Privacy Policy

1. Data Controller

InnereSource™ is the data controller responsible for your personal information.
Owner: Pav Shakti, trading as InnereSource™.
Address: 124 City Road, London, EC1V 2NX, United Kingdom.
Email: [email protected]

3. Information We Collect

• Identity & Contact Data: Name, email address, and billing address.
• Transaction Data: Details about payments for containers and services, processed securely via our payment and checkout providers; we do not store full credit card numbers.
• Intake & Session Data: Information provided in application forms, intake questionnaires, and brief session notes used for tracking your somatic progress.
• Scheduling Data: Booking details processed via our scheduling software when arranging 1:1 sessions.
• Communications Data: Email addresses and engagement data processed via our email marketing platform if you're subscribed to our updates.
• Technical Data: IP addresses and browser information used to optimize your experience on our website and portal.
• Collective Data: Your member profile, and anything you post, comment on or message within the InnereSource Collective, including any health or personal information you choose to share there.

4. How We Use Your Data

We use your data to deliver bespoke services, manage your account, process payments, arrange scheduling, and ensure the safety and efficacy of our somatic work. If you have opted in to our newsletter, we may send you occasional updates, from which you can unsubscribe at any time.

5. Our Lawful Bases for Using Your Data

Under UK GDPR we need a lawful basis for everything we do with your data. Ours are:

Where we rely on consent, you can withdraw it at any time by emailing us at the address in Section 1. Where we rely on legitimate interests, we have weighed our interests against your rights, and you may object at any time.

6. The InnereSource Collective

The InnereSource Collective is our members’ community, delivered through third-party platforms. This section explains how your data is handled there.

• What we process: your profile details, posts, comments, direct messages and any recording of a group session.
• Who can see it: other members of the Collective, as set out in our Community Rules. Please share only what feels safe, and never share another person’s private information.
• Health information: if you choose to share health or wellbeing information in the Collective, this is Special Category Data. We process it on the basis of your explicit consent, which you give by choosing to post it, and you can ask us to remove it at any time.
• Group session recordings: group sessions are recorded and made available to members in the community portal. If you would rather not appear in a recording, contact us before the session to discuss your options.
• Our platform providers: the platforms that host the Collective process your data on our behalf, and also as controllers in their own right for running their platform. Their own privacy policies apply to how they handle your account.
• Our lawful bases: set out in the lawful bases section above.
• When your membership ends: your access ends. Your posts and comments remain in the Collective unless you ask us to remove them.
• Removing your data: you can ask us at any time to remove your posts, comments or other data by emailing us at the address in Section 1 (Data Controller). We will respond within one month. Where a recording includes other members, we may edit it rather than delete it. We will always tell you what we have done.

7. International Data Transfers

Some of the third-party platforms we use to run InnereSource™ — including payment, checkout, scheduling, and email service providers — may store or process data outside the UK or EEA. Where this happens, we take reasonable steps to ensure your data continues to receive an equivalent level of protection, such as through Standard Contractual Clauses or an equivalent safeguard recognised under UK data protection law.

8. Data Security & Retention

We use industry-standard encryption and secure third-party platforms to protect your personal data from being accidentally lost, used, or accessed in an unauthorized way. Intake forms and session notes are stored within secure, encrypted environments accessible only by the practitioner. We retain your personal data only for as long as necessary to fulfil the purposes we collected it for, including to satisfy any legal, accounting, or reporting requirements.

Intake forms and session notes are kept for 7 years after your last session and then securely deleted. Financial and tax records are kept for 6 years after the end of the relevant tax year, as HMRC requires. Collective posts and comments are kept while the Collective runs, including after your membership ends, and are removed on request.

9. Your Legal Rights (GDPR)

As a UK or EU resident, you have the following rights over your personal data:

• Right to Access: You can request copies of the data we hold on you.
• Right to Rectification: You can ask us to correct inaccurate information.
• Right to Erasure: You can request that we delete your data (the "Right to be Forgotten").
• Right to Restriction: You can ask us to limit how we use your data.
• Right to Portability: You can request that we transfer your data to another organization.
• Right to Object: You can object to certain kinds of processing, including direct marketing.
• Right to Withdraw Consent: Where we rely on your consent, you may withdraw it at any time.

To exercise any of these rights, please contact us via email below.