Privacy Policy: 

Gemma Armstrong Skin & Bodywork

Last updated: 1 September 2026

Gemma Armstrong Skin & Bodywork respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how I collect, use, store and protect your personal information when you visit my website, contact me, book an appointment, complete a consultation, receive a treatment or otherwise use my services.

I am a sole trader and, for the purposes of UK data protection law, I am responsible for deciding how and why your personal information is processed.

I process personal information in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where applicable, the Privacy and Electronic Communications Regulations (PECR).

1. Who I am

Business: Gemma Armstrong Skin & Bodywork
Business owner/data controller: Gemma Armstrong
Website: gemma-armstrong.com
Email: hello@gemma-armstrong.com
Telephone: +44 7531 948 475 

If you have any questions about this Privacy Policy or how your information is handled, please contact me using the details above.

2. What information I collect

Depending on how you interact with my business, I may collect:

Your name and contact details, including email address and telephone number.
Appointment and booking information.
Information about the treatments you book or receive.
Consultation and treatment information.
Information about allergies, injuries, medical conditions, medication, pregnancy and other health matters where relevant to your treatment.
Information relating to contraindications and treatment suitability.
Payment and transaction information.
Correspondence and communications between you and me.
Information you provide when submitting an enquiry, feedback, review or complaint.
Marketing preferences and records of your marketing consent or withdrawal of consent.
Website information, such as information collected through cookies or similar technologies.

I aim to collect only information that is relevant and necessary for providing my services and operating my business.

3. Health and special category information

As part of providing massage, skin and bodywork treatments, I may ask you to provide information about your health and wellbeing.

This may include information about medical conditions, injuries, allergies, medication, pregnancy, previous treatments or other information that may affect whether a particular treatment is appropriate.

Health information is special category personal data under the UK GDPR and requires additional protection.

I only collect and use health information where it is relevant and necessary to assess treatment suitability, identify contraindications, provide treatments safely, maintain appropriate treatment records and meet my legal, insurance or professional obligations.

Where required, I will obtain your explicit consent for the processing of health information. You may withdraw consent where consent is the legal basis being relied upon. However, if I cannot process information that is necessary to assess whether a treatment is safe or appropriate, I may be unable to provide that treatment.

4. How I use your information

I may use your personal information to:

Respond to enquiries.
Arrange and manage appointments.
Provide massage, skin and bodywork treatments.
Complete consultations and assess treatment suitability.
Identify relevant contraindications and treatment considerations.
Maintain appropriate consultation and treatment records.
Contact you about appointments, including confirmations, reminders or changes.
Process payments and maintain financial records.
Deal with cancellations, refunds, complaints and disputes.
Communicate with you about treatments or enquiries.
Send marketing emails where you have provided the required consent or where another lawful basis permits this.
Maintain and improve my services and website.
Meet legal, insurance, accounting and other legitimate business requirements.
Protect my business, clients and other individuals where necessary.

I will not use your personal information for purposes that are incompatible with those explained in this Privacy Policy unless I am legally permitted or required to do so.

5. Lawful bases for processing your information

Under the UK GDPR, I need a lawful basis for processing your personal information.

Depending on the circumstances, I may rely on the following lawful bases:

Contract

I may process information where this is necessary to arrange or provide a treatment or service you have requested.

Legitimate interests

I may process information where this is necessary for the reasonable running, administration and protection of my business, provided that my legitimate interests do not override your rights and freedoms.

Legal obligation

I may process information where I am legally required to do so, for example for certain financial, accounting or regulatory purposes.

Consent

I may rely on your consent where I have specifically asked you to agree to a particular use of your information, such as certain marketing communications or the processing of health information where explicit consent is required.

Where I process special category information, such as health information, I will also ensure that an appropriate condition under UK data protection law applies.

6. Booking appointments — Acuity Scheduling

I use Acuity Scheduling, provided by Squarespace, to manage appointments and bookings.

When you book an appointment, Acuity may collect information such as your name, contact details, appointment details and information provided through any consultation or intake forms that I make available through the booking system.

I use this information to manage your booking, prepare for your appointment, communicate with you and provide appropriate treatments.

Acuity provides tools intended to help businesses manage personal information and GDPR-related requests, although responsibility for how I configure and use the service remains with me as the business owner.

You can find further information about how Squarespace handles personal information in its own privacy documentation.

7. Consultation and treatment records

Consultation information and treatment records may contain sensitive health information.

I store consultation records securely, and take reasonable steps to prevent unauthorised access.

I use these records to:

Assess whether treatments are suitable.
Identify contraindications.
Provide treatments safely and appropriately.
Keep an accurate record of relevant treatment information.
Respond appropriately to future appointments.
Meet applicable legal, insurance or professional requirements.

