At Flow by Comfort Health, operated by Comfort Physiotherapy Limited, we respect your privacy and are committed to protecting your personal information.
This Privacy Notice explains how we collect, use, store and protect your personal information when you visit our studio, create an account, book or attend a class, purchase a membership, make a payment, or otherwise interact with us.
We process personal information in accordance with applicable UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are
The data controller responsible for your personal information is:
Comfort Physiotherapy Limited, trading as Flow by Comfort Health
Email: flow@comforthealth.co.uk
Address: 11 Alma Vale Road, Clifton, Bristol BS8 2HL
If you have any questions about how we use your personal information or this Privacy Notice, please contact us using the details above.
2. Information we collect
Depending on how you interact with us, we may collect the following information.
Personal and contact information
This may include:
- Full name
- Email address
- Telephone/mobile number
- Date of birth
- Account and membership information
- Class bookings and attendance records
- Purchase and transaction information
- Communications between you and us
- Marketing preferences
Health and medical information
Because we provide Yoga, Pilates and Physiotherapy-led classes and services, we may ask you to provide information about your health and physical condition.
This may include:
- Injuries
- Medical conditions
- Pregnancy
- Medication
- Previous or planned surgery
- Previous injuries or operations
- Physical limitations
- Rehabilitation needs
- Information about your ability to participate safely in exercise or particular classes
- Other health information that you choose or are required to provide in connection with our services
Health information is special category data under UK data protection law and is subject to additional legal protections.
We only collect and use health information where it is relevant and necessary to provide our services safely and appropriately.
3. How we use your information
We may use your personal information to:
- Create and manage your customer account
- Process class and appointment bookings
- Manage memberships and subscriptions
- Process payments, refunds and other transactions
- Send booking confirmations, reminders and other service-related communications
- Manage cancellations, late cancellations and no-shows
- Keep records of attendance and purchases
- Provide Yoga, Pilates and Physiotherapy-led classes and services
- Assess whether a class or service is appropriate for you
- Adapt exercises or instruction where appropriate
- Identify and manage potential risks relating to your participation
- Support rehabilitation and physiotherapy services where applicable
- Communicate with you about your bookings, membership or services
- Respond to enquiries and requests
- Maintain the security of our systems and services
- Prevent fraud or misuse of our services
- Comply with legal, regulatory, insurance and professional obligations
- Improve our services and customer experience
4. Health information and special category data
Some of the information we collect is health information and therefore constitutes special category data under the UK GDPR.
We may process this information where necessary to:
- Assess your suitability for exercise or a particular class
- Make appropriate adjustments to exercises or instruction
- Identify potential risks and help keep you safe
- Provide physiotherapy or rehabilitation services
- Maintain appropriate clinical or treatment records where applicable
- Respond appropriately to health or safety concerns
- Meet relevant legal, regulatory, professional or insurance requirements
Because health information has additional legal protections, we will only process it where we have both an appropriate lawful basis under Article 6 of the UK GDPR and an applicable condition for processing special category data under Article 9.
Where appropriate, we may ask for your explicit consent to process particular health information.
5. Our lawful bases for using your information
We must have a lawful basis under data protection law for processing your personal information.
Depending on the circumstances, we may rely on:
- Contract – where processing is necessary to provide the services you have purchased, manage your membership or process your bookings and payments.
- Legal obligation – where we are required to process information to comply with a legal or regulatory requirement.
- Legitimate interests – where processing is necessary for our legitimate business interests, such as managing and improving our services, provided that our interests do not override your rights and freedoms.
- Consent – where we ask for your consent to process information for a particular purpose and consent is the appropriate legal basis.
For health information and other special category data, we will also rely on an appropriate condition under Article 9 of the UK GDPR.
6. Payment information
We use Stripe to process payments for memberships, classes and other services.
Stripe processes your payment information on our behalf. We do not generally receive or store your full payment card details.
We may receive information about your transactions, such as the amount paid, date of payment, payment status and information necessary to manage your membership or account.
Stripe processes personal information in accordance with its own privacy policy and applicable data protection requirements.
7. Momence
We use Momence to manage aspects of our studio services, including:
- Customer accounts
- Class and appointment bookings
- Memberships and subscriptions
- Class attendance
- Purchases
- Customer communications
- Relevant customer information
Momence processes personal information on our behalf as part of providing its platform and services to us.
8. Who we share your information with
We may share your personal information with trusted third-party service providers where necessary to operate our business and provide our services.
These include:
- Momence, for customer accounts, bookings, memberships, subscriptions, attendance and related services
- Stripe, for payment processing
We may also disclose information where necessary to:
- Professional advisers
- Insurers
- IT and technology providers
- Healthcare or other professionals involved in your care, where appropriate
- Regulatory or professional bodies where required
- Law enforcement or other authorities where we are legally required to do so
We do not sell your personal information.
9. International transfers
Some of the organisations we use may process or store personal information outside the UK.
Where personal information is transferred outside the UK, we will take appropriate steps to ensure that the transfer is carried out in accordance with applicable UK data protection law and that appropriate safeguards are in place.
10. How long we keep your information
We retain personal information only for as long as necessary for the purposes for which it was collected, including where necessary to meet legal, accounting, insurance, regulatory or professional requirements.
Different types of information may be retained for different periods.
Where we provide physiotherapy or other healthcare-related services, certain records may need to be retained for longer periods in accordance with applicable professional, legal or insurance requirements.
When personal information is no longer required, we will securely delete or anonymise it where appropriate.
11. Keeping your information secure
We take appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, misuse, alteration or disclosure.
Access to personal information is restricted to people who need it for legitimate business purposes.
We take particular care with health and medical information because of its sensitive nature.
12. Marketing
We may contact you about our classes, memberships, workshops, events and other services.
Where required by law, we will ask for your consent before sending marketing communications.
You can unsubscribe from marketing communications at any time by using the unsubscribe option provided in the communication or by contacting us.
Please note that opting out of marketing does not prevent us from sending essential service communications, such as booking confirmations, class reminders, membership information or other messages necessary to provide services to you.
13. Your data protection rights
Depending on the circumstances, you have rights under UK data protection law including the right to:
- Request access to the personal information we hold about you
- Ask us to correct inaccurate or incomplete information
- Ask us to delete your information where there is no good reason for us to continue processing it
- Ask us to restrict how we use your information in certain circumstances
- Object to certain types of processing
- Request the transfer of certain information to you or another organisation
- Withdraw consent where we rely on consent as our lawful basis
These rights are subject to certain exceptions and conditions under data protection law.
To exercise your rights, please contact us at flow@comforthealth.co.uk.
14. Complaints
If you have concerns about how we have handled your personal information, please contact us first so that we can try to resolve the issue.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data protection regulator.
Further information about your data protection rights and how to make a complaint can be found on the ICO's website.
15. Changes to this Privacy Notice
We may update this Privacy Notice from time to time to reflect changes to our services, technology, legal requirements or the way we process personal information.
The latest version will be made available to customers and will include the date on which it was last updated.
Comfort Physiotherapy Limited, trading as Flow by Comfort Health
Email: flow@comforthealth.co.uk
Address: 11 Alma Vale Road, Clifton, Bristol BS8 2HL