Privacy Notice & Data Protection Policy

Catherine Day Holistic Healthcare and Wellbeing

Last updated: [19/10/2026]

​

1. Introduction

Catherine Day Holistic Healthcare and Wellbeing respects your privacy and is committed to protecting your personal information.

This Privacy Notice explains how personal information is collected, used, stored and protected when you visit the clinic, book an appointment, receive a treatment or contact the business.

This notice applies to all services provided, including Swedish Massage, Clinical Massage, Sports Massage, K-Taping, Clinical Reflexology, Clinical Aromatherapy, Acupuncture, Remedial Massage and Deep Tissue Massage.

Personal information will be handled in accordance with applicable data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

​

2. Who Is Responsible for Your Information?

Data controller: Catherine Day Holistic Healthcare and Wellbeing

The data controller is responsible for deciding how and why your personal information is processed.

Contact email: [Insert your business email address]

Business address: [Insert your business address]

Please use these contact details if you have questions about this notice or wish to exercise your data protection rights.

​

3. What Information Do We Collect?

Depending on the services you use, we may collect the following information:

Personal and contact information

• Name, address, telephone number and email address.

• Appointment dates, booking history and relevant communications.

Health and consultation information

• Medical history and relevant health conditions.

• Symptoms, injuries, pain, allergies and sensitivities.

• Medication and relevant medical advice.

• Pregnancy-related information where relevant to treatment.

• Consultation forms, treatment notes, progress records and aftercare recommendations.

Booking and payment information

• Appointment and payment records.

• Transaction references and relevant billing information.

We aim to collect only the information necessary to provide appropriate services, manage appointments and meet our professional responsibilities.

​

4. How Do We Use Your Information?

Your information may be used to:

• Assess whether a treatment is suitable and identify potential contraindications.

• Plan and deliver treatments safely and appropriately.

• Maintain accurate consultation and treatment records.

• Provide aftercare advice and communicate about your appointments.

• Process payments, refunds and booking changes.

• Respond to enquiries, concerns or complaints.

• Meet applicable legal, professional and insurance obligations.

• Establish, exercise or defend legal claims where necessary.

Your personal information will not be used for unrelated purposes without an appropriate lawful basis.

​

5. Lawful Basis for Processing

We will identify and document an appropriate lawful basis for processing personal information under Article 6 of the UK GDPR.

Depending on the purpose, this may include:

• Contract: To manage bookings and provide services you have requested.

• Legal obligation: To meet applicable legal requirements.

• Legitimate interests: Where appropriate, for necessary business administration, protecting the business or managing legal claims, provided your rights do not override those interests.

• Consent: Where consent is the appropriate lawful basis for a particular activity.

Health information is classed as special category personal data and requires additional protection. We will identify an appropriate condition under Article 9 of the UK GDPR and any additional requirements under the Data Protection Act 2018.

Where explicit consent is relied upon for processing health information, it will be obtained separately and appropriately documented.

Consent to receive a treatment is separate from consent to process personal information.

​

6. How Is Your Information Stored and Protected?

We take reasonable and appropriate steps to protect personal information against unauthorised access, accidental loss, destruction, alteration or disclosure.

These measures may include:

• Secure storage of paper consultation forms and treatment records.

• Password protection and appropriate access controls for electronic records.

• Limiting access to information to authorised persons.

• Using reputable booking, payment and record-management providers where applicable.

• Secure disposal of paper records and deletion of electronic information when appropriate.

No method of electronic transmission or storage can be guaranteed to be completely secure. However, reasonable safeguards will be maintained in line with the sensitivity of the information held.

​

7. Who May We Share Your Information With?

We treat client information confidentially and do not sell personal information.

Information may be shared where necessary and lawful with:

• Booking, payment or record-management service providers.

• Professional advisers or insurers where relevant.

• Another healthcare professional where sharing is appropriate, lawful and properly authorised.

• Relevant authorities where disclosure is required by law or justified by a serious safety or safeguarding concern.

Only information necessary for the relevant purpose will be shared, and appropriate safeguards will be considered.

​

8. How Long Do We Keep Your Information?

Personal information will be retained only for as long as reasonably necessary for the purposes for which it was collected and to meet applicable legal, professional, insurance and record-keeping requirements.

Retention periods may differ depending on the type of record, the nature of the treatment, professional guidance and any legal requirements.

When information is no longer required, it will be securely deleted or destroyed, where appropriate.

Before publication: The business should establish and document its actual retention periods for consultation forms, treatment notes, booking records and financial records rather than relying on an unspecified period.

​

9. Your Data Protection Rights

Under applicable data protection law, you may have the right to:

• Access: Request a copy of your personal information.

• Rectification: Ask for inaccurate or incomplete information to be corrected.

• Erasure: Request deletion where the legal conditions are met.

• Restriction: Ask for certain processing to be restricted.

• Objection: Object to certain types of processing.

• Data portability: Request your information in a portable format where this right applies.

• Withdraw consent: Where processing relies on consent, withdraw it at any time without affecting the lawfulness of processing before withdrawal.

These rights are subject to applicable conditions and exemptions. For example, information may need to be retained where there is a lawful reason to do so.

To exercise your rights, please contact us using the details in Section 2. We may need to verify your identity before responding.

​

10. Marketing Communications

Your treatment and consultation information will not be used for marketing without an appropriate lawful basis and, where required, your consent.

If you choose to receive marketing communications, you may opt out at any time.

Photographs, testimonials or other identifiable information will not be used for promotional purposes without appropriate permission and compliance with applicable data protection requirements.

​

11. Cookies and Website Information

When you visit our website, cookies or similar technologies may be used by the website or its service providers.

The information collected will depend on the website's actual configuration. Where required, consent will be requested before non-essential cookies or tracking technologies are used.

Please refer to any separate cookie notice displayed on the website for further information.

​

12. Data Breaches

If a personal data breach occurs, we will assess the incident and take appropriate steps to contain it, minimise harm and meet applicable reporting obligations.

Where the law requires notification to the Information Commissioner's Office or affected individuals, the necessary notifications will be made within the applicable time limits.

​

13. Complaints and Concerns

If you have concerns about how your personal information has been handled, please contact us first so that we can review and respond to your concern.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data protection regulator.

Website: https://ico.org.uk/

​

14. Changes to This Privacy Notice

This Privacy Notice may be updated to reflect changes in our services, data-handling practices or legal requirements.

The current version will be made available on our website. Where a material change affects how personal information is processed, additional information will be provided where required.

​

15. Contact Us

For questions about this Privacy Notice, the information we hold about you, or your data protection rights, please contact:

Catherine Day
Catherine Day Holistic Healthcare and Wellbeing

Email: [Insert your business email address]

Address: [Insert your business address]

Thank you for trusting us with your personal information. We are committed to treating your information with care, respect and confidentiality.