Privacy Policy

The Relationship Clinic Wales (trading name of Carbon Machine Limited)
Last updated: 17 October 2026

This Privacy Policy explains how we collect, use, store and share personal data when you use our website at clinic.wales (and related domains such as relationship.clinic.wales), book or receive counselling, use our client account, contact us, or take our relationship quizzes and surveys.

It is written for clients, prospective clients, quiz users and website visitors. It is not an employment or HR notice.

We aim to keep only what we need to run the practice safely and lawfully, under the UK GDPR and the Data Protection Act 2018, and to respect the Privacy and Electronic Communications Regulations (PECR) for cookies and similar technologies.

1. Who is responsible for your data?

The data controller is:

  • Carbon Machine Limited (Company No. 12221076)
  • Trading as The Relationship Clinic Wales / clinic.wales
  • Counsellor / Director: Rhys Lewis

For privacy questions or to exercise your rights, contact:

Our Counselling Terms & Conditions (including confidentiality and what we store about sessions) are at clinic.wales/terms_and_conditions.php. This Privacy Policy is the main transparency notice for personal data.

2. What personal data do we collect?

Depending on how you use our services, we may process:

2.1 Contact and booking data

  • First name
  • Email address
  • Mobile / telephone number (optional on some forms)
  • Whether you are a new or existing client, and session type / preferred slot
  • Messages you send via our contact form, email, SMS or messaging apps
  • Partner details you choose to provide (first name, email, mobile) when booking couples work - you must have their permission to share those details with us

2.2 Client account and appointments

  • Account identifiers needed to send a secure login / magic link by email
  • Dates of past and future appointments
  • The date we brought these terms / privacy information to your attention
  • Preferences needed to deliver sessions (for example preferred video channel)

2.3 Quizzes, surveys and relationship health checks

  • Answers you give to relationship quizzes and surveys (including free Relationship Health Check and other self-assessment tools on the site)
  • Name and email where you ask us to send or save results / reports
  • Computed scores or report outputs derived from your answers
  • Your explicit consent record when you tick the quiz consent box before we email or save results tied to your identity

Some quiz questions ask about sensitive topics (for example mental health, substance use, trauma, intimacy or similar relationship/health-related issues). Those answers may include special category data - see section 4.

2.4 Payment-related data

  • Date, time, payment method, amount, session type, and any payment reference the payment provider returns to us
  • We do not store full card numbers on our own systems. Card and wallet details are handled by the payment provider (for example PayPal) under their terms

2.5 Technical and security data (website)

  • Essential session data needed for the site to work (for example a PHP session cookie)
  • Basic server logs that our hosting may keep for security and fault diagnosis (typically IP address, browser type, timestamps, pages requested) - kept only as long as needed for those purposes

2.6 What we do not store as counselling notes

As set out in our Counselling Terms, we do not make or store clinical session notes or recordings of counselling sessions in the ordinary course of our work (except where disclosure may be required in the rare safeguarding / legal situations described in those Terms). Video or messaging apps you choose for sessions may process call metadata or content under their terms - see section 6.

3. Why we use your data and our lawful bases

Under UK GDPR we need a lawful basis for each purpose. In practice we rely mainly on:

Purpose Examples Typical lawful basis (Art. 6)
Provide counselling and manage bookings Book sessions, send confirmations, deliver video/phone sessions, manage your client account Contract (or steps before a contract) where you ask us to provide services
Respond to enquiries Contact form, calls, texts, WhatsApp Legitimate interests (responding to people who contact us) and/or contract if you are already a client
Quizzes and reports Relationship Health Check and other quizzes; emailing or saving results you request Consent (you choose to take the quiz / request results) and/or legitimate interests to provide the tool you asked for. Special category answers: see section 4
Payments and accounting Take payment, issue receipts, keep financial records Contract; legal obligation for tax/accounting records
Service messages Appointment reminders, login links, session arrangements via email, SMS or messaging apps Contract / legitimate interests to run the service you requested. You can ask us to use a different channel where practical; some channels are necessary to deliver online sessions
Security and abuse prevention Session cookies, rate limits, honeypots, time traps, server security logs Legitimate interests (keeping the site and accounts safe)
Improve anonymised statistics Aggregated / anonymised survey trends (where we retain anonymised quiz data after account closure) Not personal data once truly anonymised. Until then, legitimate interests (service improvement) - you can object; see Terms on account closure
Legal claims and safeguarding Rare disclosures where required by law or to protect life / serious harm Legal obligation and/or vital interests, as applicable

4. Special category (sensitive) data

UK GDPR treats some information as special category data. That can include data concerning health (which may cover certain mental-health or wellbeing answers).

Our quizzes and counselling context may involve answers about relationship difficulties that touch on mental health, trauma, substance use, intimacy or similar topics. Where those answers are special category data, we need both an Article 6 basis (section 3) and an Article 9 condition.

Quizzes / health-check answers: where answers may be special category data, we rely on your explicit consent (UK GDPR Art. 9(2)(a)). Before we email or save quiz results tied to your identity (including quiz result emails and the free Relationship Health Check), you must tick a consent box confirming that you consent to us processing your quiz answers and personal data for delivering those results and related clinic.wales purposes described in this Privacy Policy. The box is not pre-ticked. You can choose not to answer sensitive questions or not to use the quiz. You may withdraw consent later (see section 10); withdrawal does not affect processing already completed lawfully.

Counselling: ordinary contact and booking data are usually not special category data. Our Counselling Terms describe our services as lifestyle / non-medical advice, and we do not store clinical session notes in the ordinary course of our work. If sensitive information arises while we deliver counselling you have asked for, we process it only as needed for that service and as described in our Counselling Terms (including rare safeguarding or legal disclosures). We do not use counselling content for marketing or advertising analytics.

