1. Who we are

This Privacy Policy explains how Rachel Stevenson (“I,” “me,” or “we”), a sole proprietor based in New Hampshire, United States, and operating rachel-stevenson.com (the “Site”), collects, uses, shares, and protects personal information from visitors, clients, and newsletter subscribers.

I offer somatic coaching, breathwork facilitation, and related wellness education, working with clients individually and through content published on this Site and on social media.

Contact for privacy questions or requests:

• Email: rachel@rachel-stevenson.com

2. Scope

This policy applies to personal information collected through the Site, including contact and intake forms, newsletter sign-up, cookies and analytics, and any embedded tools (such as scheduling widgets or chat automations) used on the Site. It does not cover third-party sites you may reach through links on the Site, or platforms like Instagram, whose own privacy policies govern how they handle your data.

3. Information I collect

3.1 Information you provide directly

• Contact details: name, email address, and any details you include in a contact, intake, or inquiry form

• Session and coaching information: anything you choose to share with me in the course of booking or attending a session, which may include health, wellbeing, or personal history details you volunteer (see Section 4 on sensitive information)

• Newsletter sign-up: email address, and name if requested

• Any correspondence you send me directly by email

3.2 Information collected automatically

The Site is built on Squarespace, which automatically collects certain technical information when you visit, including:

• IP address and approximate location

• Browser type, device type, and operating system

• Pages visited, time spent on the Site, and referring/exit pages

• Cookie and similar tracking data (see Section 6)

This data is collected via Squarespace's built-in analytics and cookies. Squarespace acts as a data processor for this information; details are available in Squarespace's own privacy policy.

3.3 Information from third-party tools (keep only what applies)

• Google Analytics — if enabled, provides aggregated visitor and traffic statistics

• Meta/Facebook Pixel — if enabled, used to measure ad performance and build audiences for social advertising

• Email newsletter platform (Kit) — stores subscriber email addresses and engagement data (opens, clicks)

• Manychat or similar chat automation — if linked to the Site, may collect your Instagram handle and message content when you use a keyword-triggered flow

• Scheduling tools (Calendly) — if used, collects name, email, and appointment details

[Delete any bullet above for a tool you don't actually use, and add any tool that isn't listed — the policy should match your actual site setup.]

4. Sensitive information shared in coaching

Somatic coaching and breathwork sessions may involve you sharing information about your physical or mental health, nervous system history, or other sensitive personal matters. Several U.S. state privacy laws classify this as “sensitive data” requiring your opt-in consent before it's processed.

I only collect this information when you choose to share it with me directly (for example, during an intake form or session), and I treat your provision of that information, along with your engagement of my coaching services, as your consent for me to use it to support our work together. This information is:

• Never sold, rented, or used for advertising purposes

• Kept confidential and shared only with your explicit permission (for example, if you ask me to coordinate with another practitioner)

• Stored securely and retained only as long as needed for our working relationship, plus any period required by professional or tax record-keeping obligations

If at any point you'd like this information deleted, you can request that at the contact above, subject to the retention exceptions noted in Section 9.

5. How I use your information

I use personal information for the following purposes:

• To respond to inquiries and provide coaching services you've requested or booked

• To send the free nervous system guide or other resources you request

• To send newsletter content, if you've subscribed

• To understand how visitors use the Site and improve its content

• To meet legal, tax, and accounting obligations

I do not use your information for automated decision-making or profiling that produces legal or similarly significant effects, and I do not sell personal information or share it for cross-context behavioral advertising.

6. Cookies and tracking

Cookies are small text files placed on your device. The Site uses:

• Strictly necessary cookies — required for the Site to function (e.g. Squarespace security and load-balancing cookies). These don't require consent.

• Analytics cookies — used to understand aggregate visitor behavior (Squarespace analytics, and Google Analytics if enabled)

• Marketing cookies — used if the Meta/Facebook Pixel is active, to measure and personalize social media advertising

Where required by law, non-essential cookies are only set after you've given consent through the Site's cookie banner. You can withdraw or change consent at any time through that banner, or by adjusting your browser settings to block or delete cookies (note that blocking cookies may affect Site functionality).

7. Who I share information with

I don't sell personal information. I share it only with:

• Service providers who help me run the Site and business — for example, Squarespace (hosting), Kit, Calendly , and Manychat if used for Instagram automation. These providers process data on my behalf and are bound by their own privacy and security commitments.

