PRIVACY POLICY
This policy was last updated: 07/10/2026
Date to be reviewed: October 2027, or sooner if our services or data protection laws change
1. About this Privacy Policy
Mark Bailey Massage Therapy takes the privacy and confidentiality of clients and website visitors seriously.
This Privacy Policy explains what personal information I collect, why I collect it, how it is used and stored, who it may be shared with, how long it is retained and the rights you have in relation to your information.
I process personal information in accordance with applicable UK data protection and privacy legislation, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), as amended, and the Data (Use and Access) Act 2025.
All data protection provisions of the Data (Use and Access) Act 2025 are now in force. ICO
For data protection purposes, Mark Bailey Massage Therapy is the Data Controller for the personal information described in this policy.
Contact:
Mark Bailey Massage Therapy
Higham Ferrers, Northamptonshire
Email: mark@markbaileymassagetherapy.co.uk
2. Information I may collect
The information collected will depend on how you interact with the business and may include your name, date of birth, address, telephone number, email address and emergency contact details.
For clients under 18, I may also collect information relating to a parent, guardian or responsible adult.
When you book or receive treatment, I may collect appointment information, consultation and assessment information, treatment notes, areas treated, techniques used, your response to treatment and any exercises, stretches or self-management advice provided.
I may also hold records of appointments booked, changed or cancelled, screening forms, consent records, invoices, payment records and communications relating to your treatment.
3. Health information
3. Health Information
Providing massage treatment safely may require me to collect information about your health, including medical conditions, injuries, symptoms, medications, allergies, operations, pregnancy where relevant and other information that may affect treatment.
Health information is classed as special-category personal data and receives additional protection under UK data protection law.
UK GDPR requires both an appropriate Article 6 lawful basis and an Article 9 condition before processing special-category information. ICO guidance
How I use your health information
For health information necessary to assess your suitability for massage treatment and provide the service you have requested, I generally rely on the performance of a contract or steps taken at your request under Article 6(1)(b), together with your explicit consent under Article 9(2)(a).
Explicit consent must be freely given, specific, informed and clearly expressed. You can withdraw your consent to the processing of health information for assessment and treatment at any time by contacting mark@markbaileymassagetherapy.co.uk.
Withdrawing consent does not affect processing that was lawful before the withdrawal. Where I can no longer lawfully process the health information needed to assess suitability and provide treatment, I may be unable to continue providing that treatment.
Retaining treatment records
I may need to retain certain treatment records after treatment has ended, including where reasonably necessary for the establishment, exercise or defence of legal claims and matters relating to professional indemnity insurance.
Where applicable and justified, I rely on legitimate interests under Article 6(1)(f) and the legal claims condition under Article 9(2)(f) for this separate record-retention purpose.
Any continued retention must be necessary, proportionate and consistent with the retention periods explained in Section 10 of this Privacy Policy.
Withdrawing consent to treatment-related processing does not automatically require deleting records lawfully retained for a separate, previously explained purpose.
Consent to treatment
Consent to the processing of your health information is separate from your consent to receive massage treatment.
Before treatment begins, we will discuss the proposed treatment and agree on it with you. You may ask questions, decline any technique or withdraw your consent to treatment at any time.
4. How I collect information
Information may be collected when you book an appointment, complete a client screening form, contact me through the website, telephone, email or social media, attend a consultation or treatment, make or change an appointment, make a payment or provide feedback or a review.
Information may occasionally be provided by another person or healthcare professional where you have authorised them to do so or another lawful basis applies.
5. How I use your information
Your information may be used to arrange and manage appointments; assess whether treatment is suitable; provide and tailor treatment; maintain appropriate treatment records; communicate with you; send appointment confirmations and reminders; process payments; deal with cancellations, enquiries or complaints; provide relevant exercises or self-management advice; meet insurance, legal, tax and professional requirements; maintain the security of my systems; and establish, exercise or defend legal claims.
Marketing communications will only be sent where permitted by law, and you can opt out of them at any time.
6. Clients under 18
I may provide treatment to clients under the age of 18 where appropriate. For clients under 18, I must obtain written consent from a parent or guardian before treatment, and an adult must remain present throughout the appointment.
Relevant details of the parent or guardian and evidence of consent may be retained as part of the client’s treatment record.
Balens specifically requires practitioners to retain documented consent and highlights written parent/guardian consent when treating children and young people. Balens
Information relating to younger clients will be treated with the same confidentiality and security as information relating to adult clients.
7. Treatment records
I maintain accurate treatment records to support safe treatment, continuity of care, and my professional and insurance obligations.
Where relevant, records may include consultation information, medical conditions, medications, allergies, contraindications, assessment of suitability, consent, treatment provided, any modifications made, client responses, outcomes and aftercare or self-management advice.
This reflects Balens’ current record-keeping guidance and insurance requirements. Balens
8. Cliniko and online booking
I use Cliniko for practice management and online bookings.
Cliniko may be used to store and process contact information, appointments, screening forms, consent records, treatment notes, communications and other information necessary to manage your treatment.
When Cliniko processes client information on behalf of Mark Bailey Massage Therapy, it acts as a data processor. Cliniko has a UK Data Processing Addendum and UK privacy arrangements to support UK GDPR requirements. Cliniko Help
Cliniko states that accounts created in the UK store account data in the UK. Cliniko
Cliniko also uses approved subprocessors, and appropriate safeguards apply where information is subject to an international transfer.