I will only retain these records for as long as reasonably necessary for the purposes for which they were collected and for any applicable legal, insurance or professional requirements.

Consultation/treatment record retention period: Up to 6 years, unless you request otherwise. 

When records are no longer required, I will securely delete or dispose of them.

8. Payments — Square

I use Square to process payments.

When you make a payment, Square may process information necessary to complete and manage the transaction.

I do not need to collect or store your full payment card details myself in order to process a payment through Square.

Square provides its own privacy information and processes certain information in its role as a payment service provider. Square's current UK documentation explains that its services may involve the processing and storage of information by Square and its service providers in different countries, subject to applicable safeguards.

I may retain information such as payment amounts, dates and transaction references where necessary for accounting, tax, financial and business record-keeping purposes.

9. Email marketing

I use email marketing to send information about Gemma Armstrong Skin & Bodywork, including services, news, offers and other relevant updates.

Where required by law, I will only send marketing emails where you have provided appropriate consent or where I can lawfully rely on an applicable exception.

Marketing consent will not be a condition of booking or receiving treatment.

You can unsubscribe from marketing emails at any time by using the unsubscribe link included in the email or by contacting me directly.

I will keep appropriate records of marketing preferences and consent where necessary to demonstrate compliance with applicable data protection and electronic marketing laws.

10. Website and cookies

When you use my website, certain information may be collected automatically through cookies or similar technologies.

Some cookies may be necessary for the website to function, while others may be used for analytics, functionality or other purposes.

Where required, I will obtain consent before using non-essential cookies.

The exact cookies and third-party services used on my website may change from time to time. Information about the cookies currently used should therefore be provided in my Cookie Policy or cookie consent settings where applicable.

11. Who I share your information with

I do not sell or rent your personal information.

I may share relevant personal information with trusted third parties where this is necessary to operate my business, provide services to you or comply with legal obligations.

These may include:

Squarespace/Acuity Scheduling, for appointment booking and scheduling.
Square, for payment processing.
Website, hosting and technical service providers.
Email marketing service providers.
Accountants or other professional advisers where necessary.
Insurance providers or brokers where necessary in relation to an insurance matter.
Legal, regulatory, government or law-enforcement authorities where I am legally required to provide information.

I will only share information that is reasonably necessary for the relevant purpose.

Third-party providers may have their own privacy policies and may process information in countries outside the UK. Where international transfers of personal data take place, appropriate safeguards will be used where required by UK data protection law.

12. Keeping your information secure

I take reasonable technical and organisational measures to protect your personal information against accidental loss, unauthorised access, alteration, disclosure or destruction.

These measures include password protection and restricting access to personal and consultation information.

I will take particular care with information relating to your health and treatment history.

However, no method of electronic storage or transmission can be guaranteed to be completely secure.

13. How long I keep your information

I will only keep personal information for as long as it is reasonably necessary for the purposes for which it was collected.

Different types of information may be retained for different periods.

Consultation and treatment records: Up to 6 years unless you request otherwise. 

Booking and appointment information: Up to 48 months. 

Financial and accounting records: I will retain these for the period required by applicable tax and accounting requirements.

Marketing information: Until you unsubscribe, withdraw consent or the information is otherwise no longer required.

When information is no longer required, I will securely delete or dispose of it.

14. Your rights

Under UK data protection law, you may have the right to:

Ask what personal information I hold about you.
Request a copy of your personal information.
Ask me to correct inaccurate or incomplete information.
Ask for your information to be erased in certain circumstances.
Ask me to restrict how I use your information in certain circumstances.
Object to certain types of processing.
Request transfer of certain information to another organisation where the right to data portability applies.
Withdraw consent where processing is based on consent.

These rights are subject to certain legal conditions and exemptions, so they will not apply in every situation.

If you would like to exercise any of these rights, please contact me using the details at the end of this Privacy Policy.

15. Making a complaint

If you have concerns about how I have handled your personal information, please contact me first so that I have an opportunity to resolve the matter.

You also have the right to complain to the Information Commissioner's Office (ICO), which is the UK's independent supervisory authority for data protection.

You can find information about your data protection rights and how to make a complaint on the ICO website.

16. Changes to this Privacy Policy

I may update this Privacy Policy from time to time to reflect changes to my business, the services I provide, the third-party services I use or applicable data protection requirements.

The latest version will be made available on my website and will show the date it was last updated.

17. Contact me

If you have any questions about this Privacy Policy or how I process your personal information, please contact:

Gemma Armstrong Skin & Bodywork
Website: gemma-armstrong.com
Email: hello@gemma-armstrong.com