Privacy Policy

1. Introduction

This Privacy Policy explains how Thatcham Massage (“we”, “us”, “our”) collects, uses, stores, and protects your personal information when you book or receive massage therapy services. We are committed to safeguarding your privacy and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

By using our services, you agree to the terms of this policy.

2. Information We Collect

We collect the following types of information:

• Contact details — name, phone number, email address, home address (if provided).
• Health information — medical history, relevant conditions, injuries, allergies, lifestyle information, and treatment notes.
• Booking and payment information — appointment history, payment confirmations (we do not store full card details).
• Communication records — emails, messages, or notes relating to your care or enquiries.

3. How We Use Your Information

We use your information to:

• Provide safe and appropriate massage therapy treatments.
• Maintain accurate clinical records.
• Manage bookings, cancellations, and reminders.
• Process payments and issue receipts.
• Communicate with you about appointments or relevant updates.
• Meet legal, regulatory, and insurance obligations.

We do not use your information for automated decision‑making or profiling.

4. Legal Basis for Processing

We process your personal data under the following legal bases:

• Consent — when you voluntarily provide information or agree to treatment.
• Legitimate interest — to run and manage the business effectively.
• Legal obligation — to maintain treatment records as required by law and insurance providers.
• Vital interests — in rare cases where information may be needed to protect your health.

Health information is classified as special category data, and we process it under the condition of providing health‑related treatment by a qualified professional.

5. How We Store and Protect Your Data

We take appropriate technical and organisational measures to protect your information, including:

• Secure, password‑protected digital systems.
• Encrypted devices and secure cloud storage (if used).
• Locked physical storage for paper records.
• Restricted access to authorised personnel only.

Treatment records are kept for a minimum of 7 years (or longer for minors, in line with legal requirements).

6. Sharing Your Information

We do not sell or share your information with third parties for marketing. We may share information only when necessary:

• With healthcare professionals, but only with your explicit consent.
• With insurers or legal authorities if required by law.
• With service providers such as payment processors or booking platforms, who must comply with data protection laws.

7. Your Rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you.
• Request corrections to inaccurate information.
• Request deletion of your data (subject to legal record‑keeping requirements).
• Restrict or object to certain types of processing.
• Withdraw consent at any time.
• Request a copy of your data in a portable format.

To exercise any of these rights, contact us using the details below.

8. Cookies and Website Use (if applicable)

If you use our website, we may collect basic analytics data or use cookies to improve functionality. You can manage cookie preferences through your browser settings.

9. Contact Details

If you have questions about this policy or wish to exercise your rights, please contact info@thatcham-massage.co.uk

10. Updates to This Policy

We may update this Privacy Policy from time to time. The latest version will always be available on our website or provided upon request.