Privacy Policy

Massage for Wellness ("we", "us", or "our") is committed to protecting your privacy and ensuring your personal data is handled in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This Privacy Policy explains how we collect, use, store, and protect your personal information when you visit our website, contact us, or use our massage therapy services.

Data Controller: Caroline, Massage for Wellness
Address: 5 Vancouver Court, Smallfield, Horley, Surrey, RH6 9QZ
Email: [email protected]
Phone: 07986 476741

We may collect and process the following types of personal data:

Information you provide directly:

• Your name, email address, and telephone number when you contact us or submit an enquiry form
• Your preferred treatment type and session preferences
• Health information relevant to your massage treatment (such as medical conditions, injuries, or pregnancy status), which you provide during consultation

Information collected automatically:

• Technical data such as your IP address, browser type, operating system, and device information
• Usage data including pages visited, time spent on pages, and navigation paths
• Cookie data (see Section 6 below for full details)

We use your personal data for the following purposes:

• To provide our services: scheduling appointments, preparing for your treatment, and following up on your care
• To respond to enquiries: replying to messages submitted through our contact form, email, or telephone
• To improve our website: understanding how visitors use our site so we can enhance the user experience
• To comply with legal obligations: maintaining records as required by professional regulatory bodies and UK law

Legal bases for processing: We process your data under one or more of the following legal bases: your consent, performance of a contract (providing massage services), our legitimate interests (improving our services), or compliance with a legal obligation.

As a clinical massage practice, we may collect health-related information that constitutes special category data under the UK GDPR. This includes details about injuries, medical conditions, pregnancy status, or medications that may affect your treatment.

We process this data only with your explicit consent, which we obtain during your initial consultation. You may withdraw this consent at any time by contacting us directly.

Health data is stored securely and is only accessible to Caroline as your treating therapist. It is never shared with third parties unless required by law or with your explicit consent.

We do not sell, trade, or rent your personal information to third parties. We may share your data only in the following limited circumstances:

• Service providers: We may use third-party services for website hosting and analytics. These providers process data on our behalf and are contractually obligated to protect your information.
• Legal requirements: We may disclose your data if required to do so by law, regulation, or legal process.
• Professional referrals: If, with your consent, we refer you to another healthcare professional, we may share relevant health information to support your continued care.

Our website uses cookies — small text files placed on your device — to help us provide a better browsing experience. We categorise our cookies as follows:

You can manage your cookie preferences at any time by clearing your browser cookies and revisiting our site, at which point the cookie consent banner will reappear. You can also control cookies through your browser settings.

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:

• Contact enquiries: retained for up to 12 months after your last communication
• Client treatment records: retained for up to 7 years after your last appointment, in line with professional insurance and regulatory requirements
• Website analytics data: retained in anonymised form for up to 26 months

After the retention period, your data is securely deleted or anonymised.

Under the UK GDPR, you have the following rights regarding your personal data:

• Right of access: You can request a copy of the personal data we hold about you.
• Right to rectification: You can ask us to correct any inaccurate or incomplete data.
• Right to erasure: You can request that we delete your personal data, subject to any legal obligations we may have to retain it.
• Right to restrict processing: You can ask us to limit how we use your data in certain circumstances.
• Right to data portability: You can request your data in a structured, commonly used, machine-readable format.
• Right to object: You can object to our processing of your data where we rely on legitimate interests as our legal basis.
• Right to withdraw consent: Where we rely on your consent to process data, you can withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within one month.

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include secure storage of physical records, password-protected digital systems, and encrypted communications where possible.

While we strive to protect your personal information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security but are committed to maintaining the highest practicable standards.

Our website may contain links to external websites that are not operated by us. We have no control over the content and practices of these sites and cannot accept responsibility for their privacy policies. We encourage you to review the privacy policy of every site you visit.

Our services are not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately and we will take steps to delete it.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or regulatory guidance. Any changes will be posted on this page with an updated "Last updated" date. We encourage you to review this policy periodically.

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection:

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk

We would appreciate the opportunity to address your concerns before you approach the ICO, so please contact us first.

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact us: