Privacy Policy

[CAT’S FULL LEGAL NAME as it appears on her Colorado trade-name filing], an individual doing business as Subconscious Alchemist, a sole proprietorship based in Colorado, United States, decides how and why your information is used, and is the data controller for the purposes of the UK and EU General Data Protection Regulation. Post can be sent to [MAILING ADDRESS — use a USPS PO Box or a CMRA mailbox, NOT her home address] and email to cat@subconsciousalchemist.com.

Booking and payment happen on Acuity Scheduling, not here. What you enter there is covered by Acuity’s own privacy policy as well as by this one.

Some pages embed videos from YouTube using its privacy-enhanced mode. When one of those players loads, YouTube stores an identifier on your device and receives your IP address; if you play a video, YouTube also sets its own cookies. That is Google’s processing under Google’s privacy policy, and we receive none of it. Podcast audio is streamed from our podcast host only once you press play.

Our typefaces are served from this website, not from Google Fonts.

Newsletter — your email address. We also record the date, your IP address and your browser’s user-agent string, as evidence of when and how you gave consent, and a token that lets you unsubscribe in one click.

New client survey — your name and email address, and your answers to five questions about what you are working with and what you would like to change.

Client safety and consent form — your name, email address, phone number if you give one, which statements you agreed to, your answer about readiness, and your typed signature and the date. We keep the exact wording you agreed to, and a version number for it, so there is a record of what was actually signed.

For the survey and consent form we also record your IP address, browser user-agent, the page you submitted from and the time, to help us identify and block automated abuse.

Existing contacts — when this site replaced its predecessor we imported the mailing list. Where we could not establish that someone had agreed to receive email, they are marked as unconfirmed and we do not email them.

There is no login and there are no accounts. We do not see or store card details — payment is handled by Acuity.

Cat Gelinas is not a licensed health-care provider, and this information is not a medical record. It is not covered by HIPAA, and it does not carry the legal privilege that applies to licensed professionals.

We keep it confidential and use it only to decide whether and how to work with you, and to keep a record of what you agreed to. We do not use it for marketing, and we never sell or share it.

• To send you the newsletter you asked for — your consent. You can withdraw it at any time using the unsubscribe link in any email.
• To keep evidence that consent was given — our legal obligation to be able to demonstrate it, and our legitimate interest in being able to show we acted properly.
• To respond to a survey and decide whether we are a good fit — steps taken at your request before entering into a contract, and, for anything health-related, your explicit consent.
• To record what you agreed to before a session — performance of our contract with you, your explicit consent for health-related content, and our legitimate interest in keeping a record we can rely on if a dispute arises.
• To keep the site free of spam and abuse — our legitimate interest in protecting the site. We use a hidden honeypot field and record IP addresses for this purpose.

We use a small number of service providers, who act on our instructions and are not permitted to use your information for their own purposes:

• Supabase — hosts the database in which your information is stored (United States).
• Cloudflare — hosts and delivers this website.
• Acuity Scheduling — handles booking and payment, if you book.
• YouTube (Google) and our podcast host — deliver embedded video and audio, as described above.

We may also disclose information where the law requires it, or where it is necessary to establish, exercise or defend a legal claim. We do not sell your information, we do not share it for advertising, and we do not send it to data brokers.

Your information is stored in the United States. The United States is not covered by an adequacy decision, and we are not certified under the EU–US Data Privacy Framework. If you are in the EU or the UK and you send us your information through this website, you are sending it directly to us in the United States.

• Newsletter — until you unsubscribe. After that we keep a minimal record of your email address and that you opted out, so that we do not add you back by mistake.
• Consent evidence (IP address and user-agent) — 24 months.
• Survey answers — 24 months, or sooner if we do not go on to work together and you ask us to delete them.
• Signed consent forms — [RETENTION PERIOD for signed consent forms — set with lawyer].
• Submissions identified as spam — 90 days.

You can ask us to delete your information sooner, and we will unless we are required to keep it.

Wherever you live, you can ask us to give you a copy of what we hold about you, correct it, or delete it, and you can unsubscribe from email at any time.

If you are in the UK or the EU, you also have the right to restrict or object to how we use your information, the right to receive it in a portable form, and an absolute right to object to direct marketing. Where we rely on your consent, you can withdraw it at any time — that does not affect anything done beforehand.

Email cat@subconsciousalchemist.com and we will respond within one month. There is no charge. If you are not satisfied, you can complain to your data protection authority — in the UK that is the Information Commissioner’s Office.

Unsubscribing from the newsletter stops the email but does not delete your record — we keep a suppression entry so that you are not added again. Ask us if you want it removed entirely.

Your information is held in a hosted database that is not publicly accessible, and this site is served only over an encrypted connection. No system is completely secure, and we do not claim otherwise; if a breach affects you we will tell you as the law requires.

This website is not intended for children. You must be 18 or over to book a session or submit a form, and we do not knowingly collect information from anyone under 18. If you believe a child has given us information, please contact us and we will delete it.

If we change this policy we will update the effective date at the top of the page. If a change is significant, and we have your email address, we will tell you.