Privacy Notice

Your privacy matters, and I take it seriously.


To provide safe, appropriate and personalised support through Reflexology, Still Point, Zen Sleep Support, and other holistic therapies offered by The Zen Within, I may need to collect and store personal information, including health-related information.


Who I am

The Zen Within is operated by Emma Hammerton, who is the data controller for the personal information you provide in connection with appointments, consultations, treatments, support packages, and related communication.


If you have any questions about this Privacy Notice or how your information is handled, you can contact me using the details at the bottom of this page.


What information I may collect

Depending on the service you use, I may collect:

  • your name, date of birth, address, email address, and phone number 
  • appointment and booking details 
  • emergency contact details where relevant 
  • health and wellbeing information you choose to share 
  • medical history relevant to the service being provided 
  • medication, supplements, and other relevant treatment information 
  • consultation forms, intake forms, sleep diaries, treatment notes, session summaries, and follow-up information 
  • communication records relating to your appointments or support 


For business and workplace wellbeing contacts, I may also collect:

  • organisation name and business address
  • your name and job role where relevant
  • business email address and telephone number
  • the source of publicly available business contact information
  • records of business enquiries, correspondence and workplace wellbeing discussions
  • marketing preferences, including any request not to be contacted again. 


Why I collect and use this information

I use your information to:

  • manage bookings, appointments, and enquiries 
  • decide whether a service is appropriate for you 
  • provide safe, tailored holistic support 
  • keep accurate client records 
  • review progress across a treatment or support package 
  • communicate with you about appointments, follow-up, resources, and service-related matters 
  • meet legal, insurance, tax, regulatory, or professional record-keeping requirements 
  •  For business contacts, I may use information to:
  • respond to workplace wellbeing enquiries
  • identify and contact organisations that may have a genuine interest in The Zen Within's workplace wellbeing services
  • manage employer relationships, pilots and partnerships
  • keep a record of business correspondence and follow-up
  • record and respect requests not to receive further marketing. 


Lawful basis

Under UK GDPR, I must have a lawful basis for processing personal information.

The lawful basis I rely on will usually be:

  • performance of a contract where I am providing a booked service 
  • legitimate interests in running the practice safely and effectively 

Where I process health-related information, I do so because it is necessary for providing safe, appropriate holistic support, assessing whether the service is suitable, keeping appropriate client records, and meeting insurance, legal, and professional responsibilities.


Health information

Some of the information I collect, including health-related information, is treated as special category data under UK GDPR. This means it requires extra protection.

I only collect health-related information where it is relevant to the support, treatment, or service being provided.


How your information is kept safe

I take reasonable steps to store your information securely and limit access to it.

Your information is only accessed where necessary for providing services, keeping records, or meeting legal and professional responsibilities.


Who I share information with

Your information will not be sold or shared for unrelated marketing purposes.

I will only share information where:

  • you have asked me to 
  • you have given clear permission 
  • I am required to do so by law 
  • there is a safeguarding concern or serious risk to you or someone else 
  • it is necessary for legal, insurance, or regulatory reasons 

I may use trusted service providers such as booking, form, email, website, or secure record systems to help run the practice. Where this happens, I remain responsible for handling your information appropriately.


Marketing

If you choose to sign up for marketing updates, offers or newsletters, I will use your contact details for that purpose. You can opt out at any time.


Business-to-business contact
I may contact relevant organisations or business contacts about The Zen Within's workplace wellbeing services where I reasonably believe the information may be relevant to their organisation or professional role.

Business contact information may come from publicly available sources such as an organisation's website, Companies House, professional business sources, networking contacts or referrals.

Where business contact information identifies an individual, I normally rely on legitimate interests for carefully targeted business-to-business marketing where consent is not required by law. I consider the relevance of the contact, the source of the information and the likely impact on the individual before making contact.

I do not use legitimate interests to send unsolicited electronic marketing where PECR requires prior consent, such as certain communications to sole traders or individual subscribers.

Every business marketing communication provides a simple way to ask me not to make further marketing contact. If you object to direct marketing, I will stop using your personal information for that purpose and retain only the minimum information required to record and respect your preference.


How long I keep your information

I only keep information for as long as reasonably necessary for the purpose it was collected and in line with legal, insurance, tax, and professional requirements.

Client records are usually retained for up to 7 years after your last appointment, unless a longer period is required by law.


Your rights

Under UK GDPR, you have rights over your personal information. These may include the right to:

  • be informed about how your information is used 
  • request access to your information 
  • request correction of inaccurate information 
  • request deletion of information where appropriate 
  • request restriction of processing in some circumstances 
  • object to certain uses of your information 
  • request a copy of information you have provided, where applicable 
  • complain to the Information Commissioner’s Office if you are unhappy with how your information is handled 
  •  You have an absolute right to object to your personal information being used for direct marketing. If you object, I will stop using your information for that purpose. 

If you wish to exercise any of your rights, please contact me directly in the first instance.   

I will acknowledge data protection complaints within 30 days and respond without undue delay once I have reviewed the matter.

You also have the right to raise concerns with the Information Commissioner’s Office.


Data Protection concerns or complaints

If you are unhappy with how I have handled your personal information, please contact me directly in the first instance so I can look into this.

You can raise a data protection concern or complaint by email, phone, or in writing using the contact details below.

I will acknowledge receipt of your complaint within 30 days of receiving it. I will then review the matter, make appropriate enquiries where needed, keep you informed where appropriate, and respond without undue delay once I have looked into it.

If you are not satisfied with my response, you also have the right to raise your concern with the Information Commissioner’s Office.


If you have any questions about this Privacy Notice or how your information is handled, please contact:

Emma Hammerton
07850 462737
zenreflexologymk@gmail.com


You also have the right to raise concerns with the Information Commissioner’s Office.