Privacy Policy

DRAFT for Sally to review. Not legal advice. Highlighted items must be confirmed before launch.

Last updated: PLACEHOLDER: date of publishing

Who I am

Head to Heel Wellbeing is run by Sally Fryer, a sole trader offering holistic therapies in Sheffield. I'm the "controller" of your personal information, which means I decide how it's used and I'm responsible for looking after it.

Contact: headtoheelwellbeing@gmail.com · 07711 072610
PLACEHOLDER: postal address for privacy requests, e.g. "c/o The Brook Therapy Rooms, Second Floor, Omega Court, 350 Cemetery Road, Sheffield S11 8FT", if Sally agrees
PLACEHOLDER: ICO registration number, if Sally has registered and paid the data protection fee. Sole traders who keep health records will usually need to; check at ico.org.uk/fee

What information I collect

• Booking details: your name, email address, phone number, the treatment you book and the appointment time, collected through my online booking system (Setmore).
• Availability requests: the days and times that suit you and your preferences (for example about aromatherapy oils), collected through a Google Form.
• Health information: before your first treatment I ask you to complete a health consultation form. It covers medical conditions, medication, pregnancy, allergies, recent injuries or operations and any areas you'd like me to avoid. This is "special category" information and I treat it with extra care.
• Payments: if you pay online, the payment provider (PayPal PLACEHOLDER: and the provider behind the Google Pay / Apple Pay links) processes your card or account details. I see your name, the amount and the date, not your full card details.
• Emails and messages: anything you send me by email or phone.
• Reviews: if you leave a review on Setmore or Google, it's shown under the name you choose there.

This website doesn't have its own contact or health forms, and it doesn't store any health information. The forms open in the providers' secure systems.

Why I use it, and the lawful basis

Purpose	Lawful basis
To book, manage and remind you about appointments	Contract (to provide the treatment you've asked for)
To check a treatment is safe and suitable for you, and adapt it	Explicit consent for health information (you give it when you complete and sign the consultation form), plus contract
To take payment and keep business and tax records	Contract and legal obligation
To reply to your questions and availability requests	Legitimate interests (running my business and responding to you)
To keep treatment records in case of a later query or insurance claim	Legitimate interests. For health information: establishing, exercising or defending legal claims

You can withdraw consent at any time by contacting me. I may then not be able to treat you safely, and I'll explain why.

Who I share it with

I don't sell your information or use it for marketing without your permission. I use these trusted services to run my business, and they process information on my behalf:
- Setmore (online booking and reminders)
- Google (Gmail, Google Forms and Google Docs/Drive)
- DocuSeal PLACEHOLDER: or DocuSign / Jotform Sign, whichever Sally actually uses (electronic signing of the consultation form)
- PayPal PLACEHOLDER: and the provider behind the Google Pay / Apple Pay links (payments)
- Hostinger (website hosting) and 459design (website support). The website doesn't hold your health information.

Some of these providers may store data outside the UK. Where they do, they use approved safeguards such as the UK International Data Transfer Addendum or UK adequacy regulations.

I'll share information with others only if the law requires it, or to protect someone's vital interests in an emergency. My insurer may also need it if there's a claim.

How long I keep it

• Health consultation forms and treatment records: PLACEHOLDER: retention period. Check with the FHT and Westminster Insurance. Her insurer or professional body may set a minimum. Her form says clients must be 18 or over
• Booking and payment records: PLACEHOLDER: e.g. 6 years after the end of the tax year, for HMRC
• Availability requests and general emails: PLACEHOLDER: e.g. deleted after 12 months if no booking is made

Keeping it safe

I keep paper records (if any) locked away and digital records in password-protected accounts with two-step verification. PLACEHOLDER: confirm paper records, if any

Your rights

You have the right to ask for a copy of your information, to have it corrected or deleted, to restrict or object to how I use it, to have it transferred, and to withdraw consent. To make a request, email headtoheelwellbeing@gmail.com. I'll reply within one month.

If you're unhappy with how I've handled your information, please tell me first. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, 0303 123 1113.

Cookies

See my Cookie Policy.

Changes

I'll update this policy if anything changes and show the date at the top.