Privacy Notice

Last updated: 21/09/2026

Range of Motion Massage Ltd ("we", "us", "our") provides sports and remedial massage therapy in Chorleywood and at client and workplace locations. We are committed to protecting your personal information and handling it responsibly.

This notice explains what personal information we collect, why we collect it, who we share it with, how long we keep it and what rights you have. We comply with the UK GDPR and the Data Protection Act 2018. We pay the data protection fee and are registered with the Information Commissioner's Office (ICO).

Who we are

Range of Motion Massage Ltd is the data controller for the personal information described in this notice.

·       Company: Range of Motion Massage Ltd

·       Postal address: 46 Heronsgate Road, Rickmansworth, WD3 5BB

·       Email: jo@rangeofmotionmassage.co.uk

If you have a question about this notice or wish to exercise your data protection rights, please contact us by email in the first instance.

What personal information we collect

Depending on how you contact and book with us, we may collect:

·       Identity and contact information — name, email address, telephone number and, where relevant, postal address.

·       Booking information — appointment dates and times, treatment type, location, and your treatment preferences.

·       Health information — relevant medical history, injuries, symptoms, conditions, medications, allergies and contraindications, where this is necessary to assess whether treatment is suitable and to deliver it safely.

·       Treatment records — consultation responses, our clinical notes, treatment provided, and any aftercare advice.

·       Payment and financial information — records of payments made, invoices and receipts. We do not store your full card details.

·       Correspondence — messages you send us by email, text, contact form or social media.

·       Website information — limited technical and usage information collected through cookies, as described under Cookies and our website below.

We collect this information directly from you. For workplace events, an employer or organiser may give us limited administrative details — see Corporate and workplace wellbeing events below.

Why we use your information, and our legal basis

We only use your personal information where we have a lawful basis under UK GDPR.

To arrange and provide your treatment — including taking bookings, carrying out consultations, assessing suitability, delivering treatment, keeping treatment records and providing aftercare.
Basis: contract, and steps taken at your request before entering a contract.

To take payment and keep financial records — processing payments, issuing invoices and maintaining accounting records.
Basis: contract, and legal obligation for tax and accounting purposes.

To meet our legal and professional obligations — including record keeping required by our insurer and professional body, responding to complaints, and dealing with legal or insurance claims.
Basis: legal obligation, and legitimate interests in defending our position.

To run and improve our practice — responding to enquiries, maintaining the security of our website and systems, understanding how our website is used, and improving our services.
Basis: legitimate interests. We balance these interests against your rights and freedoms.

To send you marketing about our services — appointment reminders of a marketing nature, offers and practice news, sent through Cliniko.
Basis: consent. We only send marketing to people who have opted in, and you can withdraw consent at any time using the unsubscribe link in any message or by emailing us.

Health information

Information about your health is "special category" personal information and receives additional protection under UK GDPR.

We collect health information only where it is necessary to decide whether massage treatment is appropriate for you, to adapt treatment safely, to obtain your informed consent, and to keep an accurate treatment record. We keep it confidential and limit access to the therapist providing your care.

You are not obliged to give us health information. However, if you withhold information we need to judge whether treatment can be given safely, we may need to adapt your treatment or may be unable to provide it.

Who we share your information with

We do not sell your personal information or share it for anyone else's marketing.

We use trusted service providers who process information on our behalf under contract:

Provider

What they do

Cliniko (Red Guava Pty Ltd)

Our practice management system — online booking, consultation forms, treatment records and marketing emails

Squarespace

Hosts our website and provides website analytics

PayPal

Processes card and online payments where you choose to pay that way

Google Workspace

Our business email

Apple iCloud

Secure storage of business documents

Our bank

Processing bank transfer payments

We may also share information with:

·       Our accountant, for bookkeeping, accounts and tax purposes.

·       Our insurer and professional association, and where necessary our legal advisers, if there is a complaint, incident or claim.

·       Regulators, law enforcement or other authorities, where we are legally required to do so or where necessary to protect someone's safety.

Storing your information outside the UK

Your treatment records held in Cliniko are stored on servers in the United Kingdom.

Cliniko is an Australian company and uses some service providers based outside the UK, including in Australia and the United States. Where information is transferred outside the UK, it is protected by appropriate safeguards, including a data processing addendum incorporating Standard Contractual Clauses. Cliniko has appointed a UK representative for data protection matters (how Cliniko complies with UK GDPR).

