Privacy Policy

Catherine Gelinas, an individual doing business as Subconscious Alchemist, a sole proprietorship based in Boulder, Colorado, United States, decides how and why your information is used, and is the data controller for the purposes of the UK and EU General Data Protection Regulation. Email can be sent to cat@subconsciousalchemist.com.

Booking and payment happen on Acuity Scheduling, not here. What you enter there is covered by Acuity’s own privacy policy as well as by this one.

If you allow it, Google Analytics sets cookies on your device (named _ga and _ga_ followed by a code) that last up to two years. They give you a random identifier so that repeat visits can be counted as one person rather than several. They do not carry your name or email address.

What it records: the pages you view and how long you spend on them, how you arrived — a search engine, a link from YouTube or Instagram, our newsletter, or directly — and your device, browser, language and approximate location, worked out from your IP address to about city level. It also records a small number of specific actions: starting a video or a podcast episode, opening one of the free PDFs, sending the contact form, subscribing to the newsletter, and clicking through to the booking page.

We have switched off Google Signals and ad personalisation for this property, so what is collected is not added to advertising audiences and is not used to target ads to you anywhere else. Google acts as our processor for this and also holds the data as a recipient in the United States under its own terms.

You can change your mind at any time using “Analytics choices” at the bottom of any page — withdrawing is one click, exactly like agreeing was. If your browser sends a Global Privacy Control or Do Not Track signal we treat that as “no” automatically and do not ask. You can also block the cookies in your browser, or install Google’s own opt-out add-on.

Some pages embed videos from YouTube using its privacy-enhanced mode. When one of those players loads, YouTube stores an identifier on your device and receives your IP address; if you play a video, YouTube also sets its own cookies. That is Google’s processing under Google’s privacy policy, and we receive none of it. Podcast audio is streamed from our podcast host only once you press play.

Our typefaces are served from this website, not from Google Fonts.

Newsletter — your email address. We also record the date, your IP address and your browser’s user-agent string, as evidence of when and how you gave consent, and a token that lets you unsubscribe in one click.

Website analytics — only if you agreed to it, and only what is described under “Analytics” above. It is not linked to your name or email address, and we do not try to work out who an individual visitor is.

New client survey — your name and email address, and your answers to five questions about what you are working with and what you would like to change.

Client safety and consent form — your name, email address, phone number if you give one, which statements you agreed to, your answer about readiness, and your typed signature and the date. We keep the exact wording you agreed to, and a version number for it, so there is a record of what was actually signed.

For the survey and consent form we also record your IP address, browser user-agent, the page you submitted from and the time, to help us identify and block automated abuse.

Existing contacts — when this site replaced its predecessor we imported the mailing list. Where we could not establish that someone had agreed to receive email, they are marked as unconfirmed and we do not email them.

There is no login and there are no accounts. We do not see or store card details — payment is handled by Acuity.

Cat Gelinas is not a licensed health-care provider, and this information is not a medical record. It is not covered by HIPAA, and it does not carry the legal privilege that applies to licensed professionals.

We keep it confidential and use it only to decide whether and how to work with you, and to keep a record of what you agreed to. We do not use it for marketing, and we never sell or share it.

• To send you the newsletter you asked for — your consent. You can withdraw it at any time using the unsubscribe link in any email.
• To keep evidence that consent was given — our legal obligation to be able to demonstrate it, and our legitimate interest in being able to show we acted properly.
• To respond to a survey and decide whether we are a good fit — steps taken at your request before entering into a contract, and, for anything health-related, your explicit consent.
• To record what you agreed to before a session — performance of our contract with you, your explicit consent for health-related content, and our legitimate interest in keeping a record we can rely on if a dispute arises.
• To keep the site free of spam and abuse — our legitimate interest in protecting the site. We use a hidden honeypot field and record IP addresses for this purpose.

We use a small number of service providers, who act on our instructions and are not permitted to use your information for their own purposes:

• Supabase — hosts the database in which your information is stored (United States).
• Cloudflare — hosts and delivers this website.
• Acuity Scheduling — handles booking and payment, if you book.
• YouTube (Google) and our podcast host — deliver embedded video and audio, as described above.
• Google Analytics — measures how the website is used, but only if you agreed to it.

We may also disclose information where the law requires it, or where it is necessary to establish, exercise or defend a legal claim. We do not sell your information, we do not share it for advertising, and we do not send it to data brokers.

Your information is stored in the United States. The United States is not covered by an adequacy decision, and we are not certified under the EU–US Data Privacy Framework. If you are in the EU or the UK and you send us your information through this website, you are sending it directly to us in the United States.

• Newsletter — until you unsubscribe. After that we keep a minimal record of your email address and that you opted out, so that we do not add you back by mistake.
• Consent evidence (IP address and user-agent) — 24 months.
• Survey answers — 24 months, or sooner if we do not go on to work together and you ask us to delete them.
• Signed consent forms — [RETENTION PERIOD for signed consent forms — set with lawyer].
• Submissions identified as spam — 90 days.
• Website analytics, if you agreed to it — 14 months at Google, after which the visit-level records are deleted automatically. The cookies on your own device last up to two years unless you clear them.

You can ask us to delete your information sooner, and we will unless we are required to keep it.

Wherever you live, you can ask us to give you a copy of what we hold about you, correct it, or delete it, and you can unsubscribe from email at any time.

If you are in the UK or the EU, you also have the right to restrict or object to how we use your information, the right to receive it in a portable form, and an absolute right to object to direct marketing. Where we rely on your consent, you can withdraw it at any time — that does not affect anything done beforehand.

Email cat@subconsciousalchemist.com and we will respond within one month. There is no charge. If you are not satisfied, you can complain to your data protection authority — in the UK that is the Information Commissioner’s Office.

Unsubscribing from the newsletter stops the email but does not delete your record — we keep a suppression entry so that you are not added again. Ask us if you want it removed entirely.

For analytics specifically, the fastest route is “Analytics choices” at the bottom of any page: choosing “No thanks” stops any further collection immediately. Because analytics is not tied to your name, we usually cannot find your past records to delete them on request — which is also why there is very little to find.

Your information is held in a hosted database that is not publicly accessible, and this site is served only over an encrypted connection. No system is completely secure, and we do not claim otherwise; if a breach affects you we will tell you as the law requires.

This website is not intended for children. You must be 18 or over to book a session or submit a form, and we do not knowingly collect information from anyone under 18. If you believe a child has given us information, please contact us and we will delete it.

If we change this policy we will update the effective date at the top of the page. If a change is significant, and we have your email address, we will tell you.