Your story is yours.

Who is responsible for your data

bawhi (Maryam) is the data controller. You can contact me about your data at hello@bawhi.com.

The short version

• I only collect what's needed to arrange and provide your sessions.
• I never sell your information or use it for marketing.
• This website doesn't use tracking or advertising cookies.
• You can ask to see, correct or delete your information at any time (subject to legal record-keeping duties).

What I collect, and why

When you send a message

Your name, email address and your message, used only to reply to you. Legal basis: your consent, which you can withdraw at any time.

When you book a session

Your name, email address and phone number, plus booking and payment records. Used to arrange your appointments, send confirmations and reminders, and meet financial record-keeping duties. Legal basis: taking steps to enter into, and performing, our contract; and legal obligation for financial records.

If we work together

Brief notes from our sessions. Because these relate to your health, they're "special category" data and are handled with extra care. Legal basis: confirm, e.g. UK/EU GDPR Article 6(1)(b) and Article 9(2)(h), provision of health care by a professional under a duty of confidentiality.

Confidentiality and its limits

What you share in sessions is confidential. There are a small number of exceptions where I may have to share information, for example, if there's a serious risk of harm to you or someone else, a safeguarding concern about a child or vulnerable adult, or a court order. Wherever possible I'd discuss this with you first. Read more in the FAQ.

Who else handles your data

I use a small number of trusted services, each bound by a data processing agreement:

• Cal.com, for online booking (standard version, which may store data in the United States)
• Zoom, for online sessions
• Contact form service: name
• Mollie, for payment links
• Email (hello@bawhi.com), for messages and booking confirmations

Cal.com and Zoom may process data in the United States. Add the safeguards in place (for example EU Standard Contractual Clauses or the EU–US Data Privacy Framework) once confirmed.

How long I keep it

Messages that don't lead to a booking, and records of our sessions, are kept only for as long as they're needed and as long as the law requires, then securely deleted.

How it's protected

This site is served over an encrypted connection (HTTPS), and your information is kept in secure, password-protected accounts that only I can access.

Your rights

You have the right to access, correct, delete or restrict the use of your information, to object to its use, to receive a copy in a portable format, and to withdraw consent at any time. To use any of these rights, just email me. If you're unhappy with how your data is handled, you can complain to the data protection authority in your country. In the Netherlands, that's the Autoriteit Persoonsgegevens.

Cookies

This website does not use analytics, advertising or tracking cookies, so there's no cookie banner to click through. It doesn't load fonts or scripts from third-party servers.

The booking calendar on the booking page is provided by Cal.com. It only loads when you click "Show available times" (or open it in a new tab), and that service may set its own cookies, which are needed to make your booking. You can read Cal.com's privacy policy.