How Authentic Self collects, uses, shares and looks after your personal information, and the rights you have over it.
Last updated: 10 October 2026Authentic Self is the trading name of Christopher Michael Armstrong, a sole trader. Authentic Self decides how your personal information is used, which makes us the "controller" of your information under data protection law.
Contact us about privacy: enquiries@authentic-self.co.uk. This is the best way to reach us about anything in this policy.
Telephone: 07539375167
Business address: Authentic Self, 130 Far Laund, Belper, Derbyshire, DE56 1FN, United Kingdom
We have not appointed a Data Protection Officer. Please send any privacy or data protection questions to the email address above.
Our website is authentic-self.co.uk. Our online shop was previously called Authenticrystals, and the old authenticrystals.com address now redirects here. Any customer information originally collected under that name is handled in line with this policy.
This policy explains what personal information we collect, why we collect it, who we share it with, how long we keep it, and your rights. It applies when you:
Our services, events and training are intended for adults aged 18 and over.
The contract terms for orders, bookings, events, training and digital products are set out in our Terms of Sale, Refunds & Returns. This policy deals with how your personal information is handled.
We only collect the information we need for the purpose concerned.
Messages and enquiries. Your name, contact details and what you tell us when you email us, message our Facebook or Instagram pages, or occasionally phone or text us. When you use the contact form on our website, your message is sent to our email inbox and a copy is also stored on our website.
Orders, bookings and accounts. Shop orders, one-to-one sessions, deposits and event places are all booked through our website shop. We collect the information needed for the booking or order: your name, billing and delivery addresses, email address, phone number, and what you ordered or booked. The online booking process does not ask for health information. If you create a customer account, we hold your account details and order history. If you request a password reset, the reset email includes the IP address the request came from.
Payments. You can pay through Stripe, PayPal or Klarna. Your payment is handled by the provider you choose, and their own privacy information explains how they use your details. We do not receive, write down or store your full card or payment details. Our website keeps a record of each order and payment, such as the amount, date and payment method.
Health and suitability information. Information about your health or circumstances that helps us check a session or activity is suitable and safe for you. This is normally gathered in person and recorded on paper. Section 4 explains this.
Session notes. Brief handwritten notes about your one-to-one sessions, such as what was covered and anything agreed, so we can provide continuity of support. These are written on the same paper form as your health questionnaire.
Business coaching and mentoring. Information about your business that you share with us, and brief handwritten notes of our sessions. We treat this as confidential.
Events. Your booking through our website shop is our main record of who has booked an event. At some events, people choose to give their details on a paper form.
Photographs and video at events. We may take photographs or video at events for our website and social media. We always ask before doing so (see section 7).
Training. Wayfinder Foundations and other courses are planned for the future. When training begins, we will hold students' booking details, attendance, coursework and assessment records, feedback, certification records, and reasonable administration records.
Free resources and digital products. When you request a free meditation, worksheet or resource, we collect your name and email address so we can send it to you. Your request is also stored on our website. We will only add you to our mailing list if you separately agree (see section 8). When paid digital products are available, we will also hold your order details and a record of the consent you give at checkout to receive them straight away.
Mailing list. Your name, email address and marketing preferences, held in Mailchimp.
Website use. Technical information such as your IP address, browser and how you use our website, collected through cookies and Google's analytics service (see section 10).
As part of your session or intake, we may ask about your health and circumstances. This may include:
Some of this is "special category" health information under UK data protection law. It is given extra protection, and we handle it with particular care.
We use this information only to:
Authentic Self provides complementary wellbeing, reflective and personal-development services. We are not a medical service. We do not diagnose conditions or provide medical treatment, and the information you share is not used for that purpose.
We do not ask for health information during online booking or payment. Relevant health and suitability information is normally discussed with you in person as part of your session, and recorded on a paper questionnaire. Session notes are handwritten on the same form.
These paper records are kept in a locked filing cabinet that only Chris Armstrong can access. They are not typed into a computer, our website or any electronic client-record system.
If you choose to mention health or other sensitive information in an email or message before you visit, we use it only to respond to you. We do not keep our inbox as a client record, and such messages are deleted once they are no longer needed.
We only ask for health information that is relevant, and we explain why we are asking. We will ask for your agreement before recording it on your questionnaire. You do not have to share it. If you choose not to, we may not be able to offer some services, or may need to adapt them, where we cannot be confident they are suitable and safe for you. You can withdraw your agreement at any time by telling us. This does not affect anything we did before you withdrew it.
Health information is never used for marketing, and it is not entered into general-purpose AI tools (see section 14).
What you share with us in sessions is treated as confidential. This includes health information, session notes, and business information shared in coaching or mentoring.
There are limited circumstances in which we may need to share information without your agreement:
In these situations, we share only what is necessary, and only with the people or organisations who need it. Where it is safe and lawful to do so, we will talk to you first.
This matches the confidentiality section of our Terms of Sale, Refunds & Returns.
