Privacy Policy
Last updated: August 13, 2025
This policy explains what information I collect through estherchelladurai.com and in the course of working with clients, how I use it, and what control you have over it.
I am a sole practitioner. There is no team, no marketing department, and no one else reading your messages.
Who this applies to
Services are offered to adults in the United States. I am not currently accepting clients located in the European Union or the United Kingdom.
What I collect
When you use the contact form Your name, email address, and whatever you write in the message field.
When you book or pay for a session Your name, email address, scheduling details, and billing information. Payment card details are handled directly by my payment processor. I never see or store your full card number.
When we work together Notes I take about our sessions, and an automated transcript of the session itself. These may include what you tell me about your health, your history, your stress, your sleep, your relationships, and your body. This is the most sensitive information I hold and I treat it that way. See the section on transcription and AI below.
When you visit the site Standard technical information collected by my website host, including IP address, browser type, pages viewed, and referring site. This is aggregate analytics, not individual tracking.
If you email me directly Whatever you send.
About health information
The contact form asks what is going on for you, and sessions involve discussing your physical and emotional state. That means the information I hold is likely to include health information.
Two things you should know:
I am not a HIPAA covered entity. HIPAA applies to licensed healthcare providers, health plans, and their business associates. I am a somatic facilitator and coach, not a licensed healthcare provider, so HIPAA protections do not apply to our work. I hold your information carefully anyway, and this policy describes how.
I do not currently collect wearable or biometric data. If that changes, I will ask for your separate written consent first, explain exactly what would be collected and why, and update this policy before any collection begins.
How I use your information
To respond to enquiries and schedule sessions
To deliver sessions and prepare for them
To process payments
To keep track of package sessions used and remaining
To send you administrative messages about your bookings
To send you newsletters or updates, but only if you have separately opted in
Transcription and AI
Sessions are transcribed. I use Google Meet's built-in transcription during online sessions. You are told this in your calendar invite, asked to confirm before your first session, and prompted by the platform itself at the start of each session. Transcripts are stored in my paid Google Workspace account. Google states that Workspace meeting data stays within the account and is not used to train Google's models.
I use AI assistants to help me work. Specifically, to summarise session notes and track patterns across my practice over time. I remove names and direct identifiers before doing this. I do not use AI during sessions, and I do not use it to make decisions about how to work with you.
You should know that removing a name does not make notes truly anonymous. Session content often includes details that could identify someone to a person who already knows them. I treat these notes as pseudonymised rather than anonymous, and I handle them accordingly.
You can opt out of any of this. You can decline transcription for a single session or permanently, and you can ask that no part of your notes ever passes through an AI tool. Either request is easy to accommodate and changes nothing about how we work together. Just tell me.
Who I share it with
I use third-party services to run the practice. Each of them handles some of your information in order to do their job:
Website hosting, contact form, and commerce: Squarespace
Payment processing: Squarespace Payments
Video sessions, transcription, email, and file storage: Google Workspace
AI assistants used for note summarising: Anthropic (Claude)
These providers have their own privacy policies. I choose them for their security practices, but I do not control them.
I do not sell your personal information. I do not share it for cross-context behavioural advertising. I do not trade, rent, or give your information to anyone for their own marketing purposes.
Beyond the service providers above, I will only disclose your information where I am legally required to, or in the limited safety circumstances described in the Terms of Service.
How long I keep it
Session transcripts: deleted 120 days after our last session. This matches the window in which package sessions expire, so once your sessions can no longer be used, the recording of them is gone too.
My own session notes: kept for 3 years after our last session, so that I have continuity if you come back to work with me later. These are my summaries, not verbatim records.
Contact form enquiries that do not become clients: deleted after 12 months
Payment and transaction records: kept as long as tax and accounting rules require, generally seven years
Newsletter subscriptions: until you unsubscribe
You can ask me to delete your information sooner. See below.
How it is stored
Session notes are kept in password-protected files. Devices are password-protected and encrypted. I use two-factor authentication on the accounts that hold client information.
No system is perfectly secure. If there is ever a breach affecting your information, I will tell you promptly and directly.
Your rights
Whoever and wherever you are, you can ask me to:
Tell you what information I hold about you
Give you a copy of it
Correct anything that is wrong
Delete it, subject to any records I am legally required to keep
Stop sending you marketing emails
To make any of these requests, email [esther@estherchelladurai.com]. I will respond within 30 days. I will not treat you differently for asking.
If you are in California
Under the California Consumer Privacy Act, as amended, California residents have the right to know what personal information is collected, used, and disclosed; the right to delete it; the right to correct inaccurate information; the right to opt out of sale or sharing; and the right to non-discrimination for exercising these rights.
I do not sell or share personal information as those terms are defined under the CCPA, so there is no opt-out to exercise. The categories of information I collect are identifiers, commercial information, internet activity information, and health-related information you choose to share with me. I collect it directly from you.
You may authorise someone else to make a request on your behalf. I may need to verify your identity before acting on a request.
If you are in New York
New York does not currently have a comprehensive consumer privacy statute equivalent to California's, but the rights described above are available to you on request regardless of where you live.
Cookies and analytics
The site uses cookies necessary for it to function, and analytics cookies via Squarespace Analytics. You can block or delete cookies in your browser settings. Blocking essential cookies may stop parts of the site from working.
Site imagery
Some images on this site were generated using AI tools. No client photographs appear anywhere on the site.
Children
This practice is for adults. I do not knowingly collect information from anyone under 18. If you believe a minor has submitted information through the site, contact me, and I will delete it.
Changes to this policy
If I change this policy, I will update the date at the top. If the change is significant and affects current clients, I will tell you directly rather than relying on you to notice.