At Serene Studio, I am committed to protecting your privacy and handling your personal data with care. This policy explains what information I collect, why I need it, and how I keep it secure. 

1. Who I Am

​

Serene Studio is a home-based Swedish massage therapy business located at 13 Stanier Way, Hedge End, SO30 2XE.  For the purposes of data protection, Keren Townend is the Data Controller. 

• Contact: info@kerenserenestudio.co.uk

 

2. What Information I Collect

I collect and process the following data to provide safe and effective treatments: 

 

• Personal Details: Name, address, date of birth, and contact information.

• Health Information: Medical history, current medications, allergies, and session notes

• Booking Data: Appointment history and preferences.

• Payment Data: Transaction records (though card details are processed securely via [e.g., Square/Stripe/SumUp] and not stored by me). 

 

3. Lawful Basis for Processing

Under GDPR, I process your data based on:

• Contract: To fulfil your booking and provide the service.

• Legal Obligation: To comply with insurance and tax requirements.

• Consent: Your explicit consent is obtained for processing health data and sending any marketing updates. 

​

4. How Your Data Is Stored & Shared

• Security: Digital records are stored on password-protected devices or secure, GDPR-compliant booking platforms. Any paper records are kept in a locked filing cabinet.

• Sharing: I never sell your data. It is only shared with third-party service providers (website wix.com) for the purpose of appointment bookings or if required by law or for my professional insurance. 

​​

5. Data Retention

In accordance with UK insurance and legal requirements for healthcare-related records, I retain your data for 7 years after your last treatment. After this period, your data is securely destroyed. 

​

6. Your Rights

You have the right to: 

• Access: Request a copy of the information I hold about you.

• Rectification: Ask me to correct any inaccurate information.

• Erasure: Request data deletion (though this may be limited by legal retention requirements for medical notes).

​​

Complain: Lodge a complaint with the Information Commissioner’s Office (ICO) if you are unhappy with how I handle your data. 

​