Privacy Policy

Last updated: 31 July 2026

Introduction

Chiltern Mobile Massage (“we”, “us”, “our”) is a UK-based mobile massage, reflexology, Reiki and yoga practice operating across Buckinghamshire and Hertfordshire. This policy explains what personal information we collect when you get in touch, book a treatment, or visit this website, why we collect it, and what rights you have over it. We take your privacy seriously and only use your information to provide a safe, professional service.

This website and our services are based in the United Kingdom, and your personal data is handled in accordance with UK data protection law, the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Chiltern Mobile Massage is the “data controller” of the personal information described in this policy.

Who we are

Chiltern Mobile Massage is run by Céline, based in Chartridge, Buckinghamshire (HP5), United Kingdom, providing treatments across a 20-mile radius of Buckinghamshire and Hertfordshire. For any question about this policy or your personal data, contact us at:

• Email: celine@chilternmobilemassage.co.uk
• Phone: 07543 796628

Chiltern Mobile Massage’s registration with the Information Commissioner’s Office (ICO) Data Protection Fee register is currently being arranged. This page will be updated with our registration reference once confirmed.

Information we collect

We collect personal data in the following ways:

• Enquiry and booking form, when you fill in the contact form on this website, we collect your name, email address, phone number, treatment of interest, preferred date/time, and any message you add.
• Consultation, new clients have a brief phone consultation before their first booking. During this, and before or during treatments, we may ask about relevant medical history, injuries, pregnancy, allergies or other health conditions (“health information”) so that your treatment is safe and suitable. This is sensitive (“special category”) data under UK GDPR, and we only collect it with your explicit consent and only to the extent needed to treat you safely.
• Correspondence, if you email, call or message us, we keep a record of that correspondence to respond to you and for our own records.

We do not use analytics or advertising trackers on this website. The only cookies in use are the essential technical cookies WordPress needs to run the site, see Cookies below.

Why we collect it and our lawful basis

We use your information to:

• respond to your enquiry and arrange your booking (performance of a contract, or steps taken at your request before entering into one)
• assess whether a treatment is safe and appropriate for you, based on health information you provide (explicit consent)
• send booking confirmations and, where relevant, invoices or receipts (contract / legitimate interest)
• keep basic financial and treatment records as required by UK tax and insurance rules (legal obligation / legitimate interest)

We will never use your details for marketing without your separate, specific consent, and you can withdraw consent at any time.

Who we share your data with

We do not sell your personal data. We only share it with trusted service providers who help us run the business, such as our website host and email provider, who are required to keep your information secure and use it only for the purpose we specify. We do not share your health information with anyone outside of providing your treatment, except where required by law (for example, in a medical emergency). We do not disclose your data to anyone for their own marketing purposes.

International data transfers

Some of the tools we rely on to run this website and manage enquiries (for example, website hosting, email and form-handling services) may be provided by companies based outside the UK, including the United States. Where any personal data is transferred or accessed outside the UK, we ensure it is protected by a legally recognised safeguard, such as the UK Extension to the EU-US Data Privacy Framework, UK-approved Standard Contractual Clauses (SCCs), or the UK International Data Transfer Agreement (IDTA), so your data remains protected to UK standards wherever it is processed.

Where your data is stored

Your personal data is stored on secure servers within the United Kingdom or European Economic Area (EEA) wherever possible, and otherwise subject to the safeguards described above.

Cookies

This website is built on WordPress, which uses a small number of essential cookies needed for the site to function (for example, security tokens for logged-in administrators). These do not track you across other websites and are not used for advertising. We do not currently run analytics (such as Google Analytics) or marketing pixels on this site. If that changes in future, we will update this policy and, where required, ask for your consent via a cookie banner.

How long we keep your data

We keep different types of data for different lengths of time, based on legal, professional and insurance requirements:

• General enquiries that don’t lead to a booking, kept for around 24 months from your last contact with us, then deleted.
• Financial and tax records (invoices, payment records), kept for 6 years from the end of the relevant tax year, in line with HMRC record-keeping requirements.
• Treatment and consultation records (health information, contraindications, treatment notes), kept for 7 years after your last treatment with us, in line with professional body guidance (e.g. FHT, CThA) and our professional insurance requirements. For clients who were under 18 at the time of treatment, we retain these records until they reach age 25.

After these periods, your data is securely deleted or anonymised.

Your rights under UK GDPR

As a UK resident (or anyone whose data we process in connection with our UK-based services), you have the right to:

• ask what personal data we hold about you and get a copy of it (subject access request)
• ask us to correct inaccurate or incomplete data
• ask us to delete your data (“right to be forgotten”), subject to any legal reason we may need to keep it
• ask us to restrict or object to how we use your data
• request your data in a portable format, where technically feasible
• withdraw consent at any time for anything we do on the basis of consent, such as health information or marketing

To exercise any of these rights, contact us using the details above, we aim to respond within one month, as required by UK GDPR.

If you’re not satisfied with how we’ve handled your data, you have the right to complain to the UK’s independent regulator, the Information Commissioner’s Office (ICO):

• Website: ico.org.uk
• Helpline: 0303 123 1113
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Children

Our services and this website are not directed at children, and we do not knowingly collect personal data from anyone under 18 via this website. Where we treat clients under 18 with parental consent, their consultation and treatment records are retained as set out above.

Changes to this policy

We may update this policy from time to time, for example, if we start using a new tool or service. The date at the top of this page shows when it was last updated.

Governing law

This policy, and any dispute about how we handle your personal data, is governed by the laws of England and Wales.