1. Who we are

This website and the services described in this Privacy Policy are operated by:

Dr Tasha Malcolm Ltd

Trading as Healing Social Anxiety

Company number: 14476525

Email: hello@drtasha.co.uk

Dr Tasha Malcolm Ltd is the data controller for the personal data covered by this Privacy Policy. This means we decide how and why we collect and use your personal data.

If you have any questions about how we use your personal data, or you want to exercise your data protection rights, please contact us using the details above.

2. What this Privacy Policy covers

This Privacy Policy explains how we collect, use, store and protect personal data when you:

• visit our website;

• take the Social Energy™ quiz;

• receive your Social Energy™ quiz result;

• request or download free resources;

• subscribe to receive informational email content;

• purchase a Social Energy Blueprint or other digital product;

• purchase or access the Social Energy Reset course;

• contact us or request support; or

• otherwise use our website or services.

It also explains your rights under UK data protection law, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), as amended.

We may update this Privacy Policy from time to time. Please check the "Last updated" date at the top of this page.

3. What personal data we collect

We only collect personal data that we need for the purposes described in this Privacy Policy.

Information you provide directly

Depending on how you use our website and services, this may include:

Contact information

For example:

• your name;

• email address;

Social Energy™ quiz information

When you take our Social Energy™ quiz, you may provide information about your preferences, experiences, behaviours or responses to the questions in the quiz.

We use your answers to calculate and provide your Social Energy™ result and, where applicable, to provide information relevant to that result.

The Social Energy™ quiz is designed as a personal development and self-reflection tool. It is not a medical assessment, diagnosis or healthcare assessment, and we do not use your quiz answers to diagnose or assess a mental or physical health condition.

Purchase and account information

If you purchase a digital product or course, we may collect information such as:

• your name;

• email address;

• billing information;

• details of the product or course purchased;

• transaction information;

• account or login information where applicable; and

• information relating to your access to or use of the product or course.

Communications

If you contact us, we may keep records of your correspondence with us, including information you provide in emails, contact forms or support requests.

4. Payment information

Payments for our products and services may be processed by third-party payment providers such as Stripe or PayPal, depending on the payment method available at the time of purchase.

We do not store your full payment card details on our own systems.

Payment providers may collect and process payment and billing information in accordance with their own privacy policies and terms.

We may receive information such as confirmation that a payment has been made, the amount paid, the product purchased and basic billing information. We use this information to fulfil your order, provide access to your purchase and maintain appropriate financial and accounting records.

5. Information collected automatically

When you visit our website, certain technical information may be collected automatically by us or by third-party services we use.

Depending on the technology used, this may include:

• IP address;

• browser type and version;

• device type;

• operating system;

• referring website;

• pages visited;

• approximate location derived from technical information;

• date and time of visits;

• website interactions; and

• other technical or usage information.

We use this information to operate, maintain, secure and improve our website and services and, where applicable, understand how visitors use our website.

6. How we use your personal data

We use personal data for the following purposes:

Providing our services

We use your information to:

• provide access to the Social Energy™ quiz;

• calculate and deliver your quiz result;

• provide free resources you have requested;

• deliver digital products you have purchased;

• provide access to the Social Energy Reset course;

• manage your account where applicable; and

• provide customer support.

Processing purchases

We use your information to:

• process and confirm purchases;

• provide access to products and courses;

• manage refunds where applicable;

• keep appropriate financial and accounting records; and

• deal with queries relating to purchases.

Sending informational emails

If you choose to receive email content from us, we may use your name and email address to send you the informational content you have requested.

Our intention is to provide useful, educational and supportive information relating to social confidence, Social Energy™, self-confidence and related personal development topics.

You can stop receiving informational emails at any time using the unsubscribe option provided in the email or by contacting us.

Improving our website and services

We may use information about how people interact with our website, quiz and products to:

• understand how our website is being used;

• identify technical problems;

• improve our website and user experience;

• improve our products and educational resources; and

• understand which content is useful to our audience.

Where possible, we use aggregated or anonymised information for these purposes.

Security and fraud prevention

We may process technical and transaction information to protect our website, systems and customers, detect suspicious activity and prevent fraud or misuse.

Legal and business obligations

We may process personal data where necessary to:

• comply with legal obligations;

• maintain accounting and financial records;

• establish, exercise or defend legal claims;

• respond to lawful requests from authorities; and

• protect our legal rights and interests.

We will not use your personal data for unrelated purposes without providing appropriate information about the new use where required by law.

7. Our lawful bases for processing

Under UK data protection law, we need a lawful basis for processing your personal data.

Depending on what we are doing, we may rely on the following lawful bases.

Performance of a contract

We may process your personal data because it is necessary to provide a product or service you have requested or purchased.

For example, this may include providing access to the Social Energy Reset course or delivering a Social Energy Blueprint.

