Skip to content
WhatsApp us

Privacy Policy

Last updated 3 September 2026.

1. Who we are

Knead Massage Ltd ("Knead", "we") is the data controller for the personal information described in this policy. We are registered in England and Wales, company number 16438324, with our registered office at 1 Frodesley House Farm Barns, Dorrington, Shrewsbury SY5 7HD. Email: john@kneadmassage.co.uk.

This policy covers our website (kneadmassage.co.uk), our booking site (book.kneadmassage.co.uk) and the emails and messages we send. It applies to clients, visitors to our website, people who join our email lists, and therapists who apply to work with us.

2. What we collect

When you book:

  • Account details: your name, email address, phone number and a password. The password is stored by our booking provider and we never see it. If you sign in with Facebook, we receive your name and email address from Facebook.
  • Booking details: the treatment, therapist, date, time and location you choose, and your address if you book a home visit.
  • Health information: your answers to the questions we ask when you book (an emergency contact, which is optional, your massage preferences and health screening questions), and anything you tell us or your therapist about your health, injuries or preferences. Health information is "special category" data under UK data protection law and we treat it with extra care (section 3).
  • Payment details: payments are taken by Stripe and SBPay.me. We receive confirmation that you have paid, the amount and a payment reference. We never see or store your full card number.
  • Gift cards and batches of sessions: purchases, balances and redemptions, and the name and email address of a gift card recipient where you give them.
  • Correspondence: emails, WhatsApp messages and feedback you send us, and notes about any complaint.

When you use our website: see section 8 (cookies) and section 9 (email lists).

If you apply to work with us: the details you send us, including your CV, qualifications, insurance and DBS evidence, and our interview notes.

3. Why we use it, and our legal basis

  • Taking and managing your booking, sending your confirmation and a reminder, taking payment, and checking in with you the day after your appointment: performance of our contract with you, and our legitimate interest in making sure the treatment went well.
  • Passing your booking details, and any health information you give, to your therapist so they can prepare for and deliver a safe treatment: performance of the contract and, for health information, your explicit consent (below).
  • Keeping accounting and tax records of bookings and payments: legal obligation.
  • Running and improving the business: reporting on bookings by area, preventing misuse, and handling complaints and legal claims: our legitimate interest in running a safe, viable service, balanced against your interests.
  • Emailing you tips and offers, or launch news for your area: your consent, which you can withdraw at any time.
  • Measuring use of our website with Google Analytics: your consent, given through the cookie notice.
  • Assessing a therapist's application and, if successful, working together: steps taken at your request before a contract, then the contract.

Health information. We collect it only with your explicit consent, which you give when you answer the health questions at booking. If you would rather not answer online, you can discuss your health directly with your therapist before the session. Either way, your therapist needs enough information to treat you safely and may decline to treat you without it. Health information is used only for your safety and to tailor your treatment. It is never used for marketing.

4. Who we share it with

  • Your therapist. Therapists are self-employed. Your therapist receives your name, contact details, booking details, your address for a home visit, and any health information you give. They may keep their own treatment notes, as their professional body and insurer require; for those notes they are a data controller in their own right. We require every therapist to keep your information confidential and to use it only for your treatment.
  • Our service providers, who process data on our behalf under contracts that protect it:
    • SimplyBook.me Ltd (Cyprus): runs our booking system, client accounts, gift cards and batch purchases, and sends booking emails.
    • Stripe and SBPay.me: take payments.
    • Google Workspace: our email, and the records we keep of bookings and payments. Google Analytics, only if you allow analytics cookies.
    • Cloudflare: hosts our website and the datastore behind our email forms.
    • Resend: sends our own emails (tips, waitlist and download emails).
    • Zapier and GitHub: automation that copies booking records from the booking system into our own records.
    • WhatsApp: if your number is on WhatsApp, our check-in message the day after your appointment is sent through WhatsApp, which is run by Meta under its own privacy policy.
  • Trustpilot, if you choose to leave a review there. Trustpilot's own privacy policy applies to what you post.
  • StorePoint and Google Maps, which provide the therapist map on our website and see standard web-traffic data when the map loads.
  • Professional advisers, insurers and authorities, where necessary to deal with a complaint, a claim or a legal duty.

