Privacy Policy
This policy explains what personal information FLO Studio collects when you book a class or an assessment through our website, why we collect it, and what rights you have over it.
Who we are
FLO Studio is the data controller for the personal information described in this policy. We run mat pilates classes at venues across Reigate, Oxted and Godstone, and deliver physiotherapy at clients' own homes across the same area. You can contact us about anything in this policy at flo.physio.pilates@gmail.com.
The information we collect
When you book an initial assessment or reserve a place on a course through our website, we collect:
- Your name and email address
- Any answers to booking questions attached to that specific class or assessment (for example, confirming you've already completed your initial assessment)
- Basic technical information your browser sends automatically when you visit our site (such as your browser type) — we do not currently combine this with analytics or tracking tools; see our Cookie Policy for details
We do not ask you to submit detailed health or medical information through the booking form itself. If you become a client of our physiotherapy service, further health information (for example, in a clinical assessment or treatment notes) is collected separately by your treating clinician, not through this website, and is handled under the additional safeguards described below.
How we use your information, and our lawful basis
| What we do | Why (lawful basis under UK GDPR) |
|---|---|
| Create and manage your booking, send confirmation and reminder messages | Performance of a contract with you (Article 6(1)(b)) |
| Keep basic records for accounting and legal purposes | Legal obligation (Article 6(1)(c)) |
| Improve the studio and respond to enquiries or feedback | Our legitimate interest in running a good studio, balanced against your rights (Article 6(1)(f)) |
We do not use your information for marketing unless you separately opt in, and we do not sell your personal information to anyone.
Special category (health) information
Where our physiotherapists collect health information as part of an assessment or treatment, this is "special category data" under Article 9 UK GDPR and is handled with extra care. Our lawful basis for this is that it's necessary for the provision of health care by a professional subject to a duty of confidentiality (Article 9(2)(h)) — our physiotherapy is provided by HCPC-registered clinicians, who are bound by professional confidentiality obligations. Clinical records are kept separately from booking records, with access limited to your treating clinician(s).
Who we share your information with
We use a small number of trusted service providers to run our booking system and website:
- Cal.com — our booking and scheduling platform. When you book, your name, email and booking answers are sent to Cal.com to create your registration. Cal.com's own privacy policy explains how they handle this data.
- Netlify — our website hosting provider.
We don't share your information with anyone else except where we're required to by law.
How long we keep your information
We generally keep booking records for 7 years after your last booking, to handle any queries, refunds or legal obligations. However, if you remain an active client, we keep your records for as long as you continue to book with us. In line with HCPC guidance, clinical records are kept for 7 years after treatment ends.
Your rights
Under UK GDPR, you have the right to:
- Ask for a copy of the personal information we hold about you
- Ask us to correct inaccurate information
- Ask us to delete your information, in some circumstances
- Ask us to restrict or object to certain processing
- Ask for your information in a portable format
To exercise any of these rights, contact us at flo.physio.pilates@gmail.com. We'll normally respond within one month. If you're unhappy with how we've handled your information, you also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.
Keeping your information secure
We use reputable, established providers (Cal.com and Netlify) to store and process booking information, and we don't store payment card details ourselves. Where payment is required, it's taken by Cal.com using Stripe as the payment processor — your card details are entered directly into Stripe's secure checkout and are never seen or held by FLO Studio.
Changes to this policy
We may update this policy from time to time, for example if we start using a new service or add online payments. We'll update the "last updated" date at the top of this page when we do.
Contact us
Questions about this policy or your information: flo.physio.pilates@gmail.com.