Privacy Policy 

2.        The Personal Data We Collect  

Personal data means any information about an individual from which that person can be identified.  

We may collect, use, store and process the following categories of personal data:

  A. Customer and Order Data

• Full name
• Billing and delivery address
• Email address
• Telephone number
• Order history
• Payment transaction confirmation details (we do not store full card details)  

B. Course and Training Records

• Name and contact details
• Courses attended
• Certification status
• Attendance records
• Assessment outcomes (where applicable)  

C. Certified Practitioner Information

Where individuals are listed as certified practitioners, we may process:

• Name
• Practice name
• Professional contact details
• Certification status
• Practice location  

Practitioner details are published either:

• With the practitioner’s consent; or
• Under our legitimate interests in promoting certified practitioners and supporting customers in locating trained professionals.  

D. Marketing Data

• Email address
• Mobile number
• Marketing preferences
• Interaction data (e.g. email opens, clicks)  

We use Mailchimp as our email marketing platform.  

E. Technical and Usage Data 

• IP address
• Browser type and version
• Time zone setting
• Device type
• Website usage data (via cookies and similar technologies)  

F. Scan and Check-Up Data (Including Special Category Data)

We offer scan services that generate a Check-Up Report and a Detailed Report.  

When you participate in a scan, we may collect:

• Your name and contact details (for delivery of results)
• Scan reference information
• Scan result data

In this policy, references to “scan data”, ”scan result data”, “scan-related data” or similar terms refer to information that may relate to health or wellbeing and may constitute special category data under Article 9 UK GDPR.  

Identifiable scan data is processed only: 

With your explicit consent; and/or

For the provision of a service you have requested.  

Where scan result data constitutes special category (health) data, we process it only with your explicit consent in accordance with Article 6(1)(a) and Article 9(2)(a) UK GDPR.  

You will be asked to provide clear and explicit consent for the processing of your scan‑related health data at the point of booking or request. You may withdraw your consent at any time by contacting us using the details set out in Section 12. Please note that if you withdraw your consent, we may no longer be able to provide the scan service or related results.  

Scan data used for internal analysis and service improvement is anonymised. This means:

• Identifiers are removed or stored separately;
• The data cannot reasonably be used to identify you;
• It is no longer personal data once anonymised.  

G. Identity Verification Data (Rental Products)

Where products are rented, we may request proof of identity and address for verification purposes. This may include:

• Passport
• Driving licence
• Utility bill or bank statement  

This information is processed for the purposes of fraud prevention, asset protection, and contractual security.

Our lawful basis for processing this data is:

• Article 6(1)(b) UK GDPR – performance of a contract; and/or
• Article 6(1)(f) UK GDPR – legitimate interests in preventing fraud and protecting company property.  

We retain identity verification data only for as long as necessary in connection with the rental agreement and in accordance with legal limitation periods.  

H. Identity Verification Data (Collective Practitioners Support Services)  

Where individuals register with our Collective Practitioners Support Services, we request proof of identity and address for verification purposes. This may include Photo ID such as:

• Passport
• Driving licence  

This information is processed for the purposes of identity verification, safeguarding of services, fraud prevention, and ensuring the integrity and security of practitioner and client interactions.  

Our lawful basis for processing this data is:

• Article 6(1)(b) UK GDPR – performance of a contract; and/or
• Article 6(1)(f) UK GDPR – legitimate interests in maintaining secure and trusted service provision, preventing fraud, and protecting participants.  

We retain identity verification data only for as long as necessary to confirm the identity of the Practitioner and for a reasonable period thereafter in accordance with legal limitation periods.