This policy was last updated on 5 October 2026 and reflects the UK Data (Use and Access) Act 2025 (DUAA), which amends the UK GDPR, the Data Protection Act 2018 (DPA) and the Privacy and Electronic Communications Regulations 2003 (PECR). We at The Thoughtful Body™ Limited offer personal and educational services in the health, fitness and wellbeing industry. This Privacy Statement sets out our commitment to your data security and privacy, and explains what information we collect, how we use it, what we do to protect it, who we share it with, and how you can manage the information we hold. WHO WE ARE The data controller is The Thoughtful Body™ Limited ("we", "us", "our"), a company registered in England and Wales. Organisation name : The Thoughtful Body Limited Company number: 10259555 Registered address: Darley Abbey Mills Darley Abbey Derby DE22 1DZ United Kingdom ICO registration number: A8859454 Contact for all privacy matters: [email protected] In this policy, "Service" means our services accessed via our website at www.thethoughtfulbody.com, social media, workshops, online training, teacher training, classes and one-to-one sessions. "You" refers to you as a user of the Service.
I. HOW WE USE YOUR INFORMATION AND OUR LAWFUL BASES We only collect information that is necessary, relevant and adequate for the purpose for which it is provided. By using our website you are not giving blanket consent to everything in this policy; we rely on the specific lawful basis shown for each purpose below. Where we rely on consent, you can withdraw it at any time by contacting us. Information involvedLawful basis Provide classes, workshops, retreats, trainings and one-to-one sessions Collect data such as name, contact details, date of birth, booking and payment records Performance of a contract with you regarding a service we provide you with Keep client records for assessments and treatments (for example biomechanics, Bowen, acupuncture, Reiki, Pilates and yoga sessions) Health and medical information, session notes (see "Health information" below) Contract, plus your explicit consent and the health-care provision condition for health data Send our newsletter and marketing emailsName, email addressYour consent, or for existing customers our legitimate interests (the "soft opt-in"), with an unsubscribe option Reply to your enquiriesName, contact details, your messageLegitimate interests (responding to you), or steps you ask us to take before a contract Process payments and keep accounting recordsTransaction details (we do not hold full card details)Contract and legal obligation Run and secure the website, and understand how it is usedDevice and browser data, cookies (see "Cookies")Legitimate interests, or consent where cookies require it Prevent fraud, safeguard people, or respond to emergenciesAs neededLegal obligation, or a recognised legitimate interest under the DUAA
II. INFORMATION WE COLLECT Personal information is information that identifies you, such as your name (including title), address, phone number, date of birth and email address. It also includes online identifiers such as cookie IDs and IP addresses where these can be linked to you. Non-personal information is information that cannot identify you, such as anonymised or aggregated usage data, referring and exit pages, and platform type. If usage or preference data is linked to a cookie ID or another identifier, we treat it as personal information.
Health information (special category data) If you attend a one-to-one session, assessment, class or treatment, we may ask for and record information about your health, for example medical history, injuries, medication, symptoms, posture and movement assessments, and session notes. This is special category data. We collect it only so that we can deliver your session safely and appropriately and keep proper records. We ask for your explicit consent on our intake form before recording it, and we process it under the health-care provision condition in data protection law. We keep it confidential, store it securely, share it only with your consent (for example with your GP or another practitioner you ask us to contact) or where the law requires, and never use it for marketing. You can withdraw consent at any time, although we may then be unable to continue some services safely.
