PRIVACY POLICY

At a Glance: Your Privacy Matters

I take your privacy and trust seriously. Here’s a simple overview of how I handle your information:

• Confidentiality first: I treat your personal and health information as confidential and only use or disclose it where there is a legitimate reason to do so, as explained in this Privacy Policy.

• Information I collect: Depending on the service you use, this may include your name, contact details, date of birth, address, emergency contact details, booking information, health information and treatment or session notes.

• Why I collect it: I collect information that is relevant and necessary to provide safe, appropriate and effective massage and yoga services, manage appointments and run my business.

• Stored securely: I take reasonable technical and organisational measures to protect your information from loss, misuse or unauthorised access.

• Trusted service providers: I use trusted providers, including Wix and Google email and other business-service providers, where necessary to operate my business. I do not sell your personal information.

• Your rights: You have rights in relation to your personal information, including rights to access and, in certain circumstances, correct, delete or restrict the use of your information.

• Marketing: Marketing emails are separate from appointment and service communications. Where consent is required, I will ask for it separately, and you can unsubscribe at any time.

• Cookies: My website uses cookies and similar technologies. Some are necessary for the website to function, while others may be used for analytics or other purposes depending on the services enabled on my website.

 

That’s the essence - open, respectful, and transparent.
The full details are explained below.

​

Who This Applies To

This Privacy Notice explains how I collect, use, store and protect personal information when you interact with Sally Gardner Yoga + Massage, including through my website, booking system, online forms, email and social-media channels.

When I say “you”, I mean a client, customer, prospective client or website visitor.

When I say “I”, “me” or “Sally Gardner Yoga + Massage”, I mean the business operated by me as a sole trader.

​

Data controller: Sally Gardner
Contact: hello@sallygardner.yoga

​

Information I Collect

Depending on how you interact with me, I may collect:

Contact and client information

• Full name

• Date of birth

• Address

• Email address

• Telephone number

• Emergency contact details, where appropriate

• Booking and appointment information

I may collect date of birth where it is relevant for age verification, accurate client identification, safeguarding or other legitimate business purposes.

I may collect your address where it is relevant to client administration, identification, insurance, legal or safety-related requirements.

​

Health and treatment information

When you book a massage or yoga service, I may ask for information such as:

• Relevant medical conditions

• Injuries or pain

• Relevant medication

• Allergies

• Pregnancy or other information relevant to treatment

• Reasons for seeking treatment

• Other information that may be relevant to providing safe and appropriate treatment

• Treatment or session notes

Some of this information may constitute special category personal data, because it relates to your health.

I aim to collect only health information that is relevant and necessary for the services I provide.

​

Communications and website information

I may also collect information you provide when you:

• Contact me by email

• Contact me by telephone

• Send me a message through social media

• Complete an online enquiry, booking or consultation form

• Use my website

When you use my website, certain technical information may also be collected automatically, such as your IP address, browser type, device information and website usage information, depending on the cookies and other technologies enabled on the site.

​

How Your Information Is Used

I use personal information for purposes such as:

• Responding to enquiries

• Managing bookings and appointments

• Providing massage and yoga services

• Assessing whether a treatment or activity is appropriate and safe

• Maintaining appropriate treatment and session records

• Communicating with you about your appointments and services

• Processing payments where applicable

• Managing my business and maintaining appropriate financial and accounting records

• Meeting legal, insurance and professional requirements

• Dealing with questions, complaints or requests concerning your information

• Improving my services and website, where appropriate

• Sending marketing communications where I have the appropriate legal basis to do so

I will not use your health information for unrelated marketing purposes.

​

My Lawful Bases for Using Your Information

UK data protection law requires me to have a lawful basis for processing personal information.

Depending on the circumstances, I may rely on:

• Contract or steps taken at your request: for example, managing a booking and providing services you have requested.

• Legal obligation: where I need to keep or provide information to comply with a legal requirement.

• Legitimate interests: where processing is necessary for legitimate business purposes and those interests are not overridden by your rights and freedoms.

• Consent: where consent is the appropriate legal basis, including certain optional activities such as marketing.

For health information, which is special category data, I also rely on an appropriate condition under Article 9 of the UK GDPR in addition to an Article 6 lawful basis.

I do not rely on consent simply because information is personal data. Where another lawful basis is more appropriate, I will use that basis.
 

Health Information

Some of the information collected through my consultation or health forms concerns your physical or mental health and is therefore special category personal data under UK data protection law.

I use relevant health information to help me:

• Assess whether massage or yoga is appropriate for you

• Identify relevant precautions or contraindications

• Provide services safely and appropriately

• Keep appropriate treatment or session records

• Respond appropriately to issues arising during or after a session

I only ask for health information that is relevant to the services I provide.