Some of our other providers, including Squarespace, Google and Apple, may also process information outside the UK under equivalent safeguards.

Corporate and workplace wellbeing events

Where we provide massage or wellbeing sessions at an employer's workplace, at an event, or at another third-party venue, the following applies in addition to the rest of this notice.

We are independent. Range of Motion Massage Ltd is the data controller for your booking, consultation and treatment information. We are not acting as your employer's occupational health provider, and we do not assess or report on your fitness for work. Your employer is separately responsible for its own staff communications and event administration.

What the organiser gives us. The organisation hosting or funding the event may give us limited administrative information, such as the event date, venue, room arrangements and an organiser contact. We do not ask your employer to give us your health information.

How you book. You book your own appointment through a private booking link, entering your own details directly into our system. Your employer does not see what you enter.

What we collect from you. Before treatment we may ask about your health, relevant medical history, injuries, symptoms, allergies and contraindications. We use this only to assess whether treatment is suitable, to obtain your consent, to adapt the session where appropriate, to keep an accurate record and to protect your safety.

What we will never tell your employer. Your consultation responses, health information and treatment notes are confidential. We do not share them with your employer, manager, colleagues, the event organiser or other participants. We will not tell your employer whether you attended, whether you were unsuitable for treatment, whether your treatment was adapted or stopped, or the reasons for any such decision.

What we do give your employer. We provide only limited operational information, such as the total number of appointment slots offered and used, event timing, and invoicing information. Where feedback is collected, we share it only in anonymous, summarised form. None of this identifies you or reveals anything about your health.

Participation is voluntary. You may choose not to take part, not to provide information, or to stop or decline treatment at any point, without giving a reason and without your employer being told.

How we protect your information

·       Treatment records and booking information are held in Cliniko, a secure practice management system with encrypted access.

·       Our devices and accounts are protected by strong passwords and, where available, two-factor authentication.

·       Access to consultation and treatment information is limited to the therapist providing your care.

·       Business documents are stored in secure, access-controlled cloud storage.

How long we keep your information

Record type

Retention period

Adult treatment records and consultation forms

7 years from your last appointment

Treatment records for clients under 18

Until the age of 26 or 7 years whichever is the latter

Financial and accounting records

6 years plus the current tax year

Marketing contact details and consent records

Until you withdraw consent, then a minimal record that you opted out

Email correspondence

Normally no longer than 2 years, unless it relates to a treatment record, complaint or claim

Corporate event records (risk assessments, venue checklists, invoices)

6 years from the event

We may keep information for longer where necessary for an ongoing complaint, insurance matter or legal claim, or where the law requires it. Where records are no longer needed, we securely delete or anonymise them.

Your rights

You have the right to:

·       Be informed about how we use your personal information — this notice.

·       Access the personal information we hold about you.

·       Correct inaccurate or incomplete information.

·       Erasure of your information, where applicable. This does not apply where we are required to keep clinical or financial records.

·       Restrict how we use your information in certain circumstances.

·       Object to processing based on our legitimate interests, and to direct marketing at any time.

·       Data portability, where applicable.

·       Withdraw consent at any time where we rely on consent, including for marketing.

To exercise any of these rights, email jo@rangeofmotionmassage.co.uk. We will respond within one month. We may ask you to confirm your identity first.

Cookies and our website

Our website is hosted on Squarespace. It uses two kinds of cookies:

·       Essential cookies, which are needed for the site to function.

·       Analytics and performance cookies, set by Squarespace, which help us understand how visitors use the site.

Analytics and performance cookies are not placed until you agree to them. When you first visit, a cookie banner lets you accept all cookies, decline non-essential cookies, or choose which categories you accept. You can change your choice at any time using the cookie preferences link on our site.

We do not use Google Analytics, and we do not use the Meta (Facebook) Pixel or any other advertising or tracking pixel on our website.

We use Google Search Console, which provides aggregated information about how our site appears in Google search results. It does not identify individual visitors.

Changes to this notice

We may update this notice from time to time. The date at the top shows when it was last changed. Where changes are significant, we will take reasonable steps to bring them to your attention.

How to complain

If you are unhappy with how we have handled your personal information, please contact us at jo@rangeofmotionmassage.co.uk so we can try to put it right.

You also have the right to complain to the Information Commissioner's Office at any time. You do not have to contact us first.

·       Website: https://ico.org.uk/

·       Helpline: 0303 123 1113