Business transactions Where you use our services in a business context, such as teacher trainings, workshops or purchases from our site, we may also collect: •Name (including title) •Job title •Qualifications •Business address •Phone number •Date of birth •Company details (some of which we may obtain from online or public business directories) •Email address We also collect details of transactions and customer orders between you and us. These are held securely and are not passed to third parties beyond what is described in this policy. Transaction details are not stored on our website and we do not hold your personal financial information. We use secure third-party payment processors for online payments; information they collect is subject to their own privacy policies, which we recommend you read before purchasing. Any information you send us, electronically or otherwise, is covered by this policy. Cookies and similar technologies Our website is hosted by Weebly, which sets cookies and similar technologies. We may also see information provided by your browser, such as the referring URL, browser type, device, and time and date of access, which we use to operate and maintain the Service and to provide general usage statistics. •Strictly necessary cookies (for example, to keep the site working, remember your cookie choices, or support a checkout you have requested) do not need your consent. •Statistical (analytics) cookies that only measure how the site is used may be set without consent, provided you are given clear information and a simple, free way to opt out. •Advertising, affiliate and cross-site tracking cookies are only set with your consent. Some of our "Our recommendations" pages contain affiliate links; if you click one, the retailer may set its own cookies and pay us a commission at no extra cost to you. We have no control over those cookies, and the retailer's own privacy policy applies. You can change or withdraw your cookie choices at any time using the cookie settings on our website, or by deleting cookies in your browser settings. Disabling cookies may mean some areas of the Service do not work properly. A full list of the cookies we use is available on request. Under the DUAA, fines for breaching the cookie rules in PECR now follow the higher UK GDPR penalty framework. What we do not collect We do not collect your bank account details, credit or debit card numbers (except details required by our third-party payment processor), social security numbers or tax identification numbers. If you have given us bank details for a refund, we delete them once the payment has been made. We have suitable physical, electronic and managerial procedures to safeguard the information we collect, including our choice of third-party payment processors. If you suspect fraud or foul play, please contact us immediately.
III. HOW WE SHARE INFORMATION We do not sell, trade or rent your personal information. We share it only with the following, and only to the extent necessary: •Website host and platform: Weebly, Inc., which hosts our site and may store information on its servers (see section VI). •Payment processors: the secure third-party processors used for online payments. e.g. PayPal / Wise/Revolut •Email and newsletter provider: Rachel Rafiefar no third part used •Other professionals: such as your GP or another practitioner, only with your consent. •Authorities and advisers: where we are required to do so by law, to cooperate with law enforcement or regulators, or to our accountants and insurers where needed. Third-party providers have their own privacy policies for the information we are required to share with them, and we recommend you read them. We may use and share non-personal, anonymised information to improve the Service and understand trends, provided it does not identify you. As our company works internationally, your information may sometimes be processed or stored outside the UK, for example by Weebly or our email provider in the United States. In those cases we ensure appropriate safeguards are in place, applying the UK GDPR transfer test as amended by the DUAA (that protection in the destination country is not materially lower than in the UK). Where consent is our basis for a transfer, you can withdraw it at any time by contacting us.
IV. HOW WE PROTECT INFORMATION We implement reasonable precautions and follow industry best practice to protect your personal information from unauthorised access, disclosure, alteration or destruction, and we recognise that no system can be completely secure. If we experience a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office and, where required, affected individuals.
Updating your information We may sometimes ask you to update your information, for example to inform you of changes to our policies, protect your information against loss or unauthorised access, check that it is accurate and up to date, improve our products and services, or invite you to complete a survey about our services. We will never ask you to confirm details of a past financial transaction. If you receive an unsolicited request of this kind that appears to be from us, do not provide any information and contact us immediately. If you have asked us not to contact you for marketing, we keep a record on our suppression list so that we can honour your request.
V. YOUR RIGHTS You have the right to prevent us contacting you for marketing purposes at any time. Subject to applicable law, you also have the right to: •request access to the personal information we hold about you •request correction of inaccurate information •request erasure of your information in certain circumstances •request that we restrict, or object to, certain processing (including processing based on our legitimate interests, and any direct marketing) •request a copy of your information in a portable format •withdraw your consent at any time where we rely on it, which does not affect the lawfulness of processing before withdrawal To use any of these rights, contact us using the details in section XII. When responding to a subject access request we carry out a reasonable and proportionate search for your information, and we may pause the one-month response period while we verify your identity or ask you to clarify your request. We will not charge you for exercising your rights unless a request is manifestly unfounded or excessive. Providing us with the information we ask for is generally optional, but we may be unable to provide some services, particularly health-related sessions, without it. We do not make decisions about you using solely automated processing.
