top of page
Decorative

Privacy Policy 

Last Updated: September 2026

 

1. Introduction

Welcome to the Privacy Policy for Phoenix Bodyworks. I respect your privacy and I am committed to protecting your personal data. This privacy notice informs you how I look after your personal data when you visit my website, use the online booking system, or undergo treatments, and tells you about your privacy rights under the UK GDPR and the Data Protection Act 2018.

 

2. The Data I Collect About You

Personal data means any information about an individual from which that person can be identified. I may collect, use, store, and transfer different kinds of personal data about you, categorised as follows:

  • Identity & Contact Data: Includes your first name, last name, email address, and phone number.

  • Financial & Transaction Data: Includes details about payments made by you for services. Online payments are securely processed by Wix as a third-party provider. I do not store or have access to your full credit or debit card details.

  • Special Category (Health) Data: Includes details about your physical health, medical history, contraindications, injuries, or pregnancy status. I only collect this with your explicit consent to ensure your massage treatment is entirely safe and appropriate.

 

3. How I Use Your Personal Data

I will only use your personal data when the UK law allows me to. Most commonly, I use your data in the following circumstances:

  • Performance of a Contract: To manage your online booking, process your payment, and deliver your requested massage service.

  • Consent: Where you have given explicit consent (specifically for storing and processing your medical and health data).

  • Legitimate Interests: Where it is necessary for my business functions, such as sending appointment reminders or managing business records.

  • Legal Obligation: Where I need to comply with a legal or regulatory obligation.

 

4. How Your Health Data is Handled

Because I collect health data, I implement extra protection:

  • I use your medical history strictly to design a safe treatment plan and rule out any medical contraindications.

  • Your medical notes and intake forms are stored securely online through Jotform. These are never shared with third parties without your explicit permission.

 

5. Data Disclosures

I do not sell your data. I only share your data with essential third-party services that enable my business to run, specifically:

  • Wix - My website host, booking platform manager and Our secure checkout provider).

  • My professional insurance providers or legal advisors, strictly if required by law or a claims process.

 

6. Data Retention & Security

I have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorised way.

In accordance with UK professional indemnity insurance guidelines and legal frameworks for health practitioners, your consultation records and treatment notes will be retained securely for a period of 7 years following your last treatment session. After this period, they will be permanently and securely destroyed.

 

7. Your Legal Rights

Under UK data protection laws, you have specific rights regarding your data, including the right to:

  • Request access to your personal data (a "data subject access request").

  • Request correction of any incomplete or inaccurate data I hold about you.

  • Request deletion of your personal data (subject to my legal requirements to retain medical records for insurance purposes).

  • Withdraw consent at any time where I am relying on consent to process your data.
     

If you wish to exercise any of these rights, please contact me directly.

 

8. Contact Details & ICO Registration

Phoenix Bodyworks is the Data Controller responsible for your personal data.

  • Email Address: Carly@phoenix-bodyworks.co.uk

  • Business Address: 18 Gandy Street, Exeter EX4 3LS

  • Information Commissioner's Office (ICO) Registration Number: ZB148226

bottom of page