PRIVACY POLICY

Alicky Pilates and Wellness

Last updated: 1 November 2026

1. Introduction

Alicky Pilates and Wellness is committed to protecting the privacy, confidentiality and security of your personal information.

This Privacy Policy explains how we collect, use, store and protect your personal information when you use our physiotherapy services, attend Pilates classes, book treatments or interact with our website and online booking system.

We process personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Data (Use and Access) Act 2025 and other applicable data protection legislation.

As an HCPC-registered physiotherapist, we also recognise our professional responsibilities regarding confidentiality, clinical record keeping and the protection of patient information.

2. Who is responsible for your information?

Alicky Pilates and Wellness is the data controller responsible for the personal information collected and processed in connection with its services.

Business: Alicky Pilates and Wellness
Business owner: Alexandra Moyle
Business address: Alicky Pilates and Wellness, Gatton Manor Gym, Standon Lane, Ockley, Surrey, RH5 5PQ
Email: alickypilates@gmail.com
Website: www.alickypilates.com

If you have any questions about how your information is handled, please contact us using the email address above.

3. What information do we collect?

Depending on the services you use, we may collect the following information.

Personal and contact information

Full name and date of birth.

Home address, email address and telephone number.

Emergency contact details, where appropriate.

Parent or guardian contact details where services are provided to children.

Health and medical information

Medical history and relevant health conditions.

Previous injuries, operations and treatments.

Current symptoms, pain and physical limitations.

Medication and relevant allergies.

Information about physical health, mobility and functional ability.

Physiotherapy assessments, clinical findings, treatment plans and progress notes.

Relevant information provided by other healthcare professionals.

Health information is classified as special category personal data under UK GDPR and receives additional protection.

Pilates and class information

Health screening and relevant medical information.

Exercise experience and physical capabilities.

Attendance and booking records.

Information required to assess suitability for safe participation in classes.

Booking and payment information

Appointment and class bookings.

Payment records and transaction details.

Cancellation and attendance records.

Relevant communications relating to bookings and services.

We do not routinely collect or store full payment card details.

Photographs and videos

With your separate permission, we may take photographs or videos for promotional purposes, including use on our website, social media or marketing materials.

Permission for promotional photography is entirely optional and is not a condition of receiving treatment or attending classes.

Where photographs or videos include identifiable clients, we will obtain appropriate permission before using them. Additional consent and safeguarding arrangements will apply when children are photographed.

4. How do we use your information?

We collect and use personal information for the following purposes:

To provide safe and appropriate physiotherapy assessments and treatments.

To plan, deliver and review individual rehabilitation programmes.

To assess suitability for Pilates classes and exercise sessions.

To manage appointments, class bookings and cancellations.

To communicate with you about your treatment, bookings and services.

To maintain accurate clinical and professional records.

To process payments and manage business administration.

To meet legal, regulatory and professional obligations.

To respond to enquiries, complaints or requests concerning your information.

To use photographs or videos for promotional purposes where appropriate permission has been obtained.

We will only use your information for purposes that are necessary, appropriate and lawful.

5. Our lawful basis for processing your information

Under UK GDPR, we must have a lawful basis for processing personal information.

For ordinary personal information, we may rely on:

Contract: Where processing is necessary to provide the services you have booked.

Legal obligation: Where we need to retain or disclose information to comply with legal requirements.

Legitimate interests: Where processing is necessary for the reasonable operation, administration and management of the business, provided your rights and interests do not override those interests.

Consent: Where you have freely agreed to a particular use of your information, such as promotional photography or certain marketing communications.

For health and medical information, which is special category personal data, we must also meet an additional legal condition.

In providing individual physiotherapy care, we may rely on Article 9(2)(h) of UK GDPR, concerning the provision of health or social care and treatment, together with the relevant provisions of the Data Protection Act 2018 and the professional confidentiality obligations applicable to healthcare professionals.

For health screening information collected in connection with Pilates classes, we will identify and apply an appropriate Article 9 condition, which may include explicit consent where appropriate.

We do not rely on consent as a blanket substitute for the other lawful bases that apply to clinical record keeping and healthcare provision.

6. Confidentiality and sharing your information

We treat all personal and clinical information as confidential.

We will not sell your personal information or share it with third parties for their own marketing purposes.

We may share relevant information where necessary and appropriate with:

Your GP or another healthcare professional involved in your care, where appropriate and with the necessary authority.

Other healthcare providers involved in coordinating your treatment, with your consent to do so.

Regulatory or statutory authorities where we are legally required to do so.

Service providers who support our business operations, such as online booking and payment providers.

Information will only be shared where there is a lawful basis to do so and only to the extent necessary.

In exceptional circumstances, information may be disclosed without consent where there is a legal requirement or where disclosure is necessary to protect someone's vital interests or prevent serious harm.

7. Online booking and payment providers

We use third-party services to support our business operations.

