Privacy policy

Who is responsible for your data?

The data controller for this website is:

Carole Andrews
Therapy by Carole
Peebles, Scottish Borders
Email: info@therapybycarole.co.uk

Therapy by Carole is registered with the Information Commissioner's Office (ICO) as a data controller. ICO registration number: C1909172.

What data this website collects

This website collects personal data through three routes:

Online booking (via Cliniko)

When you book an appointment, you are directed to a booking system operated by Cliniko. The information collected includes your name, email address, phone number, and relevant health information required to provide treatment. Cliniko acts as a data processor on behalf of Therapy by Carole. You can review Cliniko's own privacy policy at cliniko.com/policies/privacy.

Mailing list sign-up

If you choose to subscribe to the Therapy by Carole newsletter or email updates, your name and email address are collected for that purpose only. Sign-up is entirely optional and requires your active consent.

Contact form

If you send a message using the form on the contact page, your name, email address, your message, and the clinic you selected if you chose one, are collected so that your enquiry can be answered. The form is handled by Netlify, which hosts this website and acts as a data processor. Submitting the form does not sign you up to the mailing list. Please don't send detailed health information through the form: bring it to your appointment, or use the booking system, which is built for it.

Why your data is used and the legal basis

• Booking and treatment: Processing is necessary to perform the contract for massage therapy services you have requested (UK GDPR Article 6(1)(b)), and where health information is involved, for the provision of health care (Article 9(2)(h)).
• Mailing list: Processing is based on your consent (UK GDPR Article 6(1)(a)). You can withdraw consent at any time by clicking the unsubscribe link in any email or by contacting info@therapybycarole.co.uk.
• Contact form: Processing is based on your consent in sending the message, and on the legitimate interest of responding to an enquiry you have made (UK GDPR Article 6(1)(a) and 6(1)(f)).
• Existing clients: Where you are an existing client and have had the opportunity to opt out, Therapy by Carole may contact you about similar services under the soft opt-in provisions of the Privacy and Electronic Communications Regulations (PECR).

How long your data is kept

• Clinical records: Retained for a minimum of 8 years from the date of last treatment, in line with professional guidance. For clients who were under 18 at the time of treatment, records are retained until their 26th birthday.
• Mailing list: Retained for as long as you remain subscribed. On unsubscribing, your data is deleted or suppressed within 30 days.
• Contact form messages: Retained for up to 12 months after your enquiry is resolved, then deleted, unless you go on to become a client and the message forms part of your record.

Who your data may be shared with

Your personal data is not sold or shared with third parties for marketing purposes. Data may be shared with:

• Cliniko (booking and practice management system, acting as data processor)
• Mailchimp (mailing list platform used to send email communications, acting as data processor)
• Netlify (website hosting and contact form handling, acting as data processor)
• Other healthcare professionals, but only with your explicit consent or where required by law

All third-party processors are required to handle your data in accordance with UK GDPR.

Your rights

Under UK GDPR you have the right to:

• Access the personal data held about you
• Request correction of inaccurate data
• Request deletion of your data (subject to legal and professional retention requirements)
• Withdraw consent at any time where consent is the legal basis for processing
• Object to processing for direct marketing purposes
• Request restriction of processing in certain circumstances
• Complain about how your data is handled: to Therapy by Carole directly, and to the ICO (see Making a complaint below)

To exercise any of these rights, contact info@therapybycarole.co.uk. Requests will be responded to within one calendar month.

Making a complaint

If you have a concern about how your personal data has been handled, you can complain to Therapy by Carole directly by emailing info@therapybycarole.co.uk. Your complaint will be acknowledged within 30 days, investigated without undue delay, and you'll be kept informed of progress and the outcome.

You can also complain to the Information Commissioner's Office (ICO) at any time, at ico.org.uk or by calling 0303 123 1113. You're not required to complain to Therapy by Carole first.

Cookies and website analytics

This website may use cookies or analytics tools to understand how visitors use the site. No cookies that identify you personally are set without your consent. If analytics are in use, data is anonymised and aggregated.

The contact page can show a Google Maps view of each clinic. That map is not loaded until you press "Show map". Once you do, Google receives your IP address and may set its own cookies, under Google's privacy policy. If you'd rather not load it, the address and a plain link to Google Maps are on the page either way.

Changes to this policy

This policy will be updated when the services or data practices of Therapy by Carole change in a material way. The date at the top of this page reflects the most recent revision. Continued use of the website after any update constitutes acceptance of the revised policy.