Privacy Policy & General Data Protection Regulation (GDPR)

The name and contact details of our organisation(s):

• Free Your Body Therapy
• 01553 277520
• info@freeyourbodytherapy.co.uk

Who is the Data Protection Officer (DPO)?

• Jane Cole

What data do we hold/collect?

• Your name
• Address
• DOB
• Health Conditions
• Fitness Lifestyle / Activities
• Email / Telephone / Contact details
• Payment Details

Health-related information is treated as special category data and is processed with additional care and appropriate safeguards in accordance with UK GDPR.

What does giving Consent mean?

• Consent means that the individual (you) has given clear consent for us, the business, to process your personal data for a specific purpose.

How did you get this data?

• ‘Explicit Consent’: You freely and knowingly provided your personal data when you booked a class/course/session or service from the organisations listed above, therefore you have given ‘Explicit Consent’ for us to hold your data for purposes of providing said service.
• ‘Informed Consent’: In addition, when booking a class/course/session or service from the organisations listed above, you will have been asked to give ‘Informed Consent’ for us to process your data for purposes of marketing.
  • You can at any point ‘Opt Out’ of receiving our marketing emails. 
  • After you unsubscribe, we will discontinue sending those messages as soon as technically feasible.

Surveys & Contests:

• From time to time, our organisations may request information from users via surveys or contests. Participation in these surveys or contests is completely voluntary, and the user therefore has the choice of whether to disclose this information.
• Information requested may include contact information (such as name and shipping address) and demographic information (such as postcode and age level). Contact information will be used to notify the winners and award prizes. Survey information will be used to monitor or improve the use and satisfaction with the websites.

Websites:

• When you visit the websites listed below, you will provide us with two types of information: personal information you knowingly choose to disclose that is collected on an individual basis, and information collected on an aggregate basis as you and others browse the websites. Please see the specific Website Privacy Policy for further details.

What is the lawful basis for processing my data?

We process your personal data in accordance with UK GDPR under the following lawful bases:

• Contract: To provide the services you have booked.
• Legitimate Interests: To operate, manage, and secure our business (including CCTV).
• Consent: For marketing communications and certain health-related information.

Broadly speaking, we use personal information for purposes of administering our business activities, providing the products and services you requested, to process your payment, to monitor the use of the service, our marketing and promotional efforts and improve our content and service offerings, and customise our site’s content, layout, services and for other lawful purposes. 

These uses improve our services and better tailor them to meet your needs.

How long do you keep my information? / When does the ‘Right to be Forgotten’ apply?

• The ‘Right to be Forgotten’ applies when the personal data is no longer necessary for the purpose for which we originally collected or processed it.
• However, please note that it is a condition of our Insurance Policy, and it is generally accepted UK-wide to take and retain client records. These records shall be kept for at least 7 years following the last occasion on which treatment/session was given.  In the case of treatment/session involving minors, it is advisable that records should be kept for at least 7 years after they reach the age of majority (18). After which, the information will be securely erased as requested.

How do you store my information?

• Your personal information is kept (if on paper) via a locked fireproof cabinet.
• If your personal information is kept online, it will be securely stored by those listed below.

Which online systems are my information stored in, and which have their own GDPR policies?

Booking Systems:

• Acuity
• Jane APP

Payment Systems:

• Paypal
• Stripe
• GoCardless

Other:

• Rehab My Patient (Free Your Body Therapy)
• Mailchimp (Marketing)

Who has access to my information?

• Only those who need to see your information to fulfil business requirements will see it.
• This will be the instructors/clinicians of Free Your Body Therapy.
• Personally identifiable information or business information will not be shared with parties except as required by law. 

What about legally compelled ‘Disclosure of Information’?

• We may disclose information when legally compelled to do so, in other words, when we, in good faith, believe that the law requires it or for the protection of our legal rights. 
• We may also disclose account information when we have reason to believe that disclosing this information is necessary to identify, contact or bring legal action against someone who may be violating our Terms of Service or to protect the safety of our users and the Public.

Can I see what information is held about me?

• Individuals have the right to access their personal data and supplementary information known as a ‘Subject Access Request’ or SAR.  
• Subject Access Requests are generally provided free of charge. A reasonable fee of up to £30 may be charged where requests are excessive, repetitive, or require additional copies.
• Information will be provided without delay and at the latest within one month of receipt.
• However, please note that you can access all the information we hold via your booking account. The above administrative fee would apply if you wish to have physical copies of such information.

Do you have CCTV, and what’s your policy?