These include:

Momence

We use Momence to manage online bookings, appointments, Pilates class registrations and related communications. Personal information submitted through our booking system may be processed and stored by Momence in accordance with its privacy policy and the relevant contractual data protection arrangements.

Stripe

We use Stripe to process payments securely. Payment information is handled by Stripe in accordance with its privacy policy and security arrangements. We do not routinely store full payment card details ourselves.

These providers are required to handle personal information in accordance with applicable data protection requirements.

Where personal information is transferred outside the UK, appropriate safeguards must be in place in accordance with applicable data protection legislation.

8. How we store and protect your information

We take appropriate technical and organisational measures to protect personal information against unauthorised access, loss, alteration, disclosure or destruction.

These measures include:

Secure, password-protected electronic systems.

Restricted access to confidential clinical records.

Secure storage of paper records.

Appropriate safeguards when transferring personal information.

Regular review of how personal information is stored and accessed.

Only individuals who need access to your information for legitimate business or professional purposes will be permitted to access it.

9. How long do we keep your information?

We retain personal information only for as long as necessary for the purpose for which it was collected, taking account of legal, professional and regulatory requirements.

Clinical records are retained in accordance with applicable professional guidance and relevant record retention requirements. Retention periods may differ depending on the age of the client, the nature of the treatment and the circumstances of the care provided.

We maintain appropriate retention arrangements for adult and children's clinical records, including additional safeguards for records relating to children.

Administrative information, booking records and payment information are retained for the periods required by applicable legal and financial obligations.

When information is no longer required, it will be securely deleted or destroyed.

10. Children's personal information

We occasionally provide services to children.

Where services are provided to children, we take additional care to protect their personal information and ensure that it is handled appropriately.

We may collect information from a parent or legal guardian, including contact details, relevant medical history and information required to support safe participation in treatment or exercise.

We will take account of the child's age, understanding and capacity when communicating about their personal information and seeking appropriate consent or permissions.

Children's clinical records will be stored securely and retained in accordance with applicable professional and legal guidance.

11. Photographs and promotional material

We may occasionally ask clients for permission to take photographs or videos for promotional purposes.

This may include:

Photographs of Pilates classes or exercises.

Images for our website or social media pages.

Testimonials or promotional material relating to our services.

Permission will be sought separately from consent to treatment or participation in classes.

You are under no obligation to agree to photography or promotional use, and declining will not affect the services you receive.

You can withdraw your permission for future use of photographs or videos by contacting us at alickypilates@gmail.com.

Where children are involved, appropriate parental or guardian permission and consideration of the child's own wishes will be required.

12. Your rights

Under UK GDPR, you have rights concerning your personal information. These include:

Right of access: You can request a copy of the personal information we hold about you.

Right to rectification: You can ask us to correct inaccurate or incomplete information.

Right to erasure: You can request deletion of your personal information in certain circumstances.

Right to restrict processing: You can ask us to restrict how we use your information in certain circumstances.

Right to data portability: You can request certain information in a portable format where this right applies.

Right to object: You can object to certain types of processing, including processing based on legitimate interests.

Right to withdraw consent: Where processing is based on consent, you can withdraw that consent at any time.

Please note that some clinical records and financial information must be retained to meet legal and professional obligations. Therefore, a request for deletion does not necessarily mean that we can immediately erase all information.

We will respond to requests in accordance with applicable data protection legislation.

13. Marketing communications

We may occasionally contact you with information about our services, Pilates classes, treatments or relevant business updates.

We will only send electronic marketing communications where we have the appropriate permission or another lawful basis under applicable privacy and electronic communications legislation.

You can opt out of marketing communications at any time by contacting us or using the unsubscribe facility where provided.

Essential communications relating to appointments, bookings, payments and treatment will continue where necessary, even if you opt out of marketing.

We will never use confidential clinical information for marketing purposes without an appropriate lawful basis and, where required, your explicit consent.

14. Cookies and website information

Our website may use cookies and similar technologies to improve functionality, understand website usage and support online services.

Where required, we will obtain your consent before placing non-essential cookies on your device.

You can manage cookie preferences through your browser or any cookie preference facility provided on our website.

15. Data breaches

We take the security of your personal information seriously.

If a personal data breach occurs, we will investigate it and take appropriate steps to minimise any potential harm.

Where legally required, we will notify the Information Commissioner's Office (ICO) within the applicable timeframe and inform affected individuals where the breach is likely to result in a high risk to their rights and freedoms.

16. Complaints and concerns

If you have any concerns about how your personal information is being handled, please contact Alicky Pilates and Wellness in the first instance.

You also have the right to raise a complaint with the Information Commissioner's Office:

Information Commissioner's Office (ICO)
Website: www.ico.org.uk
Telephone: 0303 123 1113

17. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, business practices or applicable legislation.

The latest version will always be made available on our website.