Introduction
This Privacy Policy explains how Laura Marchesini, trading as OsteoGym, collects, uses, stores and protects personal information. Laura Marchesini is a sole trader and is the data controller for the personal information described in this policy, except where a separate organisation (such as a clinic) acts as a controller for its own processing.
This policy applies to OsteoGym's current personal training services, including in-person sessions at a clinic, at-home visits and online sessions, as well as enquiries and use of the OsteoGym website. OsteoGym does not currently provide services to anyone under 18.
Who is responsible for your information?
London SE17 3SE
United Kingdom
General enquiries: info@osteogym.com
Privacy, data-rights and data-protection complaints: lauramarche92@gmail.com
Personal information we collect
Depending on how you interact with OsteoGym, we may process:
- Identity and contact information, such as your name, email address, telephone number and, for at-home sessions, your address.
- Enquiry and correspondence information, including information you include in emails or other messages and records of communications with you.
- Website enquiry information, if you use the general enquiry form, including your name, email address, optional telephone number, training-format preference, preferred contact method and the general message you submit. The form is not a booking form and asks you not to submit detailed or confidential medical information.
- Appointment and service information, such as session dates, attendance, training preferences and administrative information relating to your sessions.
- Fitness and training information, including goals, exercise programmes, progress information and session notes.
- Health information, where relevant to safe and appropriate personal training. This may include information supplied through a PAR-Q or medical questionnaire, injuries, medical conditions, symptoms, physical limitations and other health information you choose or need to provide. Health information is special-category personal data and receives additional protection under data protection law.
- Payment and accounting information where needed for business, invoicing and tax records. OsteoGym does not currently take payments through this website and does not collect payment-card details through the website.
- Limited technical information that may be processed by the website's hosting and security infrastructure, such as IP address, browser/device information, date and time of access, and security or server-log information. OsteoGym does not currently use this information for advertising or behavioural profiling.
Where we obtain your information
We obtain most personal information directly from you, for example when you:
- email OsteoGym, use the website's general enquiry form or otherwise make an enquiry;
- complete a PAR-Q or other health/safety questionnaire;
- take part in a personal training session; or
- communicate with Laura about your programme, progress or appointments.
Where a session is arranged through the physiotherapy clinic at which Laura works, relevant information may also be received through the clinic's reception or practice-management arrangements. The clinic may be a separate data controller for information it collects and uses for its own booking, administration and other purposes; its own privacy information will apply to that processing.
Why we use your information and our lawful bases
Enquiries and arranging personal training services
We use identity, contact and enquiry information to respond to you, discuss your requirements, arrange sessions and take steps at your request before entering into a contract. Our lawful basis is that the processing is necessary to take steps before entering into a contract and, where you become a client, to perform our contract with you.
Providing and administering personal training
We use contact, appointment, fitness, programme and session information to provide, adapt and administer personal training services. Our lawful basis is performance of our contract with you.
Health and safety information
To provide personal training safely, we may need to understand relevant health conditions, injuries or physical limitations. For ordinary data, our Article 6 lawful basis is normally performance of our contract with you. Because health information is special-category data, we also require an Article 9 condition. For routine assessment and delivery of OsteoGym's current personal training services, we rely on your explicit consent where required. We will ask for that consent separately and clearly, for example in connection with the PAR-Q or health questionnaire.
You may withdraw that consent at any time by contacting lauramarche92@gmail.com. Withdrawal does not affect processing that was lawful before you withdrew consent. If relevant health information is objectively necessary to provide training safely, we may be unable to continue providing some or all services after consent is withdrawn.
Professional records, insurance and legal claims
We may retain relevant client and session records to maintain appropriate professional records, respond to complaints, meet applicable insurance requirements, and establish, exercise or defend legal claims. For ordinary personal data, our lawful basis is our legitimate interests in maintaining appropriate records, meeting insurance requirements and protecting our legal rights. Where health information is necessary for the establishment, exercise or defence of legal claims, we rely on the legal-claims condition under Article 9(2)(f) of the UK GDPR.
Accounting and tax
We may use and retain relevant transaction and business records to comply with tax, accounting and other legal obligations. Our lawful basis is compliance with a legal obligation.
Website operation and security
Limited technical information may be processed where necessary to deliver, maintain and secure the website, prevent abuse and investigate security incidents. Our lawful basis is our legitimate interests in operating and protecting a secure website. We do not currently use Google Analytics or another analytics service, advertising trackers, profiling technologies or third-party marketing pixels.
Marketing, testimonials and embedded content
OsteoGym does not currently operate an email newsletter or use client information for direct email marketing. The website does not currently publish client photographs, before-and-after images or testimonials and does not use Google Analytics or similar analytics services.
The contact page contains an interactive Google Map that loads automatically when you visit that page. Content is requested from Google, which may receive technical information about your device or connection and may use cookies or similar technologies under its own privacy terms. A normal external directions link is also available.
The website does not currently embed YouTube, Vimeo, Instagram or similar social-media content. We will update this policy and, where required, obtain consent before introducing materially different uses of personal information.
Email and WhatsApp Business
Email is OsteoGym's first-contact method through the website. Existing clients may also communicate with Laura using WhatsApp Business. If you choose to use WhatsApp Business, WhatsApp/Meta will process information associated with that communication under its own terms and privacy information. Please avoid sending detailed or unnecessary health information by WhatsApp. Where information from a message is relevant to your training record, it may be recorded with your client notes.
