Privacy Policy

Effective Date: 31st August 2025

At Autumn Sunshine Massage, I am committed to protecting and respecting your privacy. This Privacy Policy explains how I collect, use, store, and protect your personal data when you visit my website, book an appointment, or receive massage therapy treatments from me.

1. Who I Am

I am a sole trader operating as Autumn Sunshine Massage, and I am the data controller responsible for your personal information.

 * Business Name: Autumn Sunshine Massage

 * Contact Email: autumnsunshinemm@gmail.com

 * Phone Number: 07751928648

 * Address / Location: 4 Esk Bank, Longtown, Carlisle, CA6 5PT

 * ICO Registration Number: ZB973609

2. What Personal Information I Collect

I may collect and process the following personal data:

 * Basic Contact Information: Name, email address, telephone number, address.

 * Appointment & Payment Details: Booking history, payment details, and appointment preferences.

 * Health & Medical Information (Special Category Data): Medical history, current physical conditions, injury history, allergies, medication, lifestyle details relevant to treatment, emergency contact details, and session/treatment notes.

3. How I Collect Your Information

I collect data directly from you when you:

 * Fill out a booking form or contact form on my website.

 * Complete an intake or health consultation form prior to or during your appointment.

 * Communicate with me via email, phone, text message, or social media.

4. Why I Collect Your Data and My Lawful Basis

Under the UK General Data Protection Regulation (UK GDPR), I rely on the following lawful bases:

 * Contractual Necessity: To book and manage your appointments, send booking confirmations and reminders, and provide massage therapy services to you.

 * Explicit Consent & Health Safety (Special Category Data): Processing health details is necessary for me to safely assess whether massage therapy is suitable for you (checking for contraindications) and to tailor treatments to your needs.

 * Legitimate Interests: To maintain proper business records and deliver good customer service.

 * Legal Obligation: To comply with legal, tax, and professional insurance requirements.

5. How I Store and Retain Your Data

 * Data Security: I take appropriate physical, technical, and organizational measures to ensure your data is stored securely. Digital records are password-protected, and any paper consultation forms are kept securely locked away.

 * Data Retention: I retain client consultation forms and treatment records for 7 years following your last treatment, in accordance with my professional insurance and legal requirements. After this period, your records will be securely destroyed or anonymized.

6. Sharing Your Information

I do not sell, rent, or trade your personal data to third parties. I may share limited data with trusted third-party service providers solely to run my business, such as:

 * Online booking or management platforms (Square)

 * Payment processing platforms (Square)

 * Website hosting providers (Reg123)

7. Your Data Protection Rights

Under UK GDPR, you have the right to:

 * Access: Request a copy of the personal data I hold about you.

 * Rectification: Request that I correct any inaccurate or incomplete information.

 * Erasure: Request the deletion of your personal data (subject to legal or insurance obligations requiring me to retain health records).

 * Restriction: Request that I restrict the processing of your personal data under certain conditions.

To exercise any of these rights, please contact me at autumnsunshinemm@gmail.com

8. How to Complain

If you have any concerns about my use of your personal information, you can contact me directly at autumnsunshinemm@gmail.com

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK regulator for data protection:

 * Website: https://www.ico.org.uk

 * Helpline: 0303 123 1113