Last updated: June 2026

This Privacy Policy explains what personal information we collect, why we collect it, how it is used, and your rights in relation to it. We are committed to protecting your personal data and comply fully with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who We Are

This website is operated by Susan Hancock, trading as The Reflexology & Pilates Studio. Susan Hancock is the data controller responsible for your personal data.

Name: Susan Hancock
Business: The Reflexology & Pilates Studio

If you have any questions about how we handle your data, please contact us using the details above.

2. What Personal Data We Collect

We may collect and process the following types of personal data:

• Name, address, date of birth, telephone number, and email address.
• Emergency contact details.
• GP name and practice details.
• Health and medical information, including current and past medical conditions, medications, allergies, pregnancy status, and any other information relevant to your treatment or participation in Pilates.
• Treatment notes and session records.
• Payment records.
• Enquiry and correspondence records, including emails and messages sent to us.
• Website usage data collected via cookies (see Section 8).

3. How We Collect Your Data

We collect personal data in the following ways:

• When you complete a health consultation or registration form before a reflexology treatment or Pilates session.
• When you make a booking, whether online, by telephone, or by email.
• When you contact us with an enquiry or complaint.
• When you use our website, through cookies and analytics tools.
• When you purchase a gift voucher or make a payment.

4. Why We Use Your Data

We use your personal data for the following purposes:

• To provide safe and effective reflexology treatments and Pilates sessions tailored to your individual needs.
• To maintain accurate client records and health histories.
• To contact you about your appointments, including confirmations and reminders.
• To process payments and manage bookings and cancellations.
• To respond to your enquiries and complaints.
• To comply with our professional and legal obligations.
• To send you occasional information about our services, events, or offers — only where you have given us your prior consent. You may opt out at any time.

5. Our Legal Basis for Processing

Under UK GDPR, we must have a lawful basis for processing your personal data. We rely on the following:

• Contract performance — to provide the services you have booked and to manage your account.
• Legitimate interests — to maintain client records, manage our business, and improve our services.
• Legal obligation — to comply with applicable legal requirements, including HMRC record-keeping.
• Explicit consent — for special category health data (such as medical history and treatment notes), we will ask you to sign a consent declaration. You have the right to withdraw this consent at any time, though this may affect our ability to provide treatment safely.

6. Special Category Data

Because reflexology and Pilates are health-related services, we collect and process special category data under UK GDPR Article 9. This includes information about your physical and mental health, medical history, and medications. We process this data only with your explicit consent and only for the purpose of providing our services safely. This data is treated with the highest level of care and confidentiality.

7. Who We Share Your Data With

We do not sell, rent, or share your personal data with third parties for marketing purposes. We may share your data only in the following limited circumstances:

• Where required by law or a regulatory authority.
• With your GP or another healthcare professional, only with your express consent and where a referral or medical concern makes this necessary.
• With a locum or cover therapist or instructor, only where necessary to deliver your booked service, and subject to the same confidentiality obligations.
• With our booking or payment platform providers, where necessary to process your appointment or payment. These providers are required to handle your data securely and in accordance with UK GDPR.

8. Cookies & Website Data

Our website uses cookies — small text files stored on your device — to help the site function properly and to understand how visitors use it. We may use the following types of cookies:

• Strictly necessary cookies, which are essential for the website to work and cannot be switched off.
• Analytics cookies, which help us understand how visitors interact with our site so we can improve it. These collect data anonymously.
• Functional cookies, which remember your preferences to improve your experience.

You can manage or disable cookies through your browser settings at any time. Please note that disabling certain cookies may affect the functionality of the site.

9. How Long We Keep Your Data

We retain your personal data only for as long as is necessary for the purpose for which it was collected.

• Client records, including health consultation forms and treatment notes, are retained for a minimum of 7 years from the date of your last appointment, in line with professional practice guidelines.
• Financial and payment records are retained for 6 years in accordance with HMRC requirements.
• Enquiry records where no appointment was made are deleted within 12 months.
• Marketing consent records are kept for as long as you remain opted in, or until you withdraw consent.

10. How We Keep Your Data Safe

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or damage.

• Paper records are stored securely under lock and key.
• Digital records are password protected and accessible only to authorised individuals.
• We do not store card payment details.

11. Your Rights

Under UK GDPR you have the following rights in relation to your personal data:

• The right to access — you can request a copy of the personal data we hold about you.
• The right to rectification — you can ask us to correct any inaccurate or incomplete information.
• The right to erasure — you can ask us to delete your data, subject to our legal obligations.
• The right to restrict processing — you can ask us to limit how we use your data.
• The right to data portability — you can request your data in a structured, commonly used format.
• The right to object — you can object to us processing your data on the basis of legitimate interests.
• The right to withdraw consent — where we rely on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact Susan Hancock by email or post. We will respond within one calendar month. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at www.ico.org.uk if you believe your data is not being handled correctly.

12. Third-Party Links

Our website may contain links to external websites. This Privacy Policy applies only to our website. We are not responsible for the privacy practices of any third-party sites and encourage you to read their privacy policies before sharing any personal data with them.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated date at the top. We encourage you to check this page periodically. Continued use of our website or services after any update constitutes acceptance of the revised policy.

Contact Us

If you have any questions about this Privacy Policy or how we handle your personal data, please get in touch:

You also have the right to contact the Information Commissioner’s Office directly at www.ico.org.uk or by calling 0303 123 1113.