Privacy Policy

Who we are

Nature Therapy Hub is an online platform designed for outdoor, walk-and-talk and nature-based therapists.

Website: https://naturetherapyhq.co.uk

Privacy and support enquiries: [email protected]

Information we collect

The information we collect depends on how you use Nature Therapy Hub.

How we use information

We use personal information where necessary to:

• Provide and operate the Nature Therapy Hub website and Practice Hub
• Authenticate users and maintain secure access
• Deliver Practice Hub and Client Portal functionality
• Manage free trials and subscriptions
• Send operational and security-related emails
• Deliver Client Portal invitations, contracts, invoices and other therapist-initiated communications
• Operate safety check-in and emergency notification workflows
• Respond to enquiries and support requests
• Maintain audit, security and operational records
• Detect misuse, fraud or unauthorised access
• Improve platform reliability, usability and accessibility
• Comply with legal, regulatory and contractual obligations

Nature Therapy Hub does not sell personal information.

Client data and GDPR responsibilities

For client information entered into a therapist’s Practice Hub workspace, the therapist or therapy practice will normally act as the Data Controller.

Nature Therapy Hub normally acts as a Data Processor by storing and processing that information on behalf of the therapist.

Therapists are responsible for:

• Identifying an appropriate lawful basis for processing client information
• Providing relevant privacy information to their clients
• Obtaining consent where consent is required
• Managing access, accuracy, retention and disclosure of client records
• Responding to client data-protection requests where they are the Data Controller

Nature Therapy Hub provides a Data Processing Agreement setting out the responsibilities of Nature Therapy Hub and its customers when processing client information.

Where Nature Therapy Hub processes account, billing, security, support or website information for its own operational purposes, Nature Therapy Hub may act as the Data Controller for that information.

How data is stored and protected

Nature Therapy Hub uses cloud infrastructure and service providers, including Supabase, to operate the platform.

Security controls include:

• User authentication
• Encrypted connections using HTTPS and TLS
• Row Level Security policies
• Protected routes and server-side access checks
• Role-based permissions
• Private file storage
• Temporary signed download links
• Audit logging
• Secure password and authentication handling
• Restricted administrative access
• Monitoring and ongoing security review

Therapist workspaces are designed so authenticated users can only access records they are authorised to use.

Nature Therapy Hub does not expose privileged service-role credentials in the client-facing application.

No online system can guarantee absolute security. Nature Therapy Hub reviews and improves its technical and organisational safeguards as the service develops.

Uploaded files and route data

Documents, therapist logos, GPX route files and other uploaded files may be stored in private cloud storage.

Private files are not intended to be publicly accessible.

Where files are downloaded through the platform, Nature Therapy Hub may use temporary signed links that expire automatically.

Therapists are responsible for ensuring uploaded material is appropriate, lawful and necessary for their professional work.

Client Portal

Therapists may invite clients to access an invite-only Client Portal.

Depending on what the therapist shares, the Client Portal may display:

• Appointments
• Contracts
• Forms
• Shared resources
• Shared documents
• Invoices
• Therapist contact information

Nature Therapy Hub processes Client Portal data on behalf of the relevant therapist.

Clients should contact their therapist in the first instance about information displayed in their portal or requests concerning their therapy records.

Email communications

Nature Therapy Hub may send operational emails including:

• Account verification and password reset emails
• Trial and subscription notifications
• Client Portal invitations
• Appointment notifications
• Contract invitations and signature notifications
• Invoice and payment reminder emails
• Safety check-in alerts
• CPD renewal reminders
• Account deletion notifications
• Support and administrative communications

Email delivery may be provided through third-party email providers such as Resend.

Nature Therapy Hub does not send marketing communications without an appropriate lawful basis or consent where consent is required.

Payments

Nature Therapy Hub subscription payments may be processed through Stripe, including Stripe Checkout and the Stripe Customer Portal where enabled.

Therapists may also add their own bank transfer instructions or external payment links to client invoices.

Nature Therapy Hub does not collect or store client card details for therapist-issued invoices. Where a client follows an external payment link, the external payment provider’s own privacy policy and terms will apply.

Cookies

Nature Therapy Hub uses essential cookies required for authentication, security and core platform operation.

Optional analytics or preference cookies are only used in accordance with the choices made through the cookie controls.

Further information is available in the Cookie Policy.

