Therapeutic
Massage
& Healing

Who we are

This policy applies to Samuel Pitt Therapeutic Massage & Aromatherapy, a mobile massage and aromatherapy service based in Wantage, Oxfordshire. I operate as a sole trader, and under UK data protection law I am the Data Controller for the personal information described below — I decide why and how it is collected and used.

This policy explains what information I collect about you as a client (or prospective client), how and why I use it, how it is kept secure, who it is shared with, and what rights you have over it.

What information we collect

Contact and booking information — your name, address, phone number, email address, and appointment history. This is collected when you make an enquiry, book an appointment (online or by phone/text), or contact me directly.

Health and consultation information — before treatment, I ask about your medical history, current symptoms, medications, allergies, and any conditions that could affect the safety of a massage or aromatherapy treatment (contraindications). This is special category data under UK GDPR, because it relates to your health.

Payment information — details needed to process payment for treatments, handled through the relevant payment functions within Cliniko.

I do not collect any information about you beyond what is needed to safely deliver treatment, manage your bookings, and run the practice.

How and why we use your information

I only use your information for the purposes it was collected for, and I rely on the following lawful bases:

• Contract (Article 6): to arrange and deliver the treatment you have booked, including confirming appointments and contacting you about them.
• Consent (Article 6): where I hold your details for marketing purposes, such as sending newsletters or promotions. You can withdraw this consent at any time.
• Legitimate interests (Article 6): for limited administrative purposes, such as keeping basic records needed to run the practice, applied with care so it does not override your own rights and interests.
• Health and social care (Article 9): for your medical history, symptoms and contraindication details, which I need in order to deliver treatment safely. This is treated as special category data and is given extra protection.

I will never use your information for a purpose that is incompatible with the reason it was originally collected without telling you first.

How we store and protect your information

I do not keep client records on paper or on local devices. All booking, contact and health information is stored electronically in Cliniko, a cloud-based practice management system built for therapy and healthcare businesses.

Cliniko acts as my data processor: I remain the controller and decide what happens to your data, and Cliniko processes it on my behalf, under a Data Processing Addendum that covers UK GDPR. Cliniko's own safeguards include:

• UK-based data centres for UK customers
• Industry-standard encryption of stored data
• 24-hour physical security and monitoring at its data centres
• ISO 27001 accreditation
• Regular software updates, back-ups and redundancy

On my side, I protect access to my Cliniko account and devices through passkey/biometric and multi-factor authentication, automatic security updates, restricted and safe web use, and by never connecting unscanned external devices to my equipment. Because your data is not stored locally, losing a device does not put your records at risk — access to my account is the main safeguard I focus on.

Full detail on Cliniko's own security and privacy practices is available at cliniko.com/security and cliniko.com/policies/privacy.

Who we share your information with

I do not sell, rent, or trade your personal information, and I do not share it with third parties for their own marketing purposes.

Your information is shared only in these limited circumstances:

• Cliniko, as my data processor, to host and process the records described above.
• My insurer and professional body (the Federation of Holistic Therapists), only if required to support an insurance claim, investigate an incident, or meet membership obligations.
• Regulators or authorities, such as the Information Commissioner's Office (ICO), where I am legally required to disclose information.
• A relevant emergency contact or medical professional, only where necessary to protect your health or safety in an emergency.

I will never share your health or consultation information with anyone else without your explicit consent, unless the law requires it.

How long we keep your information

I keep client health and treatment records for 10 years from the date of your last visit, in line with the retention requirements of the Federation of Holistic Therapists (FHT), the professional body I am a member of.

Contact details collected only for marketing purposes (such as newsletter sign-ups) are kept only for as long as you remain subscribed, and are removed promptly if you unsubscribe or withdraw consent.

When data is no longer needed, it is securely deleted or archived within Cliniko rather than retained indefinitely.

Your rights

Under UK GDPR, you have the right to:

• Access the personal information I hold about you
• Correct any information that is inaccurate or incomplete
• Request erasure of your information ("right to be forgotten")
• Restrict or object to certain types of processing
• Request a copy of your data in a portable, machine-readable format
• Withdraw consent at any time, where I am relying on consent (for example, marketing)

To exercise any of these rights, contact me using the details below. I will respond within one month.

Please note one exception: health and consultation records processed under the "health and social care" basis (Article 9) are exempt from the right to erasure, because they are fundamental to delivering treatment safely and to my own legal and insurance obligations. I will explain this at the time if it applies to your request.

Marketing communications

With your consent, I may occasionally contact you with newsletters, promotions, or prize draw updates. You will always be asked to opt in, and every marketing message will include a simple way to unsubscribe.

You can also unsubscribe at any time by contacting me directly, and I will remove you from marketing communications promptly. This does not affect messages needed to manage bookings you have already made, such as appointment confirmations or reminders.

How to contact us, and how to complain

If you have any questions about this policy, or want to exercise any of your rights, please contact me directly:

• By using the 'contact us' form on the main website

I take data protection seriously and will do my best to resolve any concerns directly. If you remain unhappy with how your information has been handled, you also have the right to complain to the UK's data protection regulator:

Information Commissioner's Office (ICO)
Website: ico.org.uk
Helpline: 0303 123 1113

As my data processor, Cliniko also has its own Data Protection Officer, who can be contacted at dpo@cliniko.com for questions specifically about how Cliniko's platform handles data on my behalf.

Changes to this policy

I may update this policy from time to time, for example if my working practices, the services I use, or data protection law change. Any updated version will be shared with clients and made available wherever this policy is published.

Last updated: 22 September 2026

Acceptance of these terms

By booking an appointment with Samuel Pitt Therapeutic Massage & Aromatherapy, you agree to these terms of use. They apply to all bookings made online, by phone, or by text message.

Booking and the consultation form

When you book an appointment, you will receive an acknowledgement email containing a link to an online consultation form. This form covers your medical history, current symptoms, medications and allergies, and is needed to check the treatment is safe for you (screening for contraindications).

The consultation form must be completed before your appointment. Please complete it as soon as possible after booking, and in any event with enough time before your appointment for it to be reviewed.

Cancellations

Bookings may be cancelled if the consultation form has not been completed in good time before the appointment. This is because I need the information in the form to confirm that treatment is safe for you — without it, I cannot responsibly go ahead.

If your form is still outstanding close to your appointment time, I will try to remind you, but I reserve the right to cancel or postpone the appointment if it remains incomplete.

If you need to cancel or reschedule for any other reason, please let me know as soon as possible so the slot can be offered to another client.

Notice period: please give at least 1 day's notice to cancel or reschedule. Cancellations made with 1 day's notice or more will receive a full refund. Cancellations made with less notice than this may not be eligible for a refund.

Home visits

As this is a mobile service, treatment takes place at your home. Please ensure there is a suitable, private space available for the appointment, and that someone will be available to let me in at the agreed time.

Please let me know in advance of anything at the property that may affect the appointment (such as pets, parking, or access arrangements).

Right to decline or stop treatment

I reserve the right to decline or stop treatment at any point if I have concerns about your health and safety, if the consultation form reveals a contraindication, or if the environment at the property is not safe or suitable to work in.

Changes to these terms

These terms may be updated from time to time. The current version will always be available via Cliniko.

Last updated: 22 September 2026