Privacy Policy

Last updated: 6 August 2026

1. About this policy

Equilibrium respects your privacy and is committed to handling personal information lawfully, fairly, transparently and securely.

This Privacy Policy explains how we collect, use, store and share personal information when you:

• visit our website;
• contact us;
• make or manage a booking;
• create a booking-platform account;
• complete a health and safety waiver or consultation form;
• use Sauna & Ice, red light therapy, massage, consultations, wellness programmes or related services;
• purchase a membership, package, gift card or retail product;
• use