Legal bases for processing

Depending on the information and purpose, Nature Therapy Hub may rely on one or more of the following legal bases:

• Performance of a contract
• Steps taken before entering into a contract
• Legitimate interests in operating, securing and improving the service
• Compliance with legal obligations
• Consent, where consent is required
• Establishment, exercise or defence of legal claims

Therapists are responsible for identifying the lawful basis that applies to the client information they control.

Data retention

Nature Therapy Hub retains personal information only for as long as reasonably necessary for the purpose for which it was collected, to provide the service, maintain security, resolve disputes and comply with legal obligations.

The Practice Hub uses a standard seven-year retention period as a record-management reference for therapist workspaces.

This setting does not replace the therapist’s own professional, legal, insurance, safeguarding or regulatory responsibilities.

Therapists remain responsible for deciding how long client records should be retained and whether longer or shorter periods are required in their circumstances.

Backups, audit records, security records or limited administrative records may remain for a restricted period after deletion where required for security, legal compliance, fraud prevention, dispute resolution or technical recovery.

Data export

Therapists can use the Data Export Centre to generate exports of information held in their Practice Hub workspace.

Exports may contain confidential or special-category client information. Therapists are responsible for storing exported files securely and limiting access to authorised people.

Account deletion

Therapists can request account deletion from the Settings area of the Practice Hub.

When deletion is requested:

• A 14-day grace period begins
• The Practice Hub becomes read-only
• Data export remains available during the grace period
• The deletion request can be cancelled before the scheduled deletion date
• Nature Therapy Hub may send reminder emails before deletion

At the end of the grace period, Nature Therapy Hub will attempt to delete the therapist account, associated Practice Hub records, therapist-scoped uploaded files and authentication account.

Deletion may be delayed or limited where information must be retained to comply with legal obligations, resolve disputes, prevent misuse, preserve security records or establish, exercise or defend legal claims.

Once data has been permanently deleted, it may not be recoverable.

Your data-protection rights

Depending on the circumstances and applicable law, individuals may have the right to:

• Be informed about how their information is used
• Request access to their personal information
• Request correction of inaccurate information
• Request erasure of information
• Request restriction of processing
• Object to certain processing
• Receive certain information in a portable format
• Withdraw consent where processing relies on consent
• Complain to the Information Commissioner’s Office

Requests concerning a therapist’s client records should normally be directed to the therapist or therapy practice acting as the Data Controller.

Requests concerning a Nature Therapy Hub account, website interaction, subscription or support correspondence can be sent to: [email protected]

Special-category information

Therapists may use the Practice Hub to store information concerning a client’s physical or mental health and other confidential therapy records.

This may constitute special-category personal data under the UK GDPR.

Nature Therapy Hub processes this information only to provide the Practice Hub service on behalf of the therapist.

Therapists must ensure they have both an appropriate lawful basis under Article 6 of the UK GDPR and an applicable condition under Article 9 where special-category information is processed.

International data transfers

Some service providers used by Nature Therapy Hub may process information outside the United Kingdom.

Where personal data is transferred internationally, Nature Therapy Hub uses appropriate safeguards as required by applicable data-protection law. These may include adequacy regulations, approved contractual safeguards or other lawful transfer mechanisms.

Service providers

Nature Therapy Hub may use trusted service providers to support:

• Database hosting
• Authentication
• File storage
• Website hosting
• Email delivery
• Payment processing
• Security, monitoring and operational support

Confirmed platform providers include Supabase for database, authentication and storage, Resend for email delivery where configured, Stripe for subscription payment processing, and Vercel for hosting and analytics where configured.

These providers may only process information as required to deliver their contracted services and are subject to appropriate contractual and security requirements.

Children’s information

Nature Therapy Hub is a professional platform intended for therapists and authorised clients.

Therapists may only add information relating to children or young people where they have an appropriate professional, legal and safeguarding basis for doing so.

The public Nature Therapy Hub website and therapist account service are not directed at children creating their own independent therapist accounts.

Changes to this Privacy Policy

Nature Therapy Hub may update this Privacy Policy to reflect changes in the platform, service providers, legal requirements or operational practices.

The latest version will be published on the Nature Therapy Hub website.

Where changes are significant, Nature Therapy Hub may provide an additional notice through the website, Practice Hub or email.

Contact and complaints

Questions about this Privacy Policy or Nature Therapy Hub’s handling of personal information can be sent to: [email protected]

Individuals also have the right to raise a concern with the Information Commissioner’s Office.