1. Who We Are

This website is operated by:

Catherine Rutherford Holistic Therapist, Reflexologist, EFT Practitioner, Soulful Doula & Yoga Teacher Ratoath, Co. Meath, Ireland Email: [[email protected]].

Catherine is the Data Controller for all personal information collected through this website and related services.

2. What Personal Data We Collect

We may collect the following types of information:

2.1 Information You Provide Directly

Name

Email address

Phone number

Billing information (processed securely by third‑party payment providers)

Health information relevant to treatments or yoga classes

Pregnancy‑related or wellbeing information you choose to share

Information submitted through contact forms, booking forms, or email

Information shared during sessions, classes, or programs

2.2 Automatically Collected Information

When you visit the website, we may collect:

IP address

Browser type

Pages visited

Time spent on the site

Cookies (see Cookie Policy if applicable)

This helps improve website performance and user experience.

3. How We Use Your Information

Your information is used to:

Process bookings and payments

Provide treatments, classes, and programs

Communicate with you about appointments, updates, or changes

Send newsletters or updates (only if you opt in)

Maintain accurate health and wellbeing records for safe practice

Improve website functionality and user experience

Comply with legal and insurance requirements

We never sell your data or share it with third parties for marketing.

4. Legal Basis for Processing (GDPR)

We process your data under the following lawful bases:

Consent – when you sign up for newsletters or provide information voluntarily

Contract – to deliver services you have booked

Legal obligation – for tax, insurance, or regulatory requirements

Vital interests – where health information is necessary for safe practice

Legitimate interests – to improve services and website performance

You may withdraw consent at any time.

5. Special Category Data (Health Information – GDPR Article 9)
As a holistic therapist and yoga teacher, Catherine processes special category data (health information) under GDPR Article 9(2)(h) (healthcare) and Article 9(2)(a) (explicit consent).

Explicit consent is obtained before collecting health data (e.g. via intake forms or verbal agreement).

Health data is collected via verbal discussion at your first session or via secure intake form. Explicit consent is obtained before any health information is processed.

Purpose: Only for safe treatment delivery (e.g., identifying reflexology contraindications).

Storage: Encrypted, access-restricted, and retained per professional guidelines (e.g., 8 years for reflexology).

Health data is collected via verbal discussion at your first session or via secure intake form. Explicit consent is obtained before any health information is processed.

6. How Your Data Is Stored

Website Data (catherinerutherford.com):
Hosted and processed within the European Union (for data collected via our website forms, bookings, and contact pages).

Community Data (GoKollab/Womb & Bloom):
Hosted and processed by LeadConnector LLC (U.S.) on servers in the United States, protected under the EU-U.S. Data Privacy Framework (DPF).

Health records are stored in:

Password-protected Microsoft Word documents (encrypted, access-restricted)

Encrypted USB drive (stored securely offline)

Modern CRM (GDPR-compliant, marked as private)
Access: Limited to Catherine Rutherford only. All devices use strong passwords.

Your data may be stored in:

Secure booking systems

Encrypted email platforms

Password‑protected devices

GDPR‑compliant cloud services

Data is retained only for as long as necessary for:

Providing services

Legal, tax, and insurance obligations

Professional record‑keeping requirements

As of 13/8/26, our Womb & Bloom community and associated programs have been temporarily suspended to ensure full GDPR compliance while we verify Modern CRM’s cookie consent mechanism. Services will resume once compliance is confirmed.

7. Sharing Your Information

Your data may be shared only with:

Payment processors (e.g., Stripe, PayPal)

Booking platforms

Email newsletter providers

Legal or regulatory bodies if required

All third‑party providers are GDPR‑compliant.

We never sell or trade your information.

8. Your Rights Under GDPR

You have the right to:

~ Access your personal data

~ Correct inaccurate information

~ Request deletion (“right to be forgotten”)

~ Restrict or object to processing

~ Withdraw consent

~ Request data portability

~ Lodge a complaint with the Data Protection Commission (Ireland)

- Right to Object: You may object to processing based on legitimate interests (e.g., analytics). Contact us to exercise this right.

