Privacy Policy
This page explains what information I collect when you get in touch or book a massage, why I need it, how long I keep it, and what rights you have over it. Some of what I hold is health information, which the law treats as especially sensitive, so this policy sets out how that is handled.
Last updated: DRAFT — not yet published
Who is responsible for your information Needs input
North Peak Massage is the data controller for the information described on this page. That means I decide what is collected and why, and I am accountable for looking after it.
You can reach me about anything on this page at hello@northpeakmassage.com.
To finish this section: Confirm the legal trading name and status (sole trader?), the business address to publish for legal notices, and your ICO registration number once registered. Registration is almost certainly required — tier 1 is around £52/year.
What I collect
When you send an enquiry: your name, email address and/or phone number, the service you're interested in, your rough location, your message, and any health details you choose to include.
When you request a booking: your name, email address, phone number, postcode, the service, date, time and duration you'd like, plus any health conditions, problem areas, allergies and pressure preference you tell me about.
On the pre-visit form before a session: your full name, date of birth, gender, occupation, address and phone number; an emergency contact; your GP's name, surgery and phone number; any medical conditions or contraindications; medications you are taking; your reason for visiting; and your consent and signature. The date and time you submitted the form, and the IP address it was sent from, are recorded alongside it.
During and after a session: my own treatment notes — the areas assessed, what I observed or you reported, findings from movement and palpation, a functional score, and the treatment plan.
If we exchange emails about your appointment, a copy is kept against your client record.
Why I collect it, and my lawful basis
Contact and booking details are used to reply to you, arrange appointments and take payment. The lawful basis for this is contract — it is necessary in order to provide the service you have asked for.
Health information is used to decide whether massage is safe and appropriate for you, to plan and adapt treatment, and to keep a clinical record across sessions. Health data is 'special category' data under UK GDPR, so it needs an additional condition: I rely on Article 9(2)(h), processing necessary for the provision of health care and treatment. Your explicit consent is also recorded on the pre-visit form.
I do not use your information for marketing, and I do not sell or trade it.
How long I keep it Needs input
Treatment records are kept for a set period after your last session, because insurers and professional bodies require clinical notes to be retained in case a question arises later. Enquiries that don't lead to a booking are kept for a shorter period and then deleted.
To finish this section: Set the actual retention period — normally dictated by your insurer. Seven years after the last treatment is the most common figure in the sector; the CNHC requires eight years, or until a child client's 25th birthday. Also decide how long unconverted enquiries are kept (6–12 months is typical). This section should not be published without a real number.
Who it is shared with Needs input
Your information is not sold, and it is not shared for marketing.
A small number of service providers process data on my behalf in order to run the business: Google, which provides the email account used for booking correspondence and secures access to my admin system; and the hosting providers that run this website and the booking system.
I would only share your health information with another healthcare professional — your GP, a physiotherapist or similar — with your consent, or where required by law.
To finish this section: Confirm where the booking system and database will be hosted in production, so the provider and country of storage can be named, and whether data stays in the UK/EEA. Add any other tools you adopt (accounting software, payment processor, scheduling tools).
How it is kept secure
The admin system holding client records is locked to a single Google account — mine. There is no shared password, and sign-in is protected by the security on that Google account.
Access is default-deny: nothing in the booking system can be read without an active signed-in session, and that session is held in a cookie which website scripts cannot read. Signing out revokes it immediately.
The pre-visit form link sent to you is a single unguessable web address. It stops working seven days after your appointment, so an old email cannot be used to reach your health details indefinitely.
Public forms are rate limited to prevent automated abuse.
Your rights
Under UK GDPR you can ask me to: confirm what information I hold and give you a copy; correct anything inaccurate; delete information; restrict or object to how it is used; or provide it in a portable format.
There is no charge, and I will respond within one month. To make a request, email hello@northpeakmassage.com.
When deletion cannot be actioned in full
You can ask me to delete your information, but where I am required to retain clinical records for a set period, I cannot delete those notes until that period has passed. In that situation I will remove everything not covered by the retention requirement, stop using the remaining record for any other purpose, and delete it once the period expires. I will always tell you if this applies to your request.
If something goes wrong
If information is lost or disclosed in a way that could put you at risk, I will assess it promptly, report it to the Information Commissioner's Office within 72 hours where the law requires, and contact you directly if you are likely to be affected.
Cookies and analytics Needs input
This website does not set tracking or advertising cookies, and does not use analytics that profile visitors. Nothing here requires a cookie consent banner.
The pre-visit form uses a plain web link rather than a stored cookie to identify your booking.
To finish this section: Only accurate while the site stays free of analytics. If you add Google Analytics, a Meta pixel, embedded video, a chat widget or similar, this section must be rewritten and you will likely need a consent banner. Confirm nothing of that sort is planned before launch.
Complaints
If you are unhappy with how your information has been handled, please tell me first so I can put it right. You also have the right to complain directly to the Information Commissioner's Office, the UK regulator for data protection, at ico.org.uk or on 0303 123 1113.
Changes to this policy
If this policy changes, the revised version will be published here and the 'last updated' date changed. Where a change materially affects how your information is used, I will tell existing clients directly.