• Yes, we have CCTV which covers the public areas of our businesses.
• Clear signage is displayed on the premises informing individuals that CCTV is in operation.
• All images are recorded 24 hours a day, 7 days a week, for the purpose of public safety and crime prevention.
• CCTV footage is retained for a maximum of 30 days unless required for the investigation of an incident, safeguarding concern, or legal/insurance purposes, after which it will be securely deleted.
• CCTV may capture images of children present on the premises. This is processed under our legitimate interest for safeguarding, safety, and incident management.
• Individuals have the right to request CCTV footage of themselves; this must be in writing to the DPO as per the Data Protection Act. An administrative £10 fee per request covers the administrative costs of providing the information.  Information will be provided without delay and at the latest within one month of receipt.
• Please note that there are circumstances in which we can legally refuse such a claim, such as when other people are seen in the footage or when there is a risk of jeopardising a criminal investigation.

Sharing & selling information:

• We do not share, sell, lend or lease any of the information that uniquely identifies a client (such as email addresses or personal details) with anyone except to the extent it is necessary to process transactions or provide services that you have requested.

Can I have my information updated?

• Most certainly yes. We request that your information be as up to date as possible so we can provide the best service possible.
• You have the right to have inaccurate personal data rectified, or completed if it is incomplete.
• You can make a request for rectification in writing.
• We have one calendar month from the date of receipt to respond to a request, although, for reasons stated above, we will endeavour to meet such a request as soon as possible.

Do you review the GDPR and privacy information?

• We may change this Privacy Policy from time to time. If / when changes are made to this privacy policy, we will email users who have given us permission to do so.
• We will post any changes here, so be sure to check back periodically.
• However, please be assured that if the Privacy Policy changes in the future, we will not use the personal information you have submitted to us under this Privacy Policy in a manner that is materially inconsistent with this Privacy Policy, without your prior consent.

Acquisition or changes in ownership:

• In the event that the website (or a substantial portion of its assets) is acquired, your information would be considered part of those assets, and may be part of those assets that are transferred.

Our commitment to data security:

• Your data is stored and processed within the United Kingdom in accordance with applicable data protection laws
• To prevent unauthorised access, maintain data accuracy, and ensure the correct use of information, we have put in place appropriate physical, electronic, and managerial procedures to safeguard and secure the information we collect online.
• This includes password-protected systems, restricted access to authorised personnel only, secure third-party platforms, and secure deletion of data when no longer required.

Your consent:

• By using our services, you consent to our collection and use of your personal information as described in this Privacy Policy.
• We reserve the right to amend this privacy policy at any time with or without notice.

Website & Cookies Policy:

Websites:

• When you visit the websites listed below, you will provide us with two types of information: personal information you knowingly choose to disclose that is collected on an individual basis, and information collected on an aggregate basis as you and others browse the websites.

Organisation Websites:

• freeyourbodytherapy.co.uk

Website Use Information:

• Similar to other commercial websites, our website utilises standard technologies, such as “cookies” (see explanation below) and web server log files, to collect information about how our website is used.
• Information gathered through cookies and web server logs may include the date and time of visits, the pages viewed, time spent at our websites, and the websites visited just before and just after ours listed above.

What are ‘Cookies’?

• A cookie is a very small text document that often includes an anonymous, unique identifier.
• When you visit a website, that site’s computer asks your computer for permission to store this file in a part of your hard drive specifically designated for cookies.
• Each website can send its own cookie to your browser if your browser’s preferences allow it, but (To protect your privacy) your browser only permits a website to access the cookies it has already sent to you, not the cookies sent to you by other sites. Browsers are usually set to accept cookies.
• However, if you would prefer not to receive cookies, you may alter the configuration of your browser to refuse cookies. If you choose to have your browser refuse cookies, it is possible that some areas of our site will not function as effectively when viewed by the users.
• A cookie cannot retrieve any other data from your hard drive or pass on computer viruses.

How do we use the information we collect from Cookies?

• As you visit and browse our website, it uses cookies to distinguish you from other users. In some cases, we also use cookies to prevent you from having to log in more than is necessary for security.
• Cookies, in conjunction with our Web server’s log files, allow us to calculate the aggregate number of people visiting our websites and which parts of the site are most popular.
• This helps us gather feedback to constantly improve our websites and better serve our clients.
• Cookies do not allow us to gather any personal information about you and we do not intentionally store any personal information that your browser provided to us in your cookies.

IP Addresses:

• IP addresses are used by your computer every time you are connected to the Internet.
• Your IP address is a number used by computers on a network to identify your computer.
• IP addresses are automatically collected by our web server as part of traffic data used to send data (such as the web pages you request) to you.

What about other websites linked to our website?

• We are not responsible for the practices employed by websites linked to or from our websites or the information or content contained therein. 
• Often, links to other websites are provided solely as pointers to information on topics that may be useful to the users of our websites.
• Please remember that when you use a link to go from our websites to another website, our Privacy Policy no longer applies. 
• Your browsing and interactions on any other website, including those linked from our website, are subject to that website’s own rules and policies. 
• Please read over those rules and policies before proceeding.

Nothing in these policies shall affect your statutory rights.

REVIEWED: 10th April 2026