We collect as little as the site can work with, we do not sell personal information to anyone, and we do not use it for advertising.
About us
James Schindler-Ord is the data controller for this website, registered with the Information Commissioner’s Office under number ZB398086.
You can write to us at 2 Sheila Robb House, Oak Place, Newton Abbot, Devon TQ12 2EX, or use the contact form on this site. Please mark anything about your personal information “Privacy” so that it reaches the right place.
Who this privacy notice applies to
Two groups, and the site treats them differently.
Visitors browse the directory, search it, and may send us a message. You do not need an account and we do not ask you to identify yourself.
Tutors and applicants hold an account. A tutor signs in and publishes their own profile and course listings. Somebody who has applied to join also holds an account, but it can do nothing at all until we have looked at them: no profile, no courses, nothing published. More information is involved for both than for a visitor, because an account requires it, and more again once there are pages to publish.
What we collect from visitors
- Your message, if you use the contact form: your name, your email address, a subject, and anything you write in the message box. That box is free text, so please do not put health details or anything else sensitive in it. If you do, we will handle it with the care it deserves, but the form is not built for it.
- A message you send to a tutor, if you use the “Send a message” form on their profile: your name, your email address, and your message. It goes straight to that tutor by email and is not stored on this website. So that one address cannot send an unlimited stream of messages, we keep a scrambled one-way code made from the sender’s email address for one hour. It cannot be turned back into the address and deletes itself.
- Security records. Our security software records the IP address of requests that look like attacks, and of failed sign-in attempts. This happens whether or not you have an account.
- A visit to a course or tutor page. We add one to a counter, so that the tutor can see how much interest their listing is getting. So that the same person is not counted twice in a day, we store a scrambled one-way code made from your IP address, the listing you looked at and today’s date. It cannot be turned back into your address, it is a different code tomorrow, and it is deleted automatically within 24 hours. Nothing is stored on your device, and nobody can work out from it who you are or what else you looked at.
- What you type into the “Nearest to” box, which is explained in its own section below, because it leaves this site.
We do not track you across websites and we do not build a profile of you. The visit counting described above is the only measuring this site does, it stays on this site, and it tells us nothing about who you are.
What we collect from tutors
- Account details: your name, email address and password. Passwords are stored by WordPress as a one-way hash, so nobody here can read yours. This applies from the moment an account exists, including while an application is still waiting to be looked at.
- What you publish: your profile, your photograph, your course listings, venues, dates, prices, and any website or contact links you choose to show. This is published deliberately and is visible to anyone.
- Photographs you upload, including any information saved inside the image file by your camera or phone.
- Sign-in records, including how long your session lasts. Tutor sessions run for 30 days.
How we use personal information
| What we do | Why we are allowed to |
|---|---|
| Publish tutor profiles and course listings | Legitimate interests: running a directory people can use, which is what tutors join it for |
| Reply to a message you send us | Legitimate interests: answering someone who has asked us something |
| Pass a message you write to the tutor you chose | Legitimate interests: putting you in touch with somebody you asked to contact |
| Run accounts, keep tutors signed in, and decide whether to approve a new one | Legitimate interests, and performance of our arrangement with that tutor |
| Count visits to a listing, so the tutor whose listing it is can see the interest in it | Legitimate interests: a tutor can see how their listing is doing, and nobody is identified |
| Log attacks and failed sign-in attempts | Legitimate interests: keeping the site and everyone’s information secure |
| Turn a course venue into map coordinates so courses can be sorted by distance | Legitimate interests: making the directory useful |
| Keep records we are required to keep | Legal obligation |
Legitimate interests
Where we rely on legitimate interests, we have weighed what we want to do against what you would reasonably expect and what effect it has on you. The interests are narrow: publishing a directory that tutors have asked to be listed in, answering enquiries that were sent to us, passing a message to the tutor it was written for, letting a tutor see how much interest their own listing is getting, and keeping the site secure. If you think that balance is wrong in your case, tell us and we will look at it again.
Finding courses near you
The “Nearest to” box works differently from the rest of the site and is worth explaining properly.
When you type a postcode or a place name into it, your browser contacts api.postcodes.io directly. What you typed, and your IP address, go to that service rather than to us. We never see what you typed and we do not store it. Postcodes.io is a free UK lookup service built on Ordnance Survey and Royal Mail open data. If you would rather not use it, simply do not use that box. Everything else on the site works without it.
Separately, when a tutor saves a course, our server sends the venue postcode or town to the same service to get its coordinates. That is a place, not a person.
Video and sound on member profiles
Some members show a video or a recording on their profile. These are not stored on this website. They stay on YouTube, Vimeo, SoundCloud or Mixcloud, where the member published them.
Until you press play, nothing at all is sent to any of those companies. The picture on the tile is held here and served from this site, so looking at a profile, or opening a video to see what it is, tells them nothing.
When you press play, the player is loaded from that company’s own website. From that moment they receive your IP address and some details about your browser, and they may store information on your device, as set out in their own privacy policies. This happens only when you choose to play something, and only with the company whose recording you chose.
We are not told what you play, and we receive nothing back from them.
Who we share personal information with
We do not sell personal information and we do not share it for marketing.
- Our hosting provider, NativeSpace, which stores this website and its database.
- Postcodes.io, as described above.
- The tutor you choose to message. A message sent through the form on a tutor’s profile goes to that tutor by email, with your name and email address, so that they can reply to you. Tutors are independent practitioners rather than part of Healing Drum: once your message reaches them they handle it under their own responsibility, and any reply happens between the two of you by ordinary email. We do not receive a copy.
- Our security software provider, which processes the IP addresses of suspicious requests in order to recognise attacks.
- Anyone at all, in the case of what a tutor publishes, because published pages are public.
- The authorities, if we are legally required to disclose something.
Visit counts are not shared with anyone. A tutor sees the figures for their own listings and nobody else’s.
Cookies and browser storage
We use only what the site needs in order to work.
- Sign-in cookies, set by WordPress when a tutor or an administrator signs in. If you never sign in, you never receive one.
- A preview cookie, used while the site is closed to the public so that someone holding a preview link can see it.
- Browser storage. The site remembers your place in a listing grid, and the order tutors were shuffled into, so that going back does not reshuffle everything. This stays in your browser, is never sent to us, and is cleared when you close the tab.
There are no analytics, advertising or tracking cookies on this site, which is why you are not asked to consent to any. The visit counting described above happens on our own server and puts nothing on your device. If that ever changes, we will ask first.
Automated decision-making
We do not make decisions about anyone by automated means. Nothing here profiles you, scores you, or decides anything about you without a person involved. The only thing the site works out on its own from what you type is which courses lie nearest to a place you asked about, and that is the order things appear in on a page, not a decision about you.
Where we store personal information
This website and its database are held by NativeSpace. Messages sent through the contact form are not stored on the website at all: they arrive in an ordinary mailbox. The same is true of messages sent to a tutor: they go straight to that tutor’s own mailbox and never rest on the website. We keep personal information in the UK or the EEA wherever we can, and where a provider stores it elsewhere we satisfy ourselves that appropriate safeguards are in place.
How long we keep personal information
- Messages sent through the contact form: for as long as they are useful, and no longer than two years.
- Messages you send to a tutor: not kept by us at all. The tutor receives your message by email and keeps it as their own.
- Tutor accounts and listings: for as long as that tutor is part of the directory. Ask us to remove your listing and we will.
- An account that was applied for and never approved: no longer than twelve months from the day it was created.
- The code that stops a visit being counted twice: deleted automatically within 24 hours.
- Visit counts themselves: kept as plain numbers with nothing attached to them. Day by day figures are kept for 90 days and a running total after that.
- Security logs: a short rolling period set by the security software, weeks rather than years.
- Anything we are required to keep by law: for as long as the law requires.
How we protect personal information
The site is served only over an encrypted connection. Sign-in attempts are rate limited, a firewall filters malicious requests, and passwords are stored hashed rather than as readable text. Accounts are given the least access they need: a tutor can edit their own listing and nobody else’s.
Your rights
You can ask us to give you a copy of your personal information, to correct it, to delete it, to restrict or object to what we do with it, or to provide it in a portable form. Where we rely on consent, you can withdraw it at any time.
Some of these rights have limits. We may not be able to delete something we are required to keep, and a tutor’s published listing exists because they chose to publish it.
Subject access requests
To ask for a copy of the personal information we hold about you, write to the address above or use the contact form, using the subject “Subject access request”. We may need to check who you are before we release anything. We will respond within one month, and will tell you if we need longer because the request is complex.
Data protection complaints
If you are unhappy with anything we do with your personal information, please tell us. Use the contact form on this site or the postal address above, marked “Privacy”. There is no form to complete and no particular wording you need to use.
We will acknowledge your complaint within 30 days. We will then take appropriate steps to investigate it, keep you informed of how it is progressing, and tell you the outcome without undue delay.
If you are not satisfied with our response, you can complain to the Information Commissioner’s Office at ico.org.uk, or by telephone on 0303 123 1113.
Links to other websites
Course listings link to booking pages and to tutors’ own websites, which are run by other people. Once you follow one of those links you are on someone else’s site, covered by their privacy notice and not by this one. We are not responsible for how they handle your information.
Changes to this privacy notice
If we change how this site handles personal information, we will update this page and change the date below.
Last updated: 14 August 2026