Privacy Policy

1. Who we are

Lancara Ltd (Company No. 10854077, registered in England and Wales), registered office 181 Graham Road, Hackney, London E8 1PD, trading as Gemma Keaney (“we”, “us”, “our”), is the data controller for the personal data described here. We are registered with the Information Commissioner’s Office (ICO), registration number ZB270185.

Contact for anything about your data: [email protected].

This notice explains how we use personal data when you:

visit our website (www.gemmakeaney.com / www.gemmakeaney.co.uk); contact us or book an introductory call; receive therapy from us; buy or take part in our online programme, Same Dance, New Steps: Relationship Foundations for Couples, including as a named partner; sign up to receive emails from us.

2. The data we collect

What we collect depends on how you use our website and services. We only collect what we need, and the lists below show the most we may collect in each case.

A. Website visitors

We use Plausible, a privacy-friendly analytics service. It does not use cookies or identify you. It records things like pages visited, approximate country, device and browser type, in aggregate.

Our website host, Groove, also records page visits for its own platform statistics, using a tool called Matomo. We don't control this or see the data.

B. Enquiries

If you email us or use a contact form: your name, email address, phone number (if given), and anything you choose to tell us.

C. Therapy clients

To provide safe and effective therapy we may collect:

Identity and contact data: name, address, email, phone number, date of birth. Special category data (Article 9 UK GDPR): health information, medical history, medication details, trauma history, relationship and family information, assessment responses, session content and notes. Session notes are brief and stored securely.

D. Online programme: buyers

When you buy the programme (sold and hosted on Systeme.io, with payments by Stripe), we may collect:

Account and purchase data: name, email address, country, what you bought and when, price paid, any coupon used. Payment data: handled by Stripe. We see confirmation of payment and a reference, never your full card details. Consent records: the checkout records which boxes you ticked, the exact wording, the date and time, and your IP address and browser. We keep this as evidence of what you agreed to (for example, the version of the Programme Terms and your request for immediate access). Participation data: your login details, which lessons you have accessed or completed, and messages you send us through the platform or by email. Reflection exercises: the programme includes questionnaires and reflection exercises. These are for you alone: you complete and keep them yourself, and they are not sent to us. Feedback: if you choose to complete a feedback form (we use Tally), your answers. Feedback forms can be completed anonymously and ask you not to include personal details about yourself or your relationship. Testimonials: we will only publish a comment or testimonial with your specific permission, in the form you agree to (for example first name only, or anonymous).

E. Online programme: named partners

If someone buys the programme for themselves and their partner, the buyer gives us their partner’s name only. We don’t collect a partner’s email address or contact details. The buyer confirms they have their partner’s agreement to share it. We use it only to record who is entitled to take part under the purchase. Partners are told about this, with a link to this notice, at the start of the programme.

F. Introductory calls

If you book a free introductory call, we use Calendly to schedule it and Zoom to hold it. We collect your name, email address, the time you booked, and anything you choose to write in the booking form. Calls are not recorded. An introductory call is a conversation about whether the programme or our services might suit you; it is not therapy. Please don’t include sensitive personal or health details in the booking form.

G. Emails from us

If you sign up to our mailing list or register interest in the programme: your name and email address.

Emails we send through Systeme.io (including order, login and programme emails, and any newsletters) record whether they are opened and whether links in them are clicked. We use this only to check our emails are reaching people and to improve them. Some email apps block this, so the figures are approximate. Personal emails we send from our own mailbox are not tracked.

We don’t use your data for automated decision-making or profiling.

3. Why we use your data, and our lawful basis

Website analytics

Lawful basis: Legitimate interests (Art. 6(1)(f)): understanding and improving the site. No personal data identified.

Answering enquiries; arranging and holding introductory calls

Lawful basis: Steps at your request before a contract (Art. 6(1)(b)), or legitimate interests (Art. 6(1)(f)).

Providing therapy

Lawful basis: Contract (Art. 6(1)(b)); special category data under Art. 9(2)(h), provision of health or social care.

Keeping therapy records

Lawful basis: Legal obligation (Art. 6(1)(c)) and insurance/professional requirements.

Professional supervision

Lawful basis: Legitimate interests (Art. 6(1)(f)); anonymised, no identifiable information shared.

Selling and providing the programme, taking payment, giving access, service emails (login, access updates)

Lawful basis: Contract (Art. 6(1)(b)).

