Privacy Policy

Effective Date: 01 July 2026

This Privacy Policy explains how I, Mara Sheldon, trading as Mara Sheldon Occupational Therapy, collect, use, and protect your personal data when you visit my website, attend an education session, group session or personal 1:1 session, or interact with me online or in person.

1. What Information I Collect

I may collect the following personal information:

• Name, email address, phone number, postal address, date of birth

• Sensitive health information shared via forms, health questionnaires, discussions and during sessions

• Payment information (handled securely through Stripe)

• Messages and interactions via email, text or WhatsApp

2. How Your Information is Collected

Your information may be collected when you:

• Fill in a contact form, Client information form, client assessment form, or pre-education or group session form

• Book a class or course through my website or Eventbrite (via Stripe or Eventbrite)

• Sign up to my marketing emails (with explicit consent)

• Contact me via email, text, telephone or WhatsApp

3. Why I Collect Your Data

I use the data you provide to:

• Deliver 1:1 individual sessions tailored to your needs

• Respond to your enquiries or session bookings

• Manage and confirm your payments and appointments

• Keep records required for legal, financial, or insurance purposes

• Send occasional marketing emails and updates — only if you’ve opted in

• Design, offer and deliver group sessions or education sessions (Non-special category data only used for these purposes)

4. Special Category (Health) Data

As part of your participation in any 1:1 or group support sessions, I may collect information related to your physical or mental health. This data is considered “special category” under UK GDPR and will only be processed:

• With your explicit consent

• For the purpose of providing appropriate services

• With strict confidentiality and limited access

5. Third-Party Services

To run my business securely and efficiently, I use the following trusted third-party providers:

• Stripe – to process payments

• Eventbrite and my website – for class and course bookings

• Google Mail and Google Drive – to store emails, feedback forms (for non-sensitive data) and course materials

• Halaxy – to store notes

• WhatsApp – for communication​

• IT and system administration support

These services are compliant with GDPR and have their own privacy policies.

Data Disclosure

We may have to share your personal data with:

• Service providers who provide IT and system administration support

• Professional advisors including lawyers, bankers, auditors and insurers

• HMRC and other regulatory authorities

• Third parties if ever we sell, transfer or merge parts of our business or our assets

• Other professionals for the purposes of discussing your treatment, for further information about medical conditions or any urgent safety or medical concerns

• Other professionals to meet my professional requirements (eg. for clinical supervision).

​

We only share data where necessary for the purposes of legal or operational services, and require all of these third parties to respect the security of any personal data and to treat it in accordance with the law. They are only allowed to process your personal data on our instructions.

International transfers

Some of my third-party providers (eg some IT support) may be businesses outside of the EEA in countries which do not always offer the same levels of protection for your personal data. I do my best to ensure a similar degree of security by ensuring that contracts, code of conduct or certification are in place which give your personal data the same protection it has within Europe. If I am not able to do so, I will request your explicit consent to the transfer and you can withdraw this consent at any time.

​

6. Cookies and Analytics

My website uses cookies and tools like Google Analytics and Meta Pixel to help me understand how visitors use the site. This helps me improve your experience. You can adjust cookie preferences in your browser settings at any time.

7. Marketing and Newsletters

You will only receive marketing communications if you’ve opted in — for example, through the sign-up form in this website. You can unsubscribe at any time by clicking the link in an email or contacting me directly.

8. Your Rights Under UK GDPR

You have the right to:

• Access the personal data I hold about you

• Request that I correct inaccurate data

• Ask for your data to be deleted (where possible)

• Withdraw consent for marketing or special category data

• Object to or restrict how I process your information

To make a request, email me at mara.sheldon.OT@gmail.com

​

Your rights are set out in more detail at: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/

​

I will not charge a fee for responding to this request unless your request is clearly unfounded, repetitive or excessive in which case I may charge a reasonable fee or decline to respond.

​

I will, in most cases, reply within one month of the date of the request unless your request is complex or you have made a large number of requests in which case I will notify you of any delay and will in any event reply within 3 months.

​

9. How I Store and Protect Your Data

I have put in place security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. I also limit access to your personal data to those  professionals, employees, agents, contractors and other third parties who have a business or legal need to know such data.

They will only process your personal data on our instructions and are subject to a duty of confidentiality. We have put in place procedures to deal with any suspected personal data breaches and will notify you and any applicable regulator where we are legally required to do so.

​

In certain circumstances you can ask us to delete your data. See the section entitled ‘your rights’ below for more information. 

​

We may anonymise your personal data (so that you can no longer be identified from such data) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

10. Data Retention – How Long I Keep Your Information

I will only retain your personal information for as long as necessary to provide my services and meet legal or regulatory requirements.

• General, health forms and information: retained for up to 7 years (from your last session), in line with insurance guidelines

• Payment records: stored securely for up to 6 years, as required for tax and accounting purposes

You can request access or deletion of your data at any time by emailing mara.sheldon.OT@gmail.com

​​

Keeping your data up-to-date

I have a duty to keep your personal data up to date and accurate so from time to time I will contact you to ask you to confirm that your personal data is still accurate and up to date.

If there are any changes to your personal data (such as a change of address) please let me know as soon as possible: mara.sheldon.OT@gmail.com

​​

Complaints

I am committed to protecting your personal data but if for some reason you are not happy with any aspect of how I collect and use your data, you have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk).

I would be grateful if you would contact me first if you do have a complaint so that I can try to resolve it for you.   

​

11. Contact

If you have questions about this policy or how your information is handled, please get in touch: mara.sheldon.OT@gmail.com

​

© Mara Sheldon Occupational Therapy 2026

​