BRT Wellbeing – Privacy Policy Effective Date: 14 June 2025 Business Name: Breathe Recharge Thrive Ltd (BRT Wellbeing) Location: Gloucestershire, United Kingdom Contact Email: [email protected] Website: www.brtwellbeing.co.uk Introduction BRT Wellbeing ("we", "us", or "our") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, and protect your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. By using our services or website, you acknowledge and agree to this policy. Information We Collect We may collect and process the following categories of personal data: 2.1 Personal Information Full name Email address Telephone number Address (where required) 2.2 Health Information (Special Category Data) We may collect health-related information where necessary to provide safe and appropriate wellbeing services, including medical history, conditions, injuries, medications, and relevant lifestyle information. This data is collected only with your explicit consent. 2.3 Booking and Payment Information Appointment details and booking history Membership and purchase details Payment status information (such as whether a transaction was successful or failed) All payments are processed securely via Stripe. Payment details are submitted directly to Stripe and are not stored, processed, or accessible within our website systems. 2.4 Website Usage Data IP address Browser type and device information Pages visited and usage behaviour Cookie and tracking data How We Collect Your Data We collect personal data directly from you, through our website, and via secure third-party platforms used in connection with our services. How We Use Your Data We use personal data to provide services, manage bookings and payments, communicate with you, send marketing where permitted, improve our services, and comply with legal, regulatory, and insurance obligations. Legal Basis for Processing We rely on the following lawful bases under the UK GDPR: Contractual necessity to provide services Legitimate interests to operate and improve our business Legal obligation to comply with applicable laws Explicit consent for health data and marketing communications Storage and Security We implement appropriate technical and organisational measures to protect personal data, including secure systems, trusted third-party platforms, access controls, and encrypted payment processing. Personal data is retained only as long as necessary for business, legal, and insurance purposes. Third-Party Platforms and Health Data Health and medical information may be collected and stored using secure third-party platforms, including Google Docs. Where this applies, information is submitted directly to and processed within those platforms and is not stored on or processed through this website’s hosting infrastructure. We do not store or retain copies of this data within our website systems. BRT Wellbeing acts as the data controller for this information and is responsible for ensuring compliance with applicable data protection laws, including UK GDPR. Third-party providers operate under their own privacy policies and security practices. Sharing Your Data We do not sell personal data. We may share data with trusted third-party providers where necessary to operate our services, including payment providers such as Stripe. We may also share data with professional advisers or legal and regulatory authorities where required by law. All third parties are required to process data securely and in accordance with applicable data protection laws. Marketing Communications We may send communications about services, offers, and updates where you have consented or where permitted for existing clients. You may unsubscribe at any time. Cookies Our website may use cookies to improve user experience, analyse performance, and support marketing. You can control cookies through your browser settings. Your Rights You have the right to access, correct, delete, or restrict your personal data, object to processing, withdraw consent, and lodge a complaint with the Information Commissioner’s Office at https://ico.org.uk Data Retention Health records may be retained for up to 7 years for legal and insurance purposes. Booking and financial records are retained as required for accounting and tax obligations. Third-Party Links We are not responsible for the privacy practices of third-party websites linked from our site. Children’s Data We do not knowingly collect personal data from individuals under 18 without parental or guardian consent. Changes to This Policy We may update this policy at any time. Updates will be published on our website and continued use of our services constitutes acceptance. Contact BRT Wellbeing Email: [email protected] Website: www.brtwellbeing.co.uk