Recording a partner’s name

Lawful basis: Legitimate interests (Art. 6(1)(f)): knowing who is entitled to take part under a purchase.

Keeping consent records and financial records

Lawful basis: Legal obligation (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f)): being able to show what was agreed.

Improving the programme from feedback

Lawful basis: Legitimate interests (Art. 6(1)(f)).

Publishing testimonials

Lawful basis: Consent (Art. 6(1)(a)), which you can withdraw at any time.

Marketing emails

Lawful basis: Consent (Art. 6(1)(a)); or, for existing programme customers, emails about similar offers, which you can opt out of at any time (the “soft opt-in” under the Privacy and Electronic Communications Regulations).

About therapy records: we process therapy information to deliver therapy safely and to meet our legal and professional obligations, not on the basis of your consent. Records are kept in line with professional standards even if you withdraw consent for other uses.

4. Confidentiality and safeguarding (therapy clients)

All client information is treated as confidential. Confidentiality may be broken only where there is a risk of serious harm to you or others, where safeguarding obligations arise, where disclosure is required by law or court order, or where information relates to terrorism or other serious crime. Where possible, we will discuss this with you first. Supervision is anonymised.

5. Who we share data with

We share only what is needed, with:

Systeme.io: programme checkout, member area, course hosting and programme emails.
Groove Digital LLC (USA): hosts our website, and records page visits for its own platform statistics. It was also our previous programme platform; programme data there is kept only until all participants have moved to Systeme.io, then deleted.
Stripe: payment processing. Stripe acts as an independent controller for payment data, under its own privacy policy.
Calendly (scheduling) and Zoom (video calls) for introductory calls. Tally: feedback forms and questionnaires. Plausible: website analytics (no personal data).
Namecheap: our email provider.

Anthropic (Claude): an AI assistant we use for business admin, such as building our web pages. We don’t use it with your personal data, and never with therapy notes or health information.
Our accountants, under a data processing agreement, for financial records only. Professional advisers or authorities where the law requires it. 

We do not sell or rent personal data.

6. Cookies

Our website analytics (Plausible) do not use cookies, and on our site Groove's page statistics (Matomo) don't set cookies either. Our website sets one small functional cookie so that a pop-up isn't shown to you again on every visit. Videos on our pages play through Groove's own video player. The programme checkout and member area (Systeme.io) and payment pages (Stripe) use cookies that are strictly necessary to log you in, keep your session secure and process payment. Booking links take you to Calendly’s own site, which uses its own cookies under its own policy. We don't use advertising or social media tracking (such as a Facebook pixel). If that ever changes, we'll ask for your consent first.

7. How long we keep data

Therapy records

7 years from the end of therapy, then securely destroyed.

Enquiries and introductory call bookings that don’t lead to a purchase or therapy

12 months, then deleted.

Programme account, participation data and partner names

For as long as the purchase gives access, then 12 months, then deleted or anonymised.

Purchase records and checkout consent records

At least 6 years, as required by UK tax law and to show what was agreed. These can’t be erased on request while we’re required to keep them.

Feedback

Kept anonymised; any identifying details deleted after 12 months.

Testimonials

Until you withdraw permission.

Mailing list

Until you unsubscribe.

8. Security

We protect personal data with encrypted storage, password-protected systems with restricted access, and secure storage for any paper records, and we review our practices regularly. No online system is completely secure. If a breach affects you in a way the law requires us to tell you about, we will.

9. International transfers

Some providers process data outside the UK. Where this happens, we make sure it is protected to UK standards, using UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework (where a provider is certified), or the UK International Data Transfer Addendum.

10. Children

Our services and programme are for adults. We don’t knowingly collect data about anyone under 18.

11. Your rights

You have the right to be informed; to access your data; to have inaccurate data corrected; to erasure (subject to legal retention requirements); to restrict processing; to object to processing based on legitimate interests or for direct marketing; to data portability; and to withdraw consent at any time where we rely on consent.

To use any of these rights, email [email protected]. We’ll respond within one month.

12. Complaints

Please contact us first so we can try to put things right. You can also complain to the Information Commissioner’s Office: www.ico.org.uk, 0303 123 1113.

13. Changes to this notice

We may update this notice when our services or the law change. The current version will always be on our website, with the date it was last updated.

Updated November 1 2026