Last Updated and Effective: 27 May 2026
Privacy policies are usually dense. This one tries not to be. If you have a question while reading and want a direct answer, write to privacy@naltherapy.com and Shainna or her team will reply within 5 working days.
For purposes of this Policy, "data" means any information that identifies you or could reasonably be used to identify you — name, email, phone number, intake answers, session notes, and the content of your communications with the practitioner. Under EU law (GDPR) this is called "personal data", and some of it (specifically clinical and health data) is called "special category data", which receives additional legal protection.
The data controller for your personal data is Neuro Alchemy Lab ("NAL"), a clinical practice founded and operated by Shainna, affiliated with C.Q.F.D. A.S.B.L. (a Belgian non-profit registered in Brussels, registration in progress). The data controller is responsible for deciding how and why your personal data is processed.
For all data-protection matters — including Subject Access Requests, consent withdrawal, and complaints — contact us at: privacy@naltherapy.com.
If you are not satisfied with how we handle a data concern, EU residents have the right to lodge a complaint with their national supervisory authority. Belgian residents may contact the Autorité de Protection des Données (APD/GBA) at autoriteprotectiondonnees.be. Residents of other EU member states may contact their own national data protection authority — a full list is available from the European Data Protection Board at edpb.europa.eu.
We collect only the data that is necessary for the specific purpose it serves. The table below sets out each category, what it contains, why we collect it, and the legal basis under GDPR.
| Type of data | What we collect | Why we collect it | Legal basis (GDPR) |
|---|---|---|---|
| Visitor Data | IP address, browser type, pages visited, time on site, referrer URL | To operate and improve the site; detect security threats | Art. 6(1)(f) — Legitimate Interest |
| Booking Form Data | First name, last name, email address, preferred language, session type, free-text message | To respond to the booking request and schedule a session | Art. 6(1)(a) — Consent; Art. 6(1)(b) — Contract |
| Intake Data | Name, contact details, emergency contact, medical/psychiatric history disclosed by client, presenting issues | To provide safe, informed clinical care | Art. 9(2)(a) — Explicit Consent (health data); Art. 6(1)(b) — Contract |
| Clinical Records | Session notes, dates of service, treatment plan, NAP-D axis mapping | To deliver clinical care and meet professional record-keeping obligations | Art. 6(1)(b) — Contract; Art. 6(1)(c) — Legal Obligation |
| Payment Data | Transaction records. We do not store full card numbers — payment is processed by to be filled in | To process and record payment | Art. 6(1)(b) — Contract |
| Newsletter Data (Lab Letter) | Email address, language preference, engagement data (opens, clicks) | To deliver the newsletter to subscribers who have opted in | Art. 6(1)(a) — Consent |
| WhatsApp Communication | Phone number, message content when you initiate contact via WhatsApp | To communicate with you via your chosen channel | Art. 6(1)(a) — Consent; Art. 6(1)(b) — Contract. Note: Meta is a joint processor for WhatsApp metadata. |
| Cookies and Analytics | See Section 5 below | See Section 5 below | See Section 5 below |
We do not collect data about race, ethnicity, political opinions, trade union membership, biometric identifiers, or genetic data. Where a client voluntarily discloses cultural, ethnic, or ancestral context as part of their clinical narrative, that disclosure is treated as part of the clinical record and handled under the special category data protections above.
NAL does not use any client clinical content — session notes, intake answers, written exchanges with the practitioner — to train any AI model, whether proprietary or third-party.
The practitioner may use AI tools for general administrative support (for example, drafting newsletter content or summarising public clinical literature). These uses never involve identifiable client data. Any text submitted to an AI tool for administrative purposes is first stripped of all identifying information.
If AI is used at any point in client-facing clinical work in the future — for example, AI-assisted note summarisation or translation — you will be notified in advance and explicit consent will be requested before any such use begins. This policy will be updated to reflect the change.
NAL does not sell client data. Ever. NAL does not share clinical content — session notes, intake answers, or the substance of communications — with any third party for advertising, marketing, or research purposes.
We work with a small number of service providers who may process personal data on our behalf. Each is listed below with the data they access and the reason:
A cookie is a small text file stored on your device by a website. Cookies help sites remember your preferences, measure how visitors use the site, and (on other sites) serve targeted advertising. Here is what we use and why:
For granular cookie controls and preferences, visit /sharing-settings.html.
We hold data only for as long as it is needed for the purpose it was collected, or as required by law. The specific periods are:
After the applicable retention period, data is securely deleted or anonymised so it can no longer be attributed to an individual.
If you are an EU/EEA resident, you have the following rights regarding your personal data. To exercise any of them, email privacy@naltherapy.com. We will respond within 5 working days and fulfil formal requests within 30 days as required by law.
For clients outside the EU — including those in MENA, Africa, and other regions — NAL extends these same rights as a matter of practice, even where local law does not require them. You have the same access to your data, the same right to correct or delete it, and the same right to a response within the same timeframes.
Some of the service providers we use are based in or transfer data to countries outside the EU/EEA — principally the United States. Where this occurs, we ensure the transfer relies on one of the safeguards recognised by GDPR:
The main providers involved in international transfers are: Google (Analytics, Meet) — covered by the EU–US Data Privacy Framework and SCCs; Meta/WhatsApp — SCCs; payment processor to be specified — SCCs or adequacy decision depending on provider; newsletter provider to be specified — SCCs or adequacy decision depending on provider.
You may request information about the specific safeguards in place for any transfer by writing to privacy@naltherapy.com.
NAL does not knowingly collect personal data from anyone under the age of 16. The site and Services are directed at adults. Family sessions that involve the presence of a minor are arranged only with the documented written consent of all legal guardians, and any personal data relating to the minor is collected only to the extent necessary for safe clinical care and is handled under the strictest confidentiality in accordance with Section 2 of these terms.
If you believe that personal data relating to a child has been submitted to NAL without appropriate consent, please contact us immediately at privacy@naltherapy.com and we will delete it promptly.
No system is perfectly secure. What follows is an honest account of the technical and organisational measures in place:
If you become aware of a potential security incident affecting your data, please contact privacy@naltherapy.com immediately. If we become aware of a breach that is likely to affect your rights, we will notify you and the relevant supervisory authority within 72 hours as required by GDPR Art. 33–34.
We will update this policy when our practices change, when we add new service providers, or when legal requirements evolve. The "Last Updated" date at the top of the page reflects the most recent revision; the version published at naltherapy.com/privacy.html is always the current version.
For significant changes — particularly those affecting how clinical data is processed — active clients will be notified directly by email at least 14 days before the change takes effect. Minor clarifications (corrections, updated provider names, formatting) may be made without advance notice.
For all privacy-related questions, data subject access requests, consent withdrawals, or complaints: privacy@naltherapy.com.
We aim to acknowledge all privacy enquiries within 5 working days. Formal Subject Access Requests are fulfilled within 30 days as required by GDPR Art. 12. Where a request is complex or numerous, we may extend this period by a further two months, in which case we will notify you of the extension and the reason within the initial 30-day window.
Postal address (correspondence only): C.Q.F.D. A.S.B.L., Brussels, Belgium. Registration is in progress; the full registered address will be added once available.