How do I unsubscribe? •Email us at [email protected] with the word "unsubscribe" in the subject line. •Click the unsubscribe link at the bottom of any mailing you receive from us Even if you opt out of marketing, we may still send administrative emails, such as updates to this policy or Service-related announcements (for example if a class is cancelled). Your right to complain If you are unhappy with how we have used your personal information, you can complain to us directly using the contact details in section XII. We will acknowledge your complaint within 30 days and respond to it without undue delay. You also have the right to complain to the UK data protection regulator, the Information Commissioner's Office (ICO), which the DUAA provides for restructuring into a new body, the Information Commission. Up-to-date contact details are at ico.org.uk. We would appreciate the chance to resolve your concern directly first.
VI. WEEBLY Our website is hosted by Weebly, Inc. ("Weebly"), which provides the online platform that allows us to provide the Service. Your information, including personal information, may be stored on Weebly's servers. Weebly acts on our behalf in hosting the site and has its own privacy policy, which explains how it handles information, available at https://www.weebly.com/privacy.
VII. LINKS TO OTHER WEBSITES Our Service may link to other websites or applications. We are not responsible for their privacy practices or content, and this policy applies only to information we collect through the Service. Once you leave our site we have no control over how other websites collect or use your personal data, so please read the privacy statement of any site you visit before giving it information.
VIII. CHILDREN AND AGE OF CONSENT Our services are for people aged 18 and over and are not directed at children. Where any part of our Service could reasonably be accessed by children, we take into account the "children's higher protection matters" introduced by the DUAA, including children's more limited awareness of the risks of data processing. If we become aware that we have collected personal information from a child without appropriate parental consent, we will take steps to delete it.
IX. CHANGES TO THIS POLICY We may update this policy from time to time. We will post the updated version on this page with a new "last updated" date. If we make a material change to how we use your personal information, we will also tell you directly, for example by email if you have given us your address, before the change takes effect. We encourage you to check this page periodically.
X. MERGER OR ACQUISITION If we undergo a business transaction such as a merger, acquisition or sale of all or part of our assets, your personal information may be among the assets transferred. Any acquirer would be required to continue to process it in line with this policy and data protection law, and we will post any change in our information practices on this page.
XI. EMAIL COMMUNICATIONS AND OPTING OUT We will send Service-related announcements when necessary, for example if the Service is suspended for maintenance, or if a class or session is changed. These administrative communications are not promotional, and you generally cannot opt out of them. Where you have made an enquiry, we may reply by email or telephone in line with your wishes. We send promotional emails only as described in section I, and you can opt out at any time by following the instructions in each email.
XII. CONTACT US AND WITHDRAWING CONSENT If you have any questions about this policy, wish to exercise your rights, withdraw consent, or make a complaint, please email [email protected] or write to us at the registered address given at the top of this policy. We aim to acknowledge complaints within 30 days and resolve them without undue delay.
HOW LONG DO WE KEEP YOUR INFORMATION? We hold personal information in an identifiable format for no longer than necessary. If we obtained your details in connection with a prospective relationship or enquiry, we hold them until you unsubscribe from our mailings, or for 1 year and 6 months from collection, whichever is sooner, unless during that period we form a relationship with you, for example you attend a course or make a purchase. Once our relationship ends, we hold your personal information for 6 years from the date it ends, to establish, bring or defend legal claims. Client health and treatment records are kept for the period required by our insurer and professional bodies, which may be longer than 6 years, and records relating to a child are kept until they reach the age our insurer requires. The exceptions to these periods are where: •the law requires us to hold your personal information for a longer period, or to delete it sooner; •you have raised a complaint or concern about a product or service, in which case we retain your information for 6 years from the date of that complaint or query; or •you exercise your right to have your information erased (where it applies) and we do not need to hold it for any of the reasons permitted or required by law. Last updated: 5 October 2026