Where I rely on explicit consent as the relevant Article 9 condition, that consent will be obtained separately and clearly from other terms or marketing permissions.

​

Information Received Through Social Media

You may contact me through social-media platforms with questions or enquiries.

Please avoid sending detailed medical or other sensitive information through social media unless it is necessary.

Where an enquiry involves health information, I may ask you to continue the consultation through my booking or consultation process rather than discussing detailed health information through social media.

Social-media platforms are independent services and their own privacy policies also apply to information processed by them.

​

How Your Information Is Shared

I do not sell your personal information.

Where necessary to operate my business, I may allow trusted service providers to process personal information on my behalf. These may include providers of:

• Website and online-form services

• Booking and appointment services

• Email services

• Payment services

• Accounting or bookkeeping services

• Website analytics or other technical services

For example, my website and online forms are provided through Wix.

​

I may also disclose information where:

• I am legally required to do so

• It is necessary to comply with a legal obligation

• It is necessary to protect someone's vital interests or safety

• It is necessary for the establishment, exercise or defence of legal claims

• You have specifically requested or authorised the disclosure

Where appropriate, I take steps to ensure that service providers handling personal information provide appropriate protection for that information.

​

Confidentiality

I understand that clients may share sensitive and personal information with me.

I will treat your information confidentially and will only use or disclose it for legitimate purposes described in this Privacy Policy or where I am legally entitled or required to do so.

Confidentiality does not mean that information can never be disclosed. For example, there may be circumstances involving legal obligations, serious safety concerns or the protection of someone's vital interests where disclosure may be necessary.

Sometimes, anonymised or combined data (with no identifying details) may be used for supervision or service improvement purposes.

​

How Your Information Is Stored

I take reasonable technical and organisational measures to protect your personal information from:

• Unauthorised access

• Accidental loss

• Unauthorised disclosure

• Alteration

• Destruction or misuse

These measures may include password protection, device security, access controls, secure storage and keeping relevant software and services up to date.

​

How Long I Keep Your Information

I do not keep personal information indefinitely.

Different types of information may need to be retained for different periods depending on why it was collected and any applicable legal, tax, insurance or professional requirements.

I maintain a retention schedule and periodically review information to determine whether it is still necessary.

When information is no longer required, I will securely delete, destroy or anonymise it where appropriate.

Some information may need to be retained even if you ask for it to be deleted where there is a legitimate legal or regulatory reason for retaining it.

​

Children’s Privacy

My services are designed for adults. I don’t knowingly collect information from anyone under 16.
If you believe I have done so, please contact me immediately so I can remove the information.
 

Marketing

I may occasionally send emails about my massage and yoga services, availability, offers or other business updates.

Marketing communications are separate from emails relating to appointments or services you have requested.

Where consent is required, I will ask for marketing consent separately from other terms and privacy information.

You can unsubscribe from marketing emails at any time using the unsubscribe option provided in the email or by contacting me.

​

Cookies

My website uses cookies and similar technologies.

Some cookies are necessary for the website to function properly. Depending on the features and services enabled on my website, other cookies may be used for purposes such as analytics, performance or other website functionality.

I will provide information about the cookies used on my website and, where required, give you appropriate choices about non-essential cookies.

You can also manage cookies through your browser and, where available, the website's cookie settings.

​

Your Rights Under GDPR

Depending on the circumstances, you have rights under UK data protection law, including the right to:

• Ask whether I hold personal information about you

• Request a copy of your personal information

• Ask me to correct inaccurate or incomplete information

• Ask for your information to be deleted in certain circumstances

• Ask me to restrict how I use your information in certain circumstances

• Object to certain processing

• Withdraw consent where processing is based on consent

• Object to direct marketing

These rights are not absolute and some exceptions apply.

For example, I may need to retain certain information because of legal, insurance, accounting or other legitimate requirements.

To exercise any of these rights, please email hello@sallygardner.yoga. I’ll respond as soon as possible.

​

Data Security Incidents

If I become aware that personal information has been lost, accidentally disclosed, accessed without authorisation or otherwise compromised, I will assess the incident and take appropriate steps to contain and address it.

Where required by UK data-protection law, I will notify the Information Commissioner's Office and/or affected individuals within the applicable timescales.

​

Complaints

If you have concerns about how I have handled your personal information, please contact me first so that I have an opportunity to resolve the issue.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data-protection regulator.

​

Updates to This Policy

From time to time, this Privacy Policy may be updated to reflect changes in the law or in how I operate.
The latest version will always be available on this website.

If you have any questions about this Privacy Policy, please get in touch:
📧 hello@sallygardner.yoga