Privacy Policy

Last updated: 28 July 2026

This Privacy Policy explains how I, Maya Vaughan, collect, use, store and protect personal information when you visit my website, contact me, subscribe to my newsletter or use my relationship coaching or trauma therapy services.

1. Who is responsible for your information?

Maya Vaughan is the data controller responsible for the personal information described in this policy.

Contact details

Maya Vaughan
Archway Studios
London
N19 5JT

Email: maya@mayavaughan.com

2. The information I may collect

Depending on how you interact with me, I may collect:

Contact and identity information

  • Your name

  • Email address

  • Telephone number

  • Postal address, where necessary

  • Your signature

  • Copies of communications between us

Enquiry and appointment information

  • The service you are interested in

  • Information you include in an enquiry

  • Appointment dates and attendance

  • Cancellation and rescheduling information

Client information

When you enquire about or receive relationship coaching or trauma therapy, you may choose to share information about:

  • Your physical and mental health

  • Trauma and significant life experiences

  • Your emotional wellbeing

  • Your relationships and family circumstances

  • Your sex life or sexual orientation

  • Medication, diagnoses or treatment

  • Substance use

  • Other personal circumstances relevant to our work

Some of this is classed as special-category personal data under UK data-protection law and receives additional protection.

Safety and emergency information

Before beginning work together, I may ask for:

  • The name and telephone number of an emergency contact

  • Your GP’s name

  • Your GP surgery’s telephone number

I collect this information so that I can respond appropriately if I reasonably believe that there is a serious and immediate risk to your safety or somebody else’s safety.

Please make sure your emergency contact knows that you have provided their details to me.

Session records

I may create brief paper or electronic notes about our sessions, including:

  • Dates of sessions

  • Topics discussed

  • Relevant observations

  • Agreed actions or areas of focus

  • Information needed to provide continuity and appropriate support

Payment information

I may collect:

  • Records of payments and invoices

  • Billing information

  • Limited payment-transaction information

Payments may be made through Stripe or by bank transfer. I do not receive or store your complete card details when Stripe processes a payment.

Newsletter information

When you subscribe to my newsletter, I may collect:

  • Your name

  • Email address

  • Subscription and consent information

  • Information about whether newsletters have been opened or links selected, where the email platform provides this information

Website information

When you visit my website, Squarespace and its associated services may process limited technical information, such as:

  • Your IP address

  • Browser and device information

  • Pages visited

  • The date and time of your visit

  • Cookie and website-security information

I do not use Google Analytics or advertising pixels.

3. How I obtain your information

I normally receive information directly from you when you:

  • Complete a website or Jotform form

  • Contact me by email or telephone

  • Sign a coaching or trauma therapy agreement

  • Attend a session

  • Make a payment

  • Subscribe to my newsletter

  • Provide information during our work together

I may also receive limited information from another person where you have authorised this, or where it is necessary to respond to a serious safety concern.

4. Why I use your information and my lawful bases

I use personal information for the following purposes.

Responding to enquiries

I use your contact details and the information in your enquiry to respond, discuss your needs and decide whether my services may be suitable.

My lawful basis is taking steps at your request before entering into a contract and my legitimate interest in managing genuine business enquiries.

Providing coaching or therapy

I use client information to:

  • Assess whether my services are suitable

  • Provide the service you have requested

  • Prepare for and conduct sessions

  • Maintain appropriate records

  • Communicate about appointments

  • Manage cancellations, payments and administration

My lawful basis for ordinary personal information is the performance of our contract.

Where this involves health information or other special-category data, I normally rely on your explicit consent under Article 9(2)(a) of the UK GDPR.

You may withdraw this consent by contacting me. However, because sensitive personal information is central to relationship coaching and trauma therapy, withdrawing consent may mean that I am unable to continue providing the service.

Withdrawal will not affect processing that has already taken place. I may also retain limited information where this is necessary to meet a legal obligation or establish, exercise or defend a legal claim.

Responding to serious safety concerns

In exceptional circumstances, I may use or disclose limited information where I reasonably believe this is necessary to protect your life or safety, or the life or safety of another person.

Depending on the circumstances, my lawful basis may be vital interests, legitimate interests, compliance with a legal obligation or the establishment, exercise or defence of legal claims.

Where appropriate and safe, I will try to discuss the situation with you before disclosing information.

Processing payments and keeping financial records

I use payment and transaction information to collect fees, issue invoices, maintain accounts and meet tax and financial obligations.

My lawful bases are the performance of our contract and compliance with legal obligations.