We never sell your information, and we never share it with anyone for their own marketing.

5. Where your information is stored

Most of our providers are based in the UK or the EU. Some (Stripe, Google, Cloudflare, Zapier, GitHub and Meta) may process data in the United States or elsewhere. When personal data leaves the UK we rely on the UK's adequacy regulations for the EU and, for the United States, on the UK Extension to the EU-US Data Privacy Framework or the ICO's International Data Transfer Addendum, so that your data keeps equivalent protection.

6. How long we keep it

  • Your account, booking history and any health answers: while your account is active and for six years after your last booking, the period in which a legal claim could still be brought and for which we must keep financial records. You can ask us to delete your account sooner; we will, unless we need the record for a legal reason, in which case we keep only what is required.
  • Payment and accounting records: six years after the end of the financial year they relate to.
  • Correspondence and complaints: up to six years, in line with the booking they relate to.
  • Email lists: waitlist records until we have launched in your area and sent the promised email, and no longer than six months after that; download-only records up to 24 months; tips subscribers until you unsubscribe (we keep a record of unsubscribes so that we never email you again by mistake); email engagement records (deliveries, opens and clicks) up to 24 months.
  • Therapist applications: six months for unsuccessful applications; for successful ones, the length of our working relationship and six years after it ends.

7. Your rights

You have the right to ask for a copy of your information, to have it corrected or deleted, to restrict or object to how we use it, to receive it in a portable format, and to withdraw consent at any time (which does not affect what was done before you withdrew it). Email john@kneadmassage.co.uk and we will respond within one month.

If you think we have handled your information wrongly, please complain to us first: email john@kneadmassage.co.uk with "Data complaint" in the subject line. We will acknowledge your complaint within 30 days, look into it, and tell you the outcome. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

We do not make decisions about you by automated means, and we do not profile you.

8. Cookies and analytics

We keep this site as close to cookie-free as we can:

  • Strictly necessary: your own cookie choice is stored in your browser so that we do not keep asking, and our booking system (SimplyBook) sets the cookies it needs to take your booking on booking pages.
  • Optional analytics: Google Analytics runs only if you choose "Allow" on the small cookie notice, and helps us see which pages are useful. If you choose "No thanks", it never loads. You can change your choice at any time by visiting this link, which shows the notice again.
  • Embedded services: the therapist map is provided by StorePoint and Google Maps, and images are served from content delivery networks; these load as part of showing you the page you asked for.

9. Free downloads, launch waitlist and tips emails

Our blog offers free downloadable guides, a waitlist for areas we do not yet cover, and optional occasional tips emails. When you use these forms we collect your email address, the download you requested or the postcode you gave us, whether you ticked the optional tips box, and the date. The legal basis for this is your consent, and we keep a record of the exact wording you agreed to at the time.

What you receive depends on what you asked for:

  • A download: one email containing your requested guide, and nothing else, unless you also ticked the tips box.
  • The waitlist: one email when we launch near your postcode area, and nothing else, unless you also ticked the tips box.
  • Emails from our founder: if you tick the opt-in box, a short email roughly every two to four weeks with practical advice on massage, movement and soft tissue health, plus occasional offers. Every one contains a one-click unsubscribe link, and unsubscribing takes effect immediately.

These emails are sent through Resend (processed in the EU, Ireland region) and the records are stored in our own datastore hosted by Cloudflare; both act as processors on our behalf. Our emails include an open-tracking image and tracked links so that we can see whether what we send is actually useful. If you prefer not to be measured in this way, most email apps let you block remote images, and the emails work fine without them.

10. Children

Our services are for adults. We do not knowingly collect information from anyone under 18, and if we learn that we have, we delete it.

11. Security

We use established providers, encrypt data in transit, limit access to your information to the people who need it, and protect our accounts with strong passwords and two-factor authentication. If a security incident affects your information, we will tell you promptly and explain what we are doing about it, and we will notify the ICO where the law requires.

12. Changes to this policy

We post any changes here, with the date at the top. If a change materially affects how we use your information, we will email account holders.

13. Contact

Email john@kneadmassage.co.uk, or write to Knead Massage Ltd at the registered office above.