- Right to Restrict Processing: Request temporary restriction of processing (e.g., during a dispute).

- Automated Decision-Making: We do not use automated decision-making for your data. GoKollab may use AI tools for platform functionality (e.g., spam detection), but not for profiling or training generalized models.

To exercise any of these rights, contact Catherine at [[email protected]].

9. Cookies

This website uses cookies to improve your browsing experience. You can adjust your browser settings to refuse cookies if you prefer.

A full Cookie Policy can be added if needed.

10. Children’s Privacy

This website is not intended for children under 16. Any information relating to minors (e.g., pregnancy clients under 18) is collected only with parental/guardian consent.

11. Third-Party Service Providers"
We use Go Kollab (by LeadConnector) to host and manage our Inner Circle online community. LeadConnector acts as a Data Processor for the personal data you provide when joining or participating in the community (e.g., name, email, posts, and interactions). LeadConnector’s processing of your data is governed by their Privacy Policy and Data Processing Addendum (DPA), which align with GDPR requirements. For more details, refer to LeadConnector’s Privacy Policy.

We also use the LeadConnector app (by LeadConnector) to manage client conversations, calendar updates, and POS transactions. Data processed through this app may be transferred to and processed in the United States under the EU-U.S. Data Privacy Framework (DPF).

Data Processing Addendum (DPA):
LeadConnector LLC (GoKollab) acts as our Data Processor for community data. Their DPA is available upon request to customers and includes:

GDPR Article 28 compliance (contractual safeguards for data processing).

EU-U.S. Data Privacy Framework (DPF) protections for international transfers.

Standard Contractual Clauses (SCCs) where applicable.

LeadConnector’s processing of your data is governed by their Privacy Policy and Data Processing Addendum (DPA), which aligns with GDPR requirements. To request a copy of the DPA, contact [email protected].

GoKollab (LeadConnector LLC) as Data Processor

Role: LeadConnector acts as a Data Processor for personal data submitted when you join or participate in The Inner Circle (e.g., name, email, posts, comments, payment details, and engagement metrics).

Purpose: Hosting, managing, and facilitating community interactions, including user profiles, discussions, and content sharing.

Legal Basis: Processing is based on contractual necessity (Terms of Use) and your explicit consent (when joining the community).

Data Transfers: Your data may be transferred to and processed in the United States under the EU-U.S. Data Privacy Framework (DPF), UK Extension to the EU-U.S. DPF, and Swiss-U.S. DPF, which provide equivalent protection to GDPR. For details, see LeadConnector’s Privacy Policy and Data Privacy Framework Certification.

Data Retention: Data is retained for as long as your account is active or as required by LeadConnector’s DPA (Data Processing Addendum). You may request deletion of your community data by contacting [email protected].

Your Rights: You retain all GDPR rights (access, rectification, erasure, restriction, portability, objection). To exercise these for your GoKollab data, contact Catherine Rutherford (Data Controller) or LeadConnector (Data Processor) at [email protected]

12. External Links

This website may contain links to third‑party sites. Catherine is not responsible for their privacy practices or content.

13. Changes to This Privacy Policy

This policy may be updated occasionally. The latest version will always be posted on this page with an updated date.

14. Contact

If you have questions about this Privacy Policy or how your data is handled, please contact:

Catherine Rutherford Ratoath, Co. Meath, Ireland Email: [[email protected]]

15. Data Retention
We retain your personal data for no longer than necessary:

Booking/Payment Data: 7 years (for tax/legal compliance in Ireland).

Health Records: As required by professional body guidelines (e.g., 8 years for reflexology).

Community Data (GoKollab): Until you delete your account or request erasure. Inactive accounts may be retained for 1 year before deletion.

Analytics/Logs: 26 months (Google Analytics default) or until anonymized.