Changes4Life Privacy Policy

This website is operated by Changes4Life t/s Mindsparkz Limited .

1. Introduction Changes4Life (“we”, “us”, “our”) connects clients with qualified, independent therapists. We take your privacy seriously and are committed to protecting your personal information in accordance with UK GDPR and the Data Protection Act 2018. This Privacy Policy explains: • What personal data we collect • How we use it • Who we share it with • Your rights • How we keep your information safe We also use limited client information to carry out occasional service administration and quality assurance checks, helping us ensure that our referral process is safe, effective, and accessible.

2. What personal data we collect We collect the following information when you enquire, complete a form, or use our services: Personal identification • Name • Email address • Phone number Client information • Your reason for seeking therapy • Preferences (e.g., therapist gender, modality, availability) • Any information you choose to share in your enquiry or intake form Technical data • IP address • Device information • Cookies and analytics data (Google Analytics 4) Therapist data (if applicable) • Professional details • Qualifications • Insurance information

3. How we use your personal data We use your information to: • Respond to your enquiry • Assess your needs • Match you with the most appropriate therapist • Manage bookings, payments, and administration • Maintain safety and safeguarding standards • Improve our website and services • Comply with legal obligations Service administration & quality assurance follow ups We may occasionally contact clients after their free consultation for service administration and quality assurance purposes. This may include: • Checking that the referral process worked as intended • Confirming that you were able to access support • Reviewing the effectiveness of our matching process These contacts are limited, optional, and relate directly to the services you have requested. They are not marketing communications and do not require separate marketing consent under UK GDPR.

4. Lawful basis for processing Under UK GDPR, our lawful bases are: • Contract to provide you with therapy referral and administrative services • Legitimate interests to operate and improve our agency • Consent when you choose to share sensitive information • Legal obligation safeguarding, recordkeeping, and regulatory compliance Additional legitimate interest • Service administration & quality assurance to carry out occasional follow ups ensuring our referral process is functioning effectively and safely.

5. How we share your data We share your personal information only when necessary: With therapists We pass your details to the therapist we believe is the most appropriate for your needs. This includes: • Your name • Contact details • Relevant information from your enquiry or intake form Therapists are independent practitioners and act as separate data controllers for the therapy they provide. They maintain their own privacy policies and professional confidentiality obligations. With service providers We may share limited data with: • Email and communication platforms • Payment processors • Website hosting and security providers • Analytics tools (e.g., Google Analytics) All providers are GDPR compliant. Safeguarding If we believe someone is at risk of harm, we may share information with emergency services or safeguarding authorities. We will only share what is necessary. Quality assurance follow ups For quality assurance purposes, we may share limited information with the therapist you were referred to (e.g., confirmation that a follow up took place or relevant outcomes). This supports transparency and continuity of care. We never sell your data.

6. International transfers Some service providers (e.g., Google) may process data outside the UK. We ensure appropriate safeguards are in place, such as Standard Contractual Clauses.

7. How long we keep your data We retain: • Enquiry and referral information: up to 12 months • Administrative records: up to 6 years (legal requirement) • Therapist records: according to their professional obligations Quality assurance follow ups Records of quality assurance follow ups (e.g., notes of a call or email) are retained for up to 12 months, in line with our enquiry and referral retention period. You may request deletion at any time unless we are legally required to retain information.

8. Your rights under UK GDPR You have the right to: • Access your data • Correct inaccurate data • Request deletion • Restrict processing • Object to processing • Data portability • Withdraw consent • Complain to the ICO (Information Commissioner’s Office) ICO website: www.ico.org.uk

9. Cookies and analytics We use cookies and Google Analytics 4 to understand how visitors use our website. This may include: • Page views • Click behaviour • Device and browser information You can manage cookies through your browser settings.

10. Security We use technical and organisational measures to protect your data, including: • Encrypted website (SSL) • Secure storage • Access controls • GDPR compliant third party providers

11. Contact us For any questions or data requests: Email: enquiries@changes4life.co.uk Address: Mindsparkz Ltd t/a Changes4Life, 4 Diddenham Court, Lambwood Hill, Grazeley, Reading RG7 1JQ Telephone: 0118 206 5323