Sending newsletters and marketing communications

I use your name and email address to send newsletters, articles, event information and service updates where you have actively subscribed.

My lawful basis is consent.

You can unsubscribe at any time by using the unsubscribe link in an email or contacting me at maya@mayavaughan.com.

Running and protecting the website

I use limited technical information to operate the website, prevent misuse, maintain security and understand or resolve technical problems.

My lawful basis is my legitimate interest in maintaining a safe and functional website.

Testimonials

I will only publish a testimonial, case study or identifying client story with your separate and specific agreement.

Agreeing to a testimonial is voluntary and is not a condition of receiving a service.

5. When I may share your information

I do not sell personal information.

I may share limited information with trusted service providers where this is necessary to run my practice. These may include:

  • Squarespace, which hosts my website

  • Jotform, which provides enquiry and client-agreement forms

  • Kit and Mailchimp, which provide email and newsletter services

  • Zoom, which provides online video sessions

  • Stripe, which processes card payments

  • My bank, for bank-transfer payments

  • Email, computer, cloud-storage and IT service providers

  • My accountant, for accounting and tax purposes

These providers may only use information in accordance with their service terms, privacy obligations and applicable data-protection law.

I may also disclose limited information:

  • To your emergency contact

  • To your GP or another relevant healthcare service

  • To emergency services

  • Where disclosure is required by law or a court

  • To a solicitor, insurer or adviser where necessary for a legal claim

  • To protect somebody from a serious and immediate risk of harm

I do not routinely disclose client information to a supervisor.

6. International data transfers

Some of the technology providers I use operate internationally or may process information outside the United Kingdom.

Where personal information is transferred outside the UK, I take reasonable steps to ensure that an appropriate lawful transfer mechanism is in place. This may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved contractual clauses or another safeguard permitted by UK data-protection law.

7. How long I keep information

I do not keep personal information indefinitely.

My usual retention periods are:

  • Enquiries that do not become clients: up to 12 months after our last meaningful contact

  • Client agreements, contact details, emergency information and session records: seven years after the final session

  • Payment, invoice and tax records: six years after the end of the relevant tax year

  • Newsletter information: until you unsubscribe or I stop operating the mailing list

  • Unsubscribe information: a minimal record may be retained so that I can respect your request not to receive further marketing

  • Testimonials: until you withdraw your permission or the testimonial is no longer required

At the end of the relevant period, information will be securely deleted, destroyed or anonymised unless there is a clear legal or safeguarding reason to retain it for longer.

8. Session recordings

Zoom sessions are not normally recorded.

A session will only be recorded where we have discussed and agreed:

  • Why the recording is needed

  • How it will be used

  • Where it will be stored

  • Who will have access to it

  • When it will be deleted

I will obtain separate explicit consent before recording a session.

9. How I protect your information

I take reasonable technical and organisational steps to protect personal information against loss, misuse, unauthorised access, alteration or disclosure.

These measures include limiting access to client information, using passwords and appropriate security controls, and taking reasonable steps to secure both paper and electronic records.

No online service or method of electronic storage is completely secure. If I become aware of a personal-data breach that creates a risk to you, I will take appropriate action and report it where legally required.

10. Cookies

My Squarespace website may use cookies that are necessary for the website to function, remain secure and remember basic settings.

Any non-essential cookies should only be used where you have given the appropriate consent.

You can control or delete cookies through your browser settings. Disabling some cookies may affect how the website functions.

11. Your data-protection rights

Depending on the circumstances and the lawful basis being used, you may have the right to:

  • Ask for a copy of the personal information I hold about you

  • Ask me to correct inaccurate or incomplete information

  • Ask me to delete information

  • Ask me to restrict how information is used

  • Object to certain uses of your information

  • Receive certain information in a portable format

  • Withdraw consent at any time where processing is based on consent

These rights are not absolute and some exceptions may apply, particularly where information must be retained for legal obligations or legal claims.

To exercise a right, contact me at maya@mayavaughan.com. I may need to verify your identity before responding.

12. Your right to object

You have the right to object to personal information being used for direct marketing at any time.

You may also object where I rely on legitimate interests. I will stop processing the information unless I have a compelling legitimate reason to continue or need it for a legal claim.

13. Complaints

Please contact me first if you have a question or concern about how I use your personal information:

maya@mayavaughan.com

You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection.

14. Automated decisions

I do not use personal information to make decisions about you based solely on automated processing or profiling that would have a legal or similarly significant effect.

15. Changes to this policy

I may update this Privacy Policy where my services, systems or legal obligations change.

The latest version will be published on my website with its updated date.