Privacy Policy
The Cheshire Wellness Practice – Privacy Policy
(Last updated: 19th October 2026)
This Privacy Policy describes how The Cheshire Wellness Practice (“we”, “us”, “our”) collects, uses, and protects your personal data when you use our website at thecheshirewellnesspractice.com and when you receive treatments or services from us.
This policy is written to comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).
1. Who We Are
The Cheshire Wellness Practice is run by Gemma Gregory, who is responsible for your personal data (the “data controller”). You can contact us at:
- Location: Somerford, Cheshire
- Telephone: 07866 807654
- Email: hello@thecheshirewellnesspractice.com
2. Definitions
- “Personal Data” means any information relating to an identified or identifiable individual.
- “Special Category Data” means personal data revealing health information, and other categories given extra protection under Article 9 UK GDPR.
- “Service” refers to our website and the treatments/services we provide.
- “Service Provider” means any third party that processes data on our behalf (e.g. booking software, payment processors).
- “We”, “us”, “our” refers to The Cheshire Wellness Practice.
- “You”, “your” means the individual using our Service or receiving treatment from us.
3. Information We Collect
3.1 Contact and Booking Information
When you make an enquiry, book an appointment, or contact us, we may collect:
- Name
- Email address
- Phone number
- Address (where relevant, e.g. for invoicing)
- Appointment details and payment records
3.2 Health and Treatment Information (Special Category Data)
To provide massage, Indian head massage, aromatherapy facials, reiki, reflexology, Hopi ear candling and nutritional therapy safely, we ask you to complete a client consultation form before your first appointment and to update it periodically. This may include:
- Relevant medical history and current health conditions
- Medications and supplements you are taking
- Pregnancy status, allergies, injuries, or areas of sensitivity
- For nutritional therapy: diet and lifestyle information, food and symptom diaries, and any test results you choose to share
- Notes made during or after your treatment relevant to your care
This is special category data under UK GDPR, and we only collect it with your explicit consent, given when you complete and sign the consultation form. We process this data on the basis of Article 9(2)(h) UK GDPR (provision of health treatment) and Article 9(2)(a) (explicit consent), and it is subject to a duty of confidentiality.
You can withdraw consent at any time, but please note this may affect our ability to safely provide certain treatments.
3.3 Website Technical Information
Like most websites, the servers that host our website automatically record basic technical information when you visit, such as your IP address, browser type and the pages requested. This is used only to keep the website secure and working properly.
3.4 Cookies
Our website uses only the essential cookies needed for it to work. We do not use analytics, advertising or tracking cookies, so we do not ask for cookie consent.
If you book an appointment, our booking page displays a calendar provided by Acuity Scheduling, which sets its own cookies so your booking can be completed. These are covered by Acuity Scheduling’s own privacy policy.
You can block or delete cookies in your browser settings at any time, although some features, such as online booking, may not work without them.
4. How We Use Your Information and Our Legal Basis
| Purpose | Legal Basis |
|---|---|
| Booking and providing treatments | Performance of a contract with you |
| Assessing suitability for treatment / contraindications | Explicit consent (special category data) and provision of health treatment |
| Responding to enquiries | Legitimate interests / pre-contractual steps |
| Sending appointment confirmations and reminders | Performance of a contract |
| Sending marketing communications (e.g. newsletters, offers) | Consent (you can opt out at any time) |
| Keeping our website secure and filtering spam from our contact form | Legitimate interests |
| Complying with legal/tax obligations | Legal obligation |
| Maintaining records for insurance/professional body requirements | Legal obligation / legitimate interests |
We do not use your personal data for any purpose incompatible with the purposes listed above without notifying you and, where required, obtaining your consent.
5. Sharing Your Information
We do not sell your personal data. We use a small number of trusted service providers to run the practice:
- Acuity Scheduling, for online bookings, consultation and consent forms, and appointment reminders
- Google, for managing our appointment calendar
- Our card payment provider, connected through our booking system, to take payments for treatments
- Krystal Hosting, which hosts our website and email
- Akismet (Automattic), which checks messages sent through our contact form for spam
- WhatsApp (Meta), if you choose to contact us that way
- An email newsletter service, only if you have opted in to receive communications
We may also share information with:
- Professional bodies or insurers, where required for accreditation, complaints handling, or insurance purposes
- Law enforcement or regulators, where required by law
Where third parties process data on our behalf, we have agreements in place requiring them to protect your data and use it only for the purposes we specify.
Some of these providers, including Acuity Scheduling, Google, Automattic and Meta, are based in or store data in the United States. Where your data is transferred outside the UK, we make sure appropriate safeguards are in place, such as the UK–US data bridge, the UK International Data Transfer Agreement or UK adequacy regulations.
6. Data Retention
We keep personal data only as long as necessary for the purposes set out in this policy:
- Client consultation forms and treatment records: retained for 7 years from your last treatment, in line with professional body (e.g. FHT) and insurance recommendations.
- Booking and contact details: retained for the duration of our relationship with you, plus up to 24 months afterwards, to handle follow-up enquiries.
- Marketing consents: retained until you withdraw consent or unsubscribe.
- Website technical logs: kept by our hosting provider for a short period for security purposes.
- Financial records (invoices, payment records): retained for as long as required by HMRC (currently at least 6 years).
After these periods, data is securely deleted or anonymised, except where we are required to retain it for longer to comply with a legal obligation, establish or defend a legal claim, or where it exists in encrypted backups pending routine deletion.
7. Your Rights
Under UK GDPR, you have the right to:
- Access the personal data we hold about you
- Rectify inaccurate or incomplete data
- Erase your data (“right to be forgotten”), subject to our legal obligations to retain certain records
- Restrict processing in certain circumstances
- Object to processing based on legitimate interests or for direct marketing
- Data portability: receive your data in a portable format, where technically feasible
- Withdraw consent at any time, where processing is based on consent
To exercise any of these rights, please contact us using the details in Section 1.
If you are unhappy with how we have handled your data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at www.ico.org.uk or by calling 0303 123 1113. We would, however, appreciate the chance to address your concerns directly first.
8. Security of Your Personal Data
We take reasonable technical and organisational measures to protect your personal data, including confidential storage of consultation forms (physical and/or digital), with access limited to your practitioner. However, no method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security.
9. Children’s Privacy
Our services are for adults aged 18 and over. Our website is not directed at children, and we do not knowingly collect personal data from anyone under 18.
10. Links to Other Websites
Our website may contain links to third-party websites. We are not responsible for the content or privacy practices of these sites, and we encourage you to review their privacy policies.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will post any changes on this page and update the “Last updated” date. Where changes are significant, we will notify you directly (e.g. by email) before they take effect.
12. Contact Us
If you have any questions about this Privacy Policy, or wish to exercise any of your data protection rights, please contact us:
- By email: hello@thecheshirewellnesspractice.com
- By telephone: 07866 807654