Legal obligation

We may process personal data where this is necessary to comply with a legal obligation, such as financial, accounting or tax requirements.

Consent

Where required, we may ask for your consent before processing your personal data.

For example, we may rely on consent where you choose to receive certain communications or where consent is required for particular cookies or similar technologies.

You can withdraw consent at any time where processing is based on consent. Withdrawal of consent does not affect the lawfulness of processing carried out before you withdrew it.

Legitimate interests

We may process personal data where this is necessary for our legitimate interests, provided that those interests are not overridden by your rights and freedoms.

Our legitimate interests may include:

• operating and improving our website;

• maintaining website and system security;

• preventing fraud and misuse;

• managing our business;

• responding to enquiries;

• maintaining appropriate business records; and

• improving our services and resources.

Where we rely on legitimate interests, we consider whether the processing is necessary and whether your interests and fundamental rights and freedoms are appropriately protected.

8. The Social Energy™ quiz

The Social Energy™ quiz is designed to help you explore your Social Energy™ type and understand yourself better.

Your quiz responses are used to generate your Social Energy™ result.

The quiz is not designed to diagnose, identify or assess a medical condition, and your result is not a medical diagnosis or clinical assessment.

Your quiz result may be used to provide you with information and resources relevant to your Social Energy™ type.

The result is generated from the answers you provide.

The quiz does not make decisions about you that have legal or similarly significant effects.

9. Email communications

If you provide your email address and choose to receive email communications from us, we may use your email address to send you information relating to Healing Social Anxiety.

Depending on what you have signed up to receive, these emails may include:

• educational and helpful content about Social Energy™, social confidence and related personal development topics;

• information relating to resources you have requested;

• information about our digital products and courses, including Social Energy™ Reset; and

• other relevant information about our services.

Where an email contains advertising or promotional content about our products or services, we will treat it as direct marketing and will only send it where we have an appropriate lawful basis and comply with the applicable requirements of the Privacy and Electronic Communications Regulations (PECR).

Where consent is required for direct marketing by email, we will ask you to actively opt in to receive it. You can withdraw your consent or unsubscribe from marketing emails at any time using the unsubscribe link provided in the email or by contacting us.

Unsubscribing from marketing emails will not prevent us from sending essential service or transactional communications, such as:

• purchase confirmations;

• payment or billing information;

• course access information;

• important information about products or services you have purchased; or

• other necessary administrative communications.

Where you have purchased a product or service from us, we may in some circumstances be able to rely on the existing-customer "soft opt-in" rules to send marketing about our own similar products or services. Where we rely on this exception, we will comply with all applicable PECR requirements, including providing a clear opportunity to opt out when your contact details are collected and in every subsequent marketing communication.

10. Who we share your personal data with

We use selected third-party service providers to operate our website and provide our services.

Depending on the services we are using at the time, these may include:

Website, email and course platform

Systeme.io is used to host our website, manage forms, deliver email communications, process certain aspects of our digital products and provide course access.

Payment providers

Stripe and/or PayPal may process payments and related billing information.

Analytics and website services

We may use analytics or website performance services to understand how visitors use our website and improve its performance.

Cloud storage and business systems

We may use secure cloud-based services to store business information, documents and backups where appropriate.

Other service providers

We may use other technology providers where they are necessary to operate our website, products, courses or business.

We only provide third parties with the information they need to perform their services.

Where a third party processes personal data on our behalf, we take appropriate steps to ensure that your information is handled securely and in accordance with applicable data protection law.

We may also disclose personal data where necessary:

• to comply with a legal obligation;

• to comply with a lawful request from a competent authority;

• to protect our rights, property or safety;

• to prevent or investigate fraud or other unlawful activity; or

• in connection with the sale, transfer or restructuring of all or part of our business.

We do not sell your personal data.

11. International transfers

Some of the service providers we use may process personal data outside the United Kingdom.

Where personal data is transferred outside the UK, we will take appropriate steps to ensure that the transfer is lawful and that your personal data receives an appropriate level of protection.

Depending on the circumstances, this may include relying on:

• a UK adequacy regulation;

• appropriate contractual safeguards, such as the UK International Data Transfer Agreement or UK Addendum to EU Standard Contractual Clauses; or

• another lawful transfer mechanism available under UK data protection law.

If you would like more information about a particular international transfer, please contact us.

12. Cookies and similar technologies

Our website may use cookies and similar technologies.

Some cookies are necessary for the website to function properly. For example, they may be required for security, website functionality, account access or remembering choices you make.

Other cookies or similar technologies may be used for purposes such as analytics or understanding how visitors use our website.

Where consent is legally required, we will ask for your consent before using non-essential cookies or similar technologies.

You can manage your cookie preferences through the cookie controls provided on our website. You can also adjust cookie settings through your browser.

Please note that disabling certain cookies may affect how some parts of the website function.