How and where client records are stored
For clients seen through the clinic, relevant records may be recorded in the TM3 practice-management system under the clinic's arrangements. For Laura's private clients, client notes and training information are stored using encrypted cloud storage accessed through Laura's iPad. Access to personal information is limited to what is reasonably necessary for the purposes described in this policy.
No method of electronic storage or communication can be guaranteed to be completely secure, but OsteoGym takes reasonable technical and organisational measures appropriate to the nature of the information, particularly where health information is involved.
Who we share information with
OsteoGym does not sell personal information. Personal information may be made available only where necessary to:
- the clinic's authorised reception/administrative personnel and practice-management provider where a clinic-based service is arranged or recorded;
- Cloudflare, which provides website hosting, delivery and security and processes the website's same-origin enquiry request;
- Resend, which is used to deliver a submitted website enquiry to OsteoGym by email;
- Google, when you visit the contact page containing the automatically loaded map or follow the external Google Maps link;
- service providers supporting email, encrypted cloud storage and communications;
- professional advisers, insurers or legal representatives where necessary to obtain advice, deal with a claim or protect legal rights; or
- public authorities, regulators, courts or law-enforcement bodies where disclosure is required or permitted by law.
OsteoGym does not routinely disclose client information to GPs, other therapists or other healthcare professionals. If such a disclosure becomes necessary, we will only make it where there is an appropriate lawful basis and, where required, an applicable special-category condition such as explicit consent.
International transfers
Some technology providers used for email, cloud storage, website infrastructure or communications may process or make personal information accessible outside the United Kingdom. Where this amounts to a restricted transfer under UK data protection law, OsteoGym will use the service only where an appropriate lawful transfer mechanism is available. Depending on the destination and provider, this may include UK adequacy regulations or approved contractual safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with any additional measures required by law. You may contact lauramarche92@gmail.com for further information about the safeguards relevant to your information.
How long we keep your information
We keep personal information only for as long as reasonably necessary for the purpose for which it is held. Our current retention approach is:
- Enquiries that do not become a client relationship: normally up to 12 months after the last substantive correspondence, unless a longer period is needed to deal with a complaint, dispute or legal issue.
- OsteoGym client records: records including PAR-Q information, relevant health information, programmes and session notes are normally retained for up to 7 years after the client relationship ends, reflecting OsteoGym's current insurance record-keeping and legal-claims requirements. Information that is no longer necessary will be deleted or securely disposed of sooner where appropriate.
- Routine email or WhatsApp correspondence: retained only while it is reasonably needed for communication and administration. Relevant information forming part of the client record may be retained with that record for the period above.
- Tax and accounting records: retained for the period required by HMRC and other applicable legal obligations. For a sole trader, this is generally at least 5 years after the 31 January Self Assessment submission deadline for the relevant tax year, with longer periods applying in some circumstances.
- Website technical/security information: retained only for as long as needed for hosting, security, troubleshooting or investigation of an incident, taking account of the configuration and retention periods of the relevant provider.
Where clinic-controlled records are held under a clinic's own arrangements, the clinic's retention policy may apply to those records.
Do you have to provide personal information?
You are not required to provide personal information simply to browse the OsteoGym website. If you make an enquiry or ask to receive personal training, certain identity, contact and service information will be necessary to respond to you and provide the service. Relevant health information may also be objectively necessary to assess whether and how training can be provided safely. If necessary information is not provided, OsteoGym may be unable to offer or continue a service.
Your data protection rights
Depending on the circumstances and the lawful basis being used, you may have the right to:
- ask for access to the personal information we hold about you;
- ask us to correct inaccurate or incomplete information;
- ask us to erase your personal information in certain circumstances;
- ask us to restrict the use of your personal information in certain circumstances;
- object to certain processing;
- receive or transfer certain information in a portable format where the right to data portability applies; and
- withdraw consent at any time where processing is based on consent.
These rights are not absolute and exemptions may apply. To exercise a right, email lauramarche92@gmail.com. We may ask for information reasonably necessary to confirm your identity. We will respond within the time required by data protection law.
Your right to object
Where we rely on legitimate interests to use your personal information, you have the right to object to that processing. If you object, we will stop the processing unless we can demonstrate compelling legitimate grounds to continue, or the processing is needed for the establishment, exercise or defence of legal claims.
Automated decision-making
OsteoGym does not currently use personal information to make decisions based solely on automated processing that produce legal or similarly significant effects, and does not carry out automated profiling for marketing purposes.
People under 18
OsteoGym's personal training services are currently for adults aged 18 and over. OsteoGym does not knowingly collect personal information from anyone under 18 for the purpose of providing personal training services. If you believe a person under 18 has provided personal information to OsteoGym in error, please contact us so that we can review and, where appropriate, delete it.
Data protection concerns and complaints
If you have a concern or complaint about how OsteoGym has handled your personal information, please contact Laura at lauramarche92@gmail.com. Data protection complaints will be acknowledged within 30 days. We will take appropriate steps to investigate without undue delay, keep you informed as appropriate and tell you the outcome.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator:
Information Commissioner's Office Wycliffe HouseWater Lane
Wilmslow
Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk/make-a-complaint
Changes to this Privacy Policy
We may update this Privacy Policy if OsteoGym's services, systems, suppliers or legal obligations change. The current version will be published on this website with the date of the latest update. Where a change materially affects how we use existing client information, we will take appropriate steps to bring the change to the attention of affected clients.