Data protection law requires a valid reason, called a "lawful basis", for each way we use your information.
| What we use it for | Lawful basis |
|---|---|
| Processing orders, bookings, deposits, payments, delivery, returns and refunds | Contract: we need it to provide what you ordered or booked |
| Running your customer account | Contract |
| Supplying digital products you buy, and recording your consent to immediate supply | Contract, and legal obligation under consumer law |
| Training attendance, coursework, assessment and certification, when training begins | Contract |
| Health and suitability information | Contract, with your agreement to record the health information itself (see section 4) |
| Session notes | Legitimate interests: providing continuity of support. Any health information in them is handled as described in section 4 |
| Sending a free resource you requested | Legitimate interests: providing what you asked for |
| Marketing emails | Consent (see section 8) |
| Photographs or video of you at events | Consent |
| Replying to messages and enquiries | Legitimate interests: replying to you; or contract, where you are asking about an order or booking |
| Keeping financial and tax records | Legal obligation |
| Keeping records needed to deal with complaints, claims or insurance matters | Legitimate interests: protecting the business |
| Disclosures required by law, or to prevent serious harm | Legal obligation, or vital interests in an emergency |
| Measuring website traffic and engagement | Consent through our cookie banner, where required |
| Website security and keeping the site working | Legitimate interests |
Where we rely on legitimate interests, we have considered whether our interests are balanced against your rights. You can ask us about this.
We sometimes take photographs or video at events to share on our website and social media. We always ask before doing so. Attending an event does not mean you have agreed to be photographed or filmed, and you are welcome to say no.
If you change your mind after an image has been published, let us know. We will remove it from our website and our own social media pages where we can. We cannot control copies that other people have already shared.
We use Mailchimp to send our mailing list emails about news, events, offers and new resources. We only send marketing emails to people who have clearly agreed to receive them.
Every marketing email includes an unsubscribe link, and you can also unsubscribe by emailing enquiries@authentic-self.co.uk. Unsubscribing does not stop the messages we need to send about your orders, bookings or downloads, such as confirmations and event updates.
We never sell your personal information. We share it only where necessary to run our business and provide our services, to fulfil a contract with you, to comply with the law, or with your agreement. We share only what is needed.
Depending on how you deal with us, this may involve:
We do not routinely give attendee details to the venues where our events are held.
Facebook and Instagram. If you message us through Facebook or Instagram, those messages are handled by Meta under its own privacy policy. We do not control those platforms. We usually ask people to make bookings through our website.
Online sessions. We do not currently offer one-to-one sessions online. If we do in future, we will update this policy to explain the video service we use.
Cookies are small files stored on your device when you visit a website. We use CookieYes to show our cookie banner and record your choices. You can change your choices at any time.
Your account. If you log in to your customer account, cookies keep you logged in and remember your display choices. Login cookies last for two days, or two weeks if you choose "Remember me".
Embedded content. Some pages may include content such as videos from other websites. That content behaves as if you had visited the other website, which may collect information about you and use its own cookies.
Some of the services we use, such as payment, mailing-list, analytics and social media services, may process information outside the UK. Where this happens, the transfer must be permitted by UK data protection law. That means the destination is recognised by the UK as providing adequate protection, or appropriate safeguards are in place, such as approved contract terms.
We keep personal information only for as long as is reasonably necessary for the purpose it was collected for. That includes meeting any legal, accounting, insurance or legitimate record-keeping requirements. Different types of information are therefore kept for different lengths of time.
When information is no longer needed, it is securely deleted, destroyed or anonymised.
We take appropriate steps to protect your personal information.
Authentic Self may use artificial intelligence (AI) tools to support aspects of the business, such as developing and refining written content, research, communications, ideas and resources.
AI is used as a supporting tool only. It does not replace Chris Armstrong's professional judgement, human review or direct relationship with clients, participants or students.
Authentic Self does not intentionally enter identifiable confidential client information, private session notes or sensitive personal information into general-purpose AI tools.
If AI is used to help consider themes, situations or experiences arising through the work of Authentic Self, that information is first anonymised or generalised so that the individual cannot reasonably be identified.
Any personal information processed by Authentic Self remains subject to this Privacy Policy and applicable UK data protection requirements.
AI is not used to make autonomous decisions about clients or participants, diagnose individuals, determine suitability for services, or replace professional judgement.
Where AI assists with content, resources or communications, the resulting material is reviewed and, where appropriate, edited by Chris Armstrong before it is used or published.
For training or educational activities, AI will not independently assess students or make decisions about certification or the successful completion of training.
Where disclosure of AI use is legally required, or where failing to disclose its use could reasonably mislead someone about how material or a decision was produced, Authentic Self will provide appropriate information about that use.
Under UK data protection law, you have the right to:
We do not make decisions about you based solely on automated processing.
Some rights have limits. For example, we may need to keep financial records for tax purposes even if you ask us to delete them. If we cannot do what you ask, we will explain why.
To use any of these rights, email enquiries@authentic-self.co.uk. We may ask you to confirm your identity first. There is normally no charge. We will respond within one month. For complex or multiple requests, this can be extended by up to two further months, and we will tell you if that applies.
If you are unhappy with how we have handled your personal information, please contact us first at enquiries@authentic-self.co.uk. We will acknowledge your complaint, look into it and let you know the outcome.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk or on 0303 123 1113.
If there is a personal data breach, we will assess the risk it poses. Where the law requires it, we will report the breach to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it. If a breach is likely to result in a high risk to you, we will tell you without undue delay.
We may update this policy from time to time, for example when our services or the law change. The latest version will always be on this page.
Last updated: 10 October 2026
Back to topIf you have any questions about this policy or how we use your personal information, please get in touch.
Email us
Join the Authentic Self community and receive thoughtful guidance on healing, wellbeing, and finding your own way forward — delivered gently to your inbox.
Your details are safe with us. No spam — ever. Unsubscribe at any time.