9. Who information may be shared with
I do not sell your personal information.
Where necessary, I may share information with service providers involved in operating the business, such as Cliniko, website hosting, email, IT, payment, accounting, or professional advisory services.
Information may also be disclosed to my professional indemnity insurer, legal advisers, regulators, law enforcement or another organisation where required by law or necessary to establish, exercise or defend legal rights.
Information may be shared with another healthcare professional where you have authorised this or another lawful basis allows or requires it.
Service providers processing information on my behalf are expected to maintain appropriate confidentiality and data protection safeguards.
10. How long information is kept
I will not keep personal information longer than necessary, but I must also retain treatment records in accordance with my professional indemnity insurance requirements.
Adult treatment records
I will retain treatment and associated client records for a minimum of 7 years after the last occasion treatment was provided.
Clients under 18
Records relating to treatment provided while a client is under 18 will be retained for a minimum of 7 years after the client reaches the age of 18, ordinarily until at least their 25th birthday.
Vulnerable adults
Where appropriate, records relating to vulnerable adults may be retained for longer because limitation periods can sometimes be extended.
These periods reflect current Balens record-keeping requirements. Balens
Enquiries that do not result in treatment
Information relating solely to an enquiry will normally be deleted when it is no longer required and ordinarily within 12 months unless there is a reason to retain it for longer.
Financial records
We will retain relevant financial information for the period required by tax, accounting, and other legal obligations.
Marketing records
Information used for marketing will be retained while you remain subscribed. If you unsubscribe, limited information may be retained on a suppression list so that your preference can continue to be respected.
11. Keeping your information secure
I take reasonable technical and organisational measures to protect personal information against unauthorised access, loss, alteration, inappropriate disclosure or misuse.
This includes appropriate account security, passwords, secure practice-management systems and access controls.
Cliniko recommends additional protections such as two-factor authentication for accounts containing sensitive client information. Cliniko Help
No electronic system can be guaranteed to be completely risk-free, but reasonable measures are taken to minimise those risks.
12. Data breaches
If a personal data breach occurs, I will assess the circumstances and take appropriate action.
Where legally required, I will report the breach to the appropriate data protection regulator and inform affected individuals where a breach is likely to result in a high risk to their rights and freedoms.
13. Marketing
I will only send marketing communications where there is an appropriate lawful basis and applicable electronic marketing requirements have been met.
You may withdraw consent or unsubscribe from marketing communications at any time by contacting:
mark@markbaileymassagetherapy.co.uk
Appointment confirmations, reminders, screening forms and communications directly connected with your treatment are service communications rather than marketing communications.
14. Cookies and website information
The website may use cookies and similar technologies for functionality, security and, where applicable, analytics.
When consent is legally required for non-essential cookies, they will not be used unless the appropriate consent has been obtained.
Further information is available in the separate Cookie Policy.
Technical information such as IP address, browser or device information may also be processed where necessary to operate and protect the website.
15. Reviews and testimonials
If you voluntarily provide a review or testimonial, the information you provide may be processed for feedback and business purposes.
Where reviews are reproduced on my website or marketing materials, I will only do so where there is an appropriate lawful basis and, where appropriate, your permission.
Reviews posted directly to third-party services such as Google are also subject to that provider’s privacy terms.
16. Your rights
Depending on the circumstances and lawful basis involved, you may have rights to access your personal information, correct inaccurate information, request deletion or restriction of processing, object to certain processing, receive certain information in a portable format and withdraw consent where processing relies on consent.
These rights are not absolute. For example, I may need to retain treatment information despite a deletion request where the information is reasonably required to meet insurance obligations or establish, exercise or defend legal claims.
To exercise a data protection right, contact:
mark@markbaileymassagetherapy.co.uk
I may need to verify your identity before releasing or changing information.
17. Data protection complaints
If you have any concerns about how your personal information has been handled, please contact me in the first instance:
Mark Bailey
Mark Bailey Massage Therapy
mark@markbaileymassagetherapy.co.uk
I will provide an appropriate way for you to raise a data protection complaint, acknowledge it within 30 days, investigate it appropriately, and communicate the outcome without undue delay.
These requirements became part of UK data protection law in June 2026. ICO
You also have the right to complain to the UK’s data protection regulator. Current information about making a complaint is available from the Information Commissioner’s Office (ICO) at www.ico.org.uk.
18. Automated decision-making
Mark Bailey Massage Therapy does not use personal information to make solely automated decisions about clients that produce legal or similarly significant effects.
19. External websites and social media
My website may contain links to third-party websites and social-media platforms. Once you leave my website, the privacy practices of those organisations will apply.
If you contact me through social media, that platform may process information in accordance with its own privacy policy.
Because social media is not the most appropriate place to discuss detailed medical or treatment information, I may ask you to continue sensitive conversations through a more suitable private communication channel.
20. Changes to this policy
This policy will be reviewed regularly and updated where necessary, including if my services, suppliers, systems or applicable legislation change.
The current version will be published on the Mark Bailey Massage Therapy website with the date it was last updated.
21. Contact
For questions about this Privacy Policy, how your personal information is handled or to exercise a data protection right, please contact:
Mark Bailey
Mark Bailey Massage Therapy
Higham Ferrers, Northamptonshire