• Legal authorities, if required to comply with a legal obligation, court order, or to protect the rights, property, or safety of myself or others

• A successor entity, in the event of a business transfer such as a sale or merger — you would be notified if this affected your data

8. International visitors

This Site and business are based in the United States, and personal information is processed and stored primarily in the U.S. by service providers such as Squarespace, Google, and Meta. If you're visiting from outside the U.S., your information will be transferred to and processed in the U.S., where data protection laws may differ from those in your home country.

For visitors in the EU or UK, where personal data is transferred out of the EEA or UK, I rely on the service providers' own compliance mechanisms, such as Standard Contractual Clauses approved by the European Commission or the UK's International Data Transfer Addendum, or their participation in the EU-U.S. Data Privacy Framework, to safeguard that transfer.

9. How long I keep your information

• Contact form and inquiry data: up to 24 months, or until you ask me to delete it

• Coaching client records: for the duration of our working relationship plus7 years, to meet standard professional and tax record-keeping practice

• Newsletter subscriber data: until you unsubscribe

• Analytics data: per the retention settings of the analytics tool in use (typically 14–26 months for Google Analytics)

[Fill in the bracketed retention period based on your own bookkeeping/tax advisor's guidance — the IRS generally recommends keeping business financial records for 3–7 years, though client session notes can follow a shorter period at your discretion.]

10. Your rights

Depending on where you live, you may have the following rights regarding your personal information:

10.1 New Hampshire residents

Under the New Hampshire Data Privacy Act (NHDPA), New Hampshire consumers have the right to:

• Confirm whether I'm processing your personal data, and access it

• Correct inaccuracies in your personal data

• Request deletion of your personal data

• Obtain a copy of your personal data in a portable format

• Opt out of targeted advertising, the sale of personal data, or profiling that produces legal or similarly significant effects

[The NHDPA's obligations formally apply to businesses that process the data of 35,000+ New Hampshire consumers annually, or 10,000+ consumers while deriving over 25% of revenue from data sales — thresholds a solo coaching practice is unlikely to meet. This section is included as a good-faith commitment to these rights regardless, which is generally good practice and builds trust with clients.]

10.2 California and other U.S. state residents

If you're a California resident, the CCPA/CPRA gives you the right to know what personal information is collected, request deletion or correction, and opt out of the sale or sharing of personal information. I do not sell personal information or share it for cross-context behavioral advertising. Residents of other states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and others) have similar rights, which I extend on the same basis described above.

10.3 EU and UK residents (GDPR)

If you're located in the European Economic Area or United Kingdom, the GDPR / UK GDPR applies when I process your personal data, even though the business itself is based in the U.S. In practice, this happens if you fill out a form, book a session, or subscribe to the newsletter from the EU or UK. For that processing, you have the right to:

• Access the personal data I hold about you

• Correct inaccurate or incomplete data

• Request deletion of your data (“right to be forgotten”)

• Restrict or object to certain processing, including for direct marketing

• Receive your data in a portable, machine-readable format

• Withdraw consent at any time, without affecting processing done before withdrawal

• Lodge a complaint with a supervisory authority in your EU member state, or with the UK Information Commissioner's Office (ICO) if you're in the UK

The legal basis I rely on depends on the purpose: your consent (for the newsletter, the free guide, and any sensitive information shared in coaching), performance of a contract (for booking and delivering a session), or legitimate interest (for basic site security and aggregate analytics). Where I rely on consent, you can withdraw it at any time by contacting me.

Because I don't have an establishment in the EU or UK and don't systematically monitor or target those markets, I haven't appointed an EU or UK representative under Articles 27 GDPR / UK GDPR; if that changes — for example, if EU/UK clients become a regular part of the business — this section will be updated accordingly.

To exercise any of these rights, contact me at the email address in Section 1. I'll respond within the timeframe required by applicable law (for New Hampshire, generally within 45 days, with a possible 45-day extension for complex requests).

11. Children's privacy

The Site and services are intended for adults. I don't knowingly collect personal information from anyone under 16. If you believe a child has provided personal information through the Site, please contact me so it can be removed.

12. Data security

I take reasonable technical and organizational measures to protect personal information, including relying on reputable providers (Squarespace, Google, and similar) that maintain their own security standards, and limiting access to client information to what's necessary for our work together. No method of transmission or storage is completely secure, and I can't guarantee absolute security.

13. Changes to this policy

I may update this Privacy Policy from time to time to reflect changes in my practices or legal requirements. The “Last updated” date at the top will reflect the most recent revision. For material changes, I'll post a notice on the Site or notify newsletter subscribers by email where appropriate.

14. Contact

Questions about this policy or your personal information can be sent to:

• rachel@rachel-stevenson.com