5. Who we share data with (processors and others)

We do not sell your personal data. We share it only where needed to run the practice, with providers who process it on our instructions or as independent controllers of their own services:

  • PayPal (and any card networks behind a PayPal checkout) - payments. Their privacy notice applies to data they collect directly.
  • Video / messaging tools you agree to use for sessions - for example Zoom, WhatsApp, Microsoft Teams or Google Meet. Those providers may process call content, device data or metadata under their own terms. Choosing a channel means accepting that provider’s processing for that session.
  • Amazon Simple Email Service (Amazon SES) and SMS carriers - to send login links, quiz results, booking confirmations, reminders and service messages. Amazon SES processes emails in the UK/EU region we use.
  • Amazon Web Services (AWS) - hosts the clinic.wales website, its database and server logs on servers in London (UK).
  • Professional advisers or authorities - only where required (for example accountants for anonymised/aggregated financial data, or disclosures required by law / safeguarding as described in our Counselling Terms).

Amazon Associates links on book pages are outbound affiliate links. Clicking through to Amazon is governed by Amazon’s terms.

6. International transfers

Our website, database and outgoing website email are hosted with Amazon Web Services in London. Some providers (for example PayPal, Zoom, WhatsApp, Microsoft, Google Meet, or Amazon as a US-headquartered company) may process data in the United States or other countries outside the UK.

Where that happens, we take steps required by UK GDPR - typically using a provider that offers an appropriate transfer mechanism (such as the UK International Data Transfer Agreement / Addendum, or another mechanism recognised under UK law) and assessing the transfer. You can ask us which tools we currently use for your sessions if you want to review their privacy information before booking.

7. How long we keep your data

We keep personal data only as long as needed for the purposes above, including legal and accounting duties. Current periods:

Data Retention
Active client account, bookings, contact details While you are an active client, then up to 6 years after the last session or last meaningful contact (limitation / accounting), unless you ask us to delete sooner and we have no legal need to keep it
Clear indication you are ending counselling Personal data deleted within 7 days of a clear indication you no longer require counselling (as in Counselling Terms §5.6), subject to any short technical backup cycle and any legal hold
Account closure via Your Account Identifiers removed; survey submissions may be anonymised for aggregated statistics unless you ask for full deletion (Terms §5.7)
Quiz / survey answers tied to you While needed to provide the report or counselling you requested; deletable via account tools after first session where offered; otherwise as for client data above
Payment / invoice records Typically 6 years from the end of the financial year (UK tax / accounting)
Contact-form enquiries (no booking) 12 months after last correspondence, unless a client relationship starts
Essential security / server logs 30-90 days unless investigating an incident
PHP session cookie Browser session / short-lived server session only

Where we anonymise data so it can no longer identify you, we may keep it for service improvement without further notice.

8. Cookies and similar technologies

We take an essential-only approach. We do not use a cookie consent banner because we do not set non-essential advertising or analytics cookies on clinic.wales.

8.1 Essential first-party cookies

  • PHPSESSID (or equivalent session cookie) - needed for forms, quizzes, bookings and client-account flows to work securely (including rate limits and time traps). This is an essential / strictly necessary cookie under PECR.

8.2 Payments (PayPal)

When you pay for a session, you may complete checkout with PayPal. PayPal may set its own cookies that are necessary to process the payment securely. Those cookies are controlled by PayPal under its privacy notice; we do not use PayPal cookies for advertising analytics on clinic.wales.

9. Children

Our counselling services are for adults aged 18 or over who are resident in the United Kingdom (see Counselling Terms). We do not knowingly collect personal data from children for counselling. If you believe a child has provided personal data to us, please contact us and we will delete it.

10. Your rights

Under UK GDPR you generally have the right to:

  • Access - ask for a copy of personal data we hold about you (subject access)
  • Rectification - ask us to correct inaccurate data
  • Erasure - ask us to delete data where there is no compelling reason to keep it
  • Restriction - ask us to limit how we use data in certain cases
  • Portability - receive certain data you provided in a commonly used format, where processing is based on consent or contract and is automated
  • Object - object to processing based on legitimate interests (and we will stop unless we have compelling legitimate grounds)
  • Withdraw consent - where we rely on consent (including explicit consent for special category quiz answers), you can withdraw it at any time without affecting earlier lawful processing
  • Complain - to the ICO (section 11)

We do not use automated decision-making that produces legal or similarly significant effects about you.

To exercise your rights, contact us using the details in section 1 (preferably via the contact form). We may need to verify your identity. Subject access requests are normally free. We will respond within one month in most cases (UK GDPR timescales), or explain if we need more time or cannot fully comply.

You can also close your online account via Your Account → Close Account where that feature is available.

11. Complaints - Information Commissioner’s Office (ICO)

You have the right to lodge a complaint with the UK supervisory authority:

Please contact us first if you can - we will do our best to resolve concerns quickly.

Carbon Machine Limited is registered with the Information Commissioner’s Office as a data controller. Our ICO registration number is ZC266168. You can check this on the ICO register of fee payers.

12. Keeping data secure

We use appropriate technical and organisational measures for the sensitivity of the data (for example HTTPS on the website, access limited to those who need it to deliver the service, and minimising what we store). No online service can guarantee absolute security; please use strong unique passwords on your own email account, because we may send login links there.

13. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we do. Significant changes will be highlighted on this page or brought to your attention when you next use the service where appropriate.

14. Contact

Questions about this Privacy Policy or your personal data:

© Carbon Machine Limited - The Relationship Clinic Wales