Privacy Policy

Last Updated: September 2026

BlossomnHeal, operated by Shambhavi Nagaraj, located in Wormer, North Holland, Netherlands, is responsible for the processing of personal data as outlined in this Privacy Policy.

We take your privacy seriously and handle your data with strict confidentiality in compliance with the General Data Protection Regulation (GDPR / Algemene Verordening Gegevensbescherming - AVG) and applicable Dutch legislation.

1. Identity and Contact Details

• Business Name: BlossomnHeal

• Founder / Data Controller: Shambhavi Nagaraj

• Location: Wormer, North Holland, Netherlands

• KvK Number: 92025625

• Contact Email: shambhavi@blossomnheal.com

• Website: https://www.blossomnheal.com

2. Personal Data We Collect

Depending on how you interact with BlossomnHeal, we collect and process the following categories of personal data:

• Contact & Identification Details: Full name, email address, phone number, and location/country.

• Scheduling Information: Appointment dates, times, time zone, and intake responses submitted during booking.

• Billing & Payment Details: Invoice address, chosen payment method, transaction IDs, and payment status (note: full card/banking details are handled securely by our payment processor and never stored on our servers).

• Session Records & Content:

  • Audio/video recordings (only if explicitly agreed upon).

  • Meeting transcripts and session summaries generated during or after our calls.

  • Private notes and breakthrough diagnostic worksheets taken by the coach/facilitator to track your progress and support your coaching journey.

• Technical Data: Basic IP addresses, browser information, and website analytics data collected through cookies (where permitted).

3. Legal Grounds for Processing (GDPR Article 6)

We only process your personal data when we have a valid lawful basis under the AVG/GDPR:

1. Performance of a Contract (Art. 6(1)(b)): To deliver booked coaching, consulting, or facilitation sessions, schedule calls, issue invoices, and communicate regarding services.

2. Consent (Art. 6(1)(a)): For generating audio/video transcriptions, recording sessions, or subscribing to our email newsletters. You can withdraw your consent at any time.

3. Legal Obligation (Art. 6(1)(c)): To comply with Dutch administrative and tax retention laws (fiscale bewaarplicht) enforced by the Dutch Tax Authorities (Belastingdienst).

4. Legitimate Interest (Art. 6(1)(f)): To improve service delivery, maintain secure digital operations, and protect against fraudulent activities.

4. How We Collect and Use Your Data

• Appointment Booking (Calendly): When you schedule a session, your name, email, and booking intake answers are processed through Calendly.

• Video Sessions & Transcriptions (Zoom): Sessions are conducted via Zoom. Transcriptions, session summaries, or notes generated during or following meetings are processed solely to facilitate your coaching engagement, track breakthroughs, and provide continuity across sessions. These materials are treated as strictly confidential.

• Invoicing and Payments (Mollie): Invoices and payments are processed via Mollie B.V., a licensed Dutch payment service provider. Mollie processes your billing details, transaction status, and payment method in compliance with European banking security standards (PCI-DSS).

• Direct Communication: Email correspondence regarding your appointments, follow-ups, or inquiries.

5. Data Processors & Third-Party Sharing

We never sell, rent, or trade your personal data. We only share information with trusted third-party service providers (Data Processors) strictly necessary to deliver our services:

• Scheduling: Calendly, LLC

• Video Conferencing & Transcription: Zoom Video Communications, Inc.

• Payment Processing: Mollie B.V. (Netherlands)

• Website Hosting & Forms: Hostinger

• Cloud Storage & Administration: Google Workspace (Google Docs/Sheets/Drive)

Where third-party providers process data outside the European Economic Area (EEA), appropriate safeguards are implemented in accordance with GDPR requirements (such as Standard Contractual Clauses - SCCs, and Data Privacy Framework compliance).

6. Retention Periods

We retain personal data only as long as necessary to fulfill the purposes for which it was gathered:

• Session Notes, Summaries & Transcriptions: Retained for the duration of your active coaching program and up to 2 years following the conclusion of your sessions, after which they are permanently deleted, unless requested earlier by you.

• Administrative and Financial Records: Invoices, payment confirmations, and client billing details are retained for 7 years to satisfy statutory obligations mandated by the Dutch Tax Authority (Belastingdienst).

• General Inquiries & Correspondence: Retained for up to 1 year after resolution.

7. Security of Your Data

We implement appropriate technical and organizational measures to safeguard your personal data against unauthorized access, loss, or unlawful processing:

• Use of password-protected, encrypted accounts and two-factor authentication (2FA) across scheduling, payment, and storage platforms.

• Confidential handling of all coaching notes, session worksheets, and transcriptions.

• Secure HTTPS/SSL encryption across all website forms and transactions.

8. Your Legal Rights (Under the AVG / GDPR)

Under European privacy law, you have the following rights regarding your personal data:

• Right of Access: You may request a copy of the personal data we hold about you.

• Right to Rectification: You may ask us to correct inaccurate or outdated information.

• Right to Erasure ("Right to be Forgotten"): You may request that we delete your data, provided it is not required for statutory tax retention.

• Right to Restriction of Processing: You may request that we temporarily halt processing certain data under specific circumstances.

• Right to Data Portability: You may request your data in a structured, commonly used machine-readable format.

• Right to Withdraw Consent: Where processing relies on consent (e.g., session transcription or recordings), you may revoke it at any time.

To exercise any of these rights, email your request to: [Insert Contact Email Address]. We will respond within 30 days.

9. Complaints

If you believe that your personal data is not being handled in accordance with the law, please contact us first so we can resolve the issue. Under the GDPR, you also have the right to file an official complaint with the Dutch Data Protection Authority:

Autoriteit Persoonsgegevens (AP)

Postbus 93374

2509 AJ Den Haag

Website: https://autoriteitpersoonsgegevens.nl

10. Amendments

We reserve the right to amend this Privacy Policy to reflect operational, technical, or legal changes. The latest version will always be published on this page with an updated revision date.