Privacy Policy

Last updated: 8 September 2026

This policy explains what personal data is collected when you visit this website, get in touch, or work with me — and how it is used, stored and protected.

1. Data controller

Georgia Baltag — georgia@movetorise.com.

As data controller, I am responsible for how your personal data is collected, used and protected.

Your data is used to provide the sessions and services you have asked for, to meet the legal obligations that come with running a practice, and — where you have asked for it — to send you occasional reflections on somatic work, the nervous system and movement practice, along with news of sessions and groups. It is not used for any other purpose, and it is never sold or shared for marketing.

2. What data is collected

When you contact me through the website, by email, or by Instagram or WhatsApp message:

  • your name and contact details

  • anything you choose to tell me in your message

When you book a free introductory conversation:

  • your name and email address, and the date and time you choose

If we begin working together:

  • contact and billing details

  • information you share about your reasons for coming, your history, and your health where relevant

  • brief notes I make during or after sessions

  • appointment and payment records

If you subscribe to my newsletter:

  • your name and email address

  • basic delivery information, including whether an email has been opened, which helps me understand what is useful

When you visit the website, the hosting platform collects limited technical data such as IP address and browser type.

3. Session notes

I keep brief written notes of sessions. They allow the work to build from one session to the next, help me hold the threads of your process over time, and support the reflection that shapes how we continue. Keeping notes is a normal part of responsible practice.

Notes are handwritten and kept on paper. They are stored securely and are not held on any computer or cloud service. They are not shared with anyone. You have the right to ask to see your notes at any time.

4. Purposes and legal basis for processing

Ordinary personal data — name, contact details, billing:

  • To respond to your enquiry — on the basis of your consent, and of steps taken at your request before entering a contract.

  • To arrange and deliver the service you have booked — on the basis of our agreement.

  • To send you my newsletter, if you have asked to receive it — on the basis of your consent. This includes the basic delivery information described in section 2. Every email includes a link to unsubscribe, and you can do so at any time.

  • To keep accounting and tax records — on the basis of legal obligation.

  • To keep records that allow me to respond to any future complaint or claim — on the basis of legitimate interest.

Personal data is not subject to automated decision-making or profiling. It is not used for advertising, and is never shared with advertisers or advertising networks. The only marketing use of your data is my own newsletter — sent using your name and email address alone, and only where you have asked to receive it.

Health and other sensitive data — information shared in sessions, and my session notes:

Information of this kind constitutes special category data under Article 9 of the GDPR. It is processed solely for the purpose of delivering the therapeutic work, and on the basis of your explicit consent, obtained before the work begins.

Consent may be withdrawn at any time. Withdrawal does not affect the lawfulness of processing carried out beforehand, and certain records may still be retained where a legal obligation requires it.

5. How long data is kept

  • Enquiries that do not lead to work: up to 6 months, then deleted.

  • Newsletter subscriptions: until you unsubscribe, after which your details are removed from the mailing list.

  • Session notes and client records: five years from the end of our work together, after which they are securely destroyed. This period corresponds to the time within which a claim relating to the work could be brought.

  • Invoices and accounting records: for the period required by applicable accounting and tax legislation, currently six years.

When a retention period expires, records are deleted or, in the case of handwritten notes, destroyed.

6. Who else has access

Your personal data is not sold, rented, or disclosed to third parties for marketing purposes. The following providers process data on my behalf, or hold it in the course of ordinary communication, each subject to their own data protection obligations:

  • Squarespace — website hosting, contact form submissions, mailing list and newsletter delivery

  • Calendly — scheduling the free introductory conversation. Your name, email address and timezone, and the time you choose

  • Zoom — online sessions. Sessions are not recorded.

  • Meta — where you contact me by Instagram or WhatsApp message, that conversation is held on Meta’s systems under their own policy

  • My bank — payment records

Session notes are handwritten and are not held by any of these providers.

I discuss my work in clinical supervision. Your identity is not disclosed there, and my supervisor is bound by professional confidentiality.

Data may also be disclosed where required by law, or where there is a serious and imminent risk of harm to you or another person.

7. Transfers outside the European Economic Area

Some providers listed above are based outside the EEA, including in the United States. Where that is the case, transfers are covered by the safeguards those providers have in place, such as the EU–US Data Privacy Framework or Standard Contractual Clauses approved by the European Commission.

8. Security

Devices used for correspondence and billing are password-protected and encrypted, and access is limited to me. Handwritten session notes are stored securely and separately from your contact details.

No system is entirely secure, and email and internet communication carry inherent risks.

9. Your rights

Under the GDPR you have the right to:

  • access the personal data I hold about you

  • have inaccurate data corrected

  • have your data deleted, where no legal obligation requires me to keep it

  • restrict or object to processing

  • receive your data in a portable format

  • withdraw your consent at any time

Requests may be made by email to georgia@movetorise.com, and are answered as promptly as possible and in any event within one month of receipt, as provided for under the GDPR.

If you are not satisfied with how I have handled your data, you also have the right to lodge a complaint with the data protection supervisory authority in the country where you live.

10. Cookies

This website uses only those cookies that are strictly necessary for it to function — for example, to maintain the security of the site and to preserve your session while you browse. Cookies of this kind do not identify you, and they are not used to monitor your activity. As they are strictly necessary, your consent is not required for them under applicable law.

Beyond these, this website places no analytics, advertising or tracking cookies of its own. I do not track your browsing, either on this site or across others.

The free conversation page shows a booking calendar provided by Calendly. Opening that page connects you to Calendly, which sets its own cookies — including for its own analytics and marketing — under its own privacy policy. If you would rather not use it, you are welcome to write to me instead and we can arrange a time by email.

11. Children

This website and these services are intended for adults. I do not knowingly collect data from anyone under 18.

12. Changes to this policy

This policy may be updated. The current version is always on this page, with the date it was last updated. Where changes are significant, I will let existing clients know.

13. Contact

Georgia Baltag — georgia@movetorise.com.