONS

To book, deliver and follow up your sessions, keep session notes and contact you about your appointments. Lawful basis: contract (to provide the service you asked for).

SESSION NOTES CONTAINING WELLBEING OR HEALTH INFORMATION

To provide safe, trauma-informed support that fits your needs. Lawful basis: contract, and for special category data, your explicit consent (UK GDPR Article 9(2)(a)). I ask for this consent in my client agreement or intake form, and you can withdraw it at any time. If you withdraw it, I may not be able to continue working with you safely.

PAYMENTS, INVOICING AND ACCOUNTS

To take payment, issue invoices and keep financial records. Lawful basis: contract and legal obligation (HMRC requires me to keep financial records).

NEWSLETTERS AND MARKETING EMAILS

To send you my newsletter, offers and content. Lawful basis: consent. You can unsubscribe at any time using the link in every email.

RUNNING AND IMPROVING MY BUSINESS

To answer enquiries, keep my records accurate, improve my website and services, and protect my business in the event of a complaint or claim. Lawful basis: legitimate interests, balanced against your rights.

SAFETY AND SAFEGUARDING

To act if I believe you or someone else is at serious risk of harm (see section 7). Lawful basis: vital interests and, where relevant, legal obligation.

5. Who I share your information with

I never sell your personal information. I share it only with trusted service providers (“processors”) who help me run my business, and only as much as they need. Each one is bound by contract and data protection law.

• Calendly (appointment booking). Based in the USA.
• HubSpot (client relationship management: contact details and enquiry history). Based in the USA, with EU data hosting available.
• MailerLite (newsletter and email marketing). Based in the EU.
• Google Workspace (email, calendar, secure document storage including session notes). Based in the USA.
• WordPress website hosted by Namecheap (website, forms and quiz). Servers based in the UK.
• Xero (invoicing and accounts). Based in New Zealand, with data stored in the USA.
• Stripe and PayPal (taking payments, including Apple Pay and Google Pay). Based in the USA, with EU and UK entities.
• Zoom, Google Meet, WhatsApp and Meta (Messenger or Instagram) video calls (online sessions, using whichever you prefer).
• Fathom (AI note-taker that records, transcribes and summarises our video calls, if you consent to recording). Based in the USA.
• Anthropic (Claude) (AI assistant I may use to help transcribe, summarise and organise session notes and recordings). Based in the USA. I use it with settings that stop my data being used to train AI models, and I leave out names and identifying details wherever possible.
• Substack (if you subscribe to my writing there).
• Meta (Instagram, Facebook and WhatsApp), other social media platforms and online forums, only for messages you choose to send me there.
• Google Analytics, Meta Pixel and Microsoft Clarity (website analytics and advertising, only if you accept these cookies). Based in the USA.

I may also share information:

• with my coaching supervisor, in an anonymised way that does not identify you, to make sure my practice stays safe and ethical;
• with my professional insurer, accountant or legal adviser if needed;
• with emergency services or other authorities where the law requires it or where there is a serious risk to life (see section 7).

6. International transfers

Some of my providers store data outside the UK. Where this happens, I make sure your data is protected by an approved safeguard, such as a UK adequacy decision (for example for the EU), the UK Extension to the EU-US Data Privacy Framework for certified US companies, or the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses.

7. Confidentiality and its limits

What you share in sessions is confidential. I will not share anything that identifies you without your permission, except where:

• I believe you or someone else is at serious risk of harm;
• I become aware of a risk to a child or vulnerable adult (safeguarding);
• the law requires me to share it (for example a court order or information about terrorism or serious crime).

Where possible and safe, I will talk to you first before sharing anything.

8. Recording sessions

With your consent, I record our sessions (audio and video) so I can look back on them, prepare for future sessions and support you better. Recordings may be transcribed and summarised using secure transcription and AI tools (see section 5). Lawful basis: your explicit consent, which you give in my client agreement.

• Recordings are stored securely in password-protected cloud storage and are not shared with anyone, except clips you have agreed to as described below.
• Recordings are deleted 12 months after our last session, or sooner if you ask.
• You can say no to recording, or withdraw your consent at any time, and we can still work together.

SHARING CLIPS WITH MY COMMUNITY

With your separate, optional consent, I may share short clips from recordings with my private Quantum Buddha community. These clips only feature my own guidance and are edited so you cannot be identified: no name, face, voice or personal details. I will only share a clip that features you, or share any clip publicly (for example on social media), if you give specific written consent for that clip first. You can withdraw consent at any time, and I will stop using any clip from your sessions. Where a clip has already been posted publicly, I will remove it from my own channels.

You may not record sessions yourself without my agreement.

9. How long I keep your information

• Session notes and client records: 7 years after our last session, then securely deleted. This allows me to respond to any complaint or insurance claim.
• Session recordings and transcripts: 12 months after our last session, then securely deleted.
• Anonymised community clips: for as long as they are useful, unless you withdraw consent.
• Financial records (invoices, payments): 6 years from the end of the tax year they relate to, as HMRC requires.
• Enquiries that do not lead to working together: up to 12 months.
• Newsletter subscribers: until you unsubscribe. I may keep your email address on a suppression list so I do not contact you again.
• Free session bookings: up to 12 months unless you go on to become a client.

10. Cookies

My website uses cookies to make it work, to understand how visitors use it, and, if you agree, for marketing. You can choose which cookies to accept through the cookie banner and change your mind at any time.

• Essential cookies keep the website working and cannot be switched off.
• Google Analytics and Microsoft Clarity help me understand how visitors use the site (for example which pages are visited and how people move around a page), so I can improve it.
• Meta Pixel helps me measure and improve my adverts on Facebook and Instagram.

11. How I keep your information safe

• Devices and accounts are protected by strong passwords and two-factor authentication.
• Session notes are stored digitally in secure, password-protected cloud storage and are not shared with anyone else. Any paper notes are kept in a secured cupboard.
• Notes use the minimum detail needed.
• I hold online sessions from a private space where I cannot be overheard, and I ask you to do the same.
• I only use providers with strong security standards.

If a data breach happens that is likely to put your rights at risk, I will report it to the ICO within 72 hours and tell you without delay if it poses a high risk to you.

12. Your rights

Under UK GDPR you have the right to:

• ask for a copy of the personal information I hold about you (a subject access request);
• ask me to correct information that is wrong or incomplete;
• ask me to delete your information (unless I have to keep it by law, for example financial records);
• ask me to limit how I use your information;
• object to how I use your information, including for marketing;
• ask me to transfer your information to someone else (data portability);
• withdraw your consent at any time, where I rely on consent.

To use any of these rights, email me at help@quantumbuddha.co.uk. There is no charge, and I will reply within one month.

13. Children

My services are for adults aged 18 and over. I do not knowingly collect information about children.

14. Complaints about how I use your data

If you are unhappy with how I handle your information, please contact me first so I can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO):

• Website: ico.org.uk
• Telephone: 0303 123 1113

15. Changes to this policy

I review this policy at least once a year and whenever my services or providers change. The latest version is always available on request and on my website.