Privacy Policy
Last Updated: 14/01/2026
Steph’s Holistic Therapy is committed to protecting your privacy and ensuring your personal data is handled safely and responsibly. This Privacy Policy explains how we collect, use, store, and protect your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are
Data Controller: Steph’s Holistic Therapy (Steph Sloan)
If you have any questions about this Privacy Policy or how your data is handled, please contact:
Email: steph@stephsholistictherapy.com
Address: 4 Meadow Court, Moor Lane, Staines, TW18 4YT
2. What data we collect
Steph’s Holistic Therapy collects personal data to provide safe and effective massage treatments and therapeutic coaching. This may include:
Personal identification information
- Name, address, telephone number, email, date of birth, occupation, GP practice, and emergency contact details
Health and sensitive data
- Medical history and current health conditions
- Current medication (including HRT if relevant)
- Pregnancy, breastfeeding, and reproductive health information
- Information relevant to massage or coaching treatment (such as reasons for seeking treatment, previous therapy experience, mental health history, and lifestyle factors)
Online identifiers
- IP address, cookies, and website usage data
All intake information is collected via Jotform encrypted forms, and coaching clients also sign a contract confirming Terms & Conditions via Jotform.
3. How we collect your data
You directly provide most of the data we collect when you:
- Book an appointment or coaching session via our website, phone, email, text, or online booking system
- Complete consultation or intake forms, either online via Jotform or in person on paper
- Sign a contract confirming Terms & Conditions for coaching
- Attend treatments or coaching sessions (as we keep session notes)
- Sign up to our newsletter (only with your explicit consent)
- Communicate with us via email (including @stephsholistictherapy.com or stephsholistictherapy@gmail.com)
- Voluntarily provide feedback via Google or direct email
- Use or view our website via your browser’s cookies
We may also receive your data indirectly from:
- Referrals from another healthcare professional
- Referrals from third parties recommending our services
4. How we use your data
We collect and use your data to:
- Inform your treatment or coaching plan and provide safe, appropriate support
- Provide aftercare advice or recommendations for massage therapy
- Manage appointments and send booking confirmations and reminders
- Communicate with you about relevant services or administrative matters
- Send newsletters, marketing, or promotional communications only where consent has been given
- Improve our website and services
Your data is always processed in accordance with relevant data protection legislation.
5. Lawful basis for processing
Under UK GDPR, we process your personal data using the following lawful bases:
- Contract: where processing is necessary to provide booked treatments or coaching sessions
- Legal obligation: where we are required to retain records for insurance or legal purposes
- Consent: for marketing and newsletter communications
- Legitimate interests: for business administration, record keeping, and service improvement
We process special category health data in order to provide safe and appropriate treatments. This data is processed on the basis of explicit consent and where necessary for the provision of health-related services.
6. Who we share your data with
We only share your data where necessary and appropriate, including with:
- Your therapist or coach, to ensure safe and appropriate support
- Brevo, which we use to coordinate email communications (name, email address)
Privacy Policy: https://www.brevo.com/legal/privacypolicy/ - Setmore, our online booking system (name, phone number, email address)
Privacy Policy: https://www.setmore.com/privacy - Jotform, which hosts our encrypted online consultation and intake forms for both massage and coaching
Privacy Policy: https://www.jotform.com/privacy/ - Google Analytics, which collects anonymised website usage data to help us improve our website and services
- Google Analytics, which collects anonymised website usage data to help us improve our website and services
Privacy Policy: https://policies.google.com/privacy - Zoom, which we use to conduct online coaching sessions. Only your name is used in the meeting title to identify you; we do not share email addresses or use AI transcription.
Privacy Policy: https://zoom.us/privacy
We do not sell your personal data to third parties.
7. International data transfers
Some third-party services we use (including Brevo, Setmore, Jotform, and Google Analytics) may store or process data outside the UK. Where this occurs, appropriate safeguards are in place, such as standard contractual clauses or equivalent measures, to ensure your data is protected in line with UK GDPR.
8. Use of our website and cookies
We may use third-party service providers to monitor and analyse website usage. This may include collecting data such as IP address, browser type, visited pages, and time spent on the site. We currently use Google Analytics for this purpose.
You can control or disable cookies through your browser settings. Where required, we will seek your consent before placing non-essential cookies on your device.
9. How we store your data
Steph’s Holistic Therapy securely stores your data in the following ways:
- Password-protected computers, secure cloud servers, and mobile devices
- Jotform encrypted forms for online consultation and intake data (both massage and coaching)
- Brevo secure servers for email communications
- Setmore secure servers for booking information
- Paper records stored in a locked cabinet at Steph’s Holistic Therapy premises
For insurance purposes, massage treatment and coaching records are retained for 10 years following your last appointment or in line with contractual agreements, after which records are securely deleted unless a contractual or legal requirement dictates otherwise.
10. Email marketing and newsletters
We may contact you with newsletters, marketing, or promotional materials only where you have given explicit consent. You may withdraw your consent at any time by using the unsubscribe link in our emails or by contacting us directly.
11. Your data protection rights
Under UK GDPR, you have the right to:
- Access your personal data
- Request rectification of inaccurate or incomplete data
- Request erasure of your data (where applicable)
- Restrict processing of your data
- Object to processing in certain circumstances
- Request data portability
- Withdraw consent at any time where processing is based on consent
To exercise any of these rights, please contact us using the details above. We may need to verify your identity before processing your request. We aim to respond within one month.
12. Changes to this Privacy Policy
Steph’s Holistic Therapy keeps this Privacy Policy under regular review and posts any updates on this page. This policy was last updated on 14 January 2026.
13. How to make a complaint
If you are unhappy with how your data has been handled, please contact us first. If your concern is not resolved, you may complain to the Information Commissioner’s Office (ICO):