Our use of cookies and similar technologies may change as our website develops. Where appropriate, we will update our cookie information and consent mechanism.

13. How long we keep your personal data

We retain different categories of personal data for different periods depending on why we collected it, our legal obligations, and whether there is an ongoing relationship with you.

We do not keep personal data for longer than is reasonably necessary for the purpose for which it was collected, unless we have a legal or legitimate reason to retain it for longer.

Our approach includes the following:

Quiz information

We retain quiz responses and your Social Energy™ result for as long as reasonably necessary to provide your result, provide related resources and maintain appropriate records of your interaction with our services.

Where quiz information is no longer needed, we will delete it or anonymise it where appropriate.

Email information

If you subscribe to receive informational emails, we will retain your email address while you remain subscribed.

If you unsubscribe, we will stop sending the relevant emails and will retain only the information necessary to ensure that we respect your unsubscribe request and comply with our legal obligations.

Digital products and course information

We retain information relating to purchases and access to digital products and courses for as long as reasonably necessary to provide the service, manage your account and support your purchase.

Some transaction and financial records may need to be retained for longer to comply with legal, tax and accounting requirements.

Customer support and correspondence

We retain correspondence and support information for as long as reasonably necessary to deal with your enquiry, maintain appropriate records and resolve any potential disputes.

Technical and analytics information

Technical and analytics information may be retained for different periods depending on the service involved, the purpose for which it was collected and the settings of the relevant third-party service.

We review our retention practices periodically and delete or anonymise information when it is no longer required.

14. Your data protection rights

Under UK data protection law, you may have the following rights, depending on the circumstances and the lawful basis on which we process your information:

Right of access

You can ask for a copy of the personal data we hold about you.

Right to rectification

You can ask us to correct inaccurate or incomplete personal data.

Right to erasure

In certain circumstances, you can ask us to delete your personal data.

This is sometimes called the "right to be forgotten".

Right to restriction

In certain circumstances, you can ask us to restrict how we use your personal data.

Right to object

You may have the right to object to certain types of processing, including processing based on legitimate interests.

You have an absolute right to object to the processing of your personal data for direct marketing purposes.

Right to data portability

Where applicable, you can ask us to provide personal data you have provided to us in a structured, commonly used and machine-readable format, or ask us to transfer it to another organisation.

Right to withdraw consent

Where we rely on your consent, you can withdraw that consent at any time.

Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew your consent.

Not all rights apply in every circumstance. For example, some rights only apply to particular lawful bases or types of processing.

To exercise any of these rights, please contact us using the details in section 18.

We may need to ask for information to confirm your identity before responding to a request.

We will normally respond to a valid data protection request within one month. In certain circumstances, the law allows this period to be extended.

15. Data security

We take reasonable and appropriate technical and organisational measures to protect personal data against:

• unauthorised access;

• accidental loss;

• misuse;

• alteration; and

• unauthorised disclosure.

The measures we use may include appropriate access controls, passwords, secure systems and reputable third-party service providers.

However, no method of transmitting or storing information online can be guaranteed to be completely secure.

If we become aware of a personal data breach, we will assess it and take the steps required by applicable data protection law.

Where the law requires us to notify the Information Commissioner's Office (ICO) or affected individuals, we will do so.

16. Children

Our website and services are intended for a general audience and are not specifically directed at children.

We do not knowingly collect personal data from children where doing so would be unlawful.

If you believe that a child has provided us with personal data and you would like us to consider deleting it, please contact us.

17. Links to other websites

Our website may contain links to websites or services operated by third parties.

This Privacy Policy applies only to personal data processed by Dr Tasha Malcolm Ltd.

We are not responsible for the privacy practices, content or security of third-party websites. We recommend checking the privacy policy of any third-party website before providing personal information.

18. Data protection complaints

If you have concerns about how we have collected or used your personal data, please contact us first.

We want to give you a clear opportunity to raise concerns with us and will investigate data protection complaints appropriately.

You can contact us using:

Email: hello@drtasha.co.uk

We will acknowledge your data protection complaint within 30 days and will respond without undue delay.

If you remain dissatisfied after contacting us, you have the right to complain to the UK's data protection regulator:

Information Commissioner's Office (ICO)

Website: https://ico.org.uk/

The ICO provides information about your data protection rights and how to make a complaint.

19. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• changes to our services;

• changes to the technology we use;

• changes to how we process personal data;

• changes to data protection law; or

• changes to regulatory guidance.

When we update this Privacy Policy, we will change the "Last updated" date at the top of the policy.

Where a change materially affects how we use your personal data, we will provide additional information or notification where required by law.

20. Contact us

If you have any questions about this Privacy Policy, how we use your personal data, or your data protection rights, please contact:

Dr Tasha Malcolm Ltd

Trading as Healing Social Anxiety

Email: hello@drtasha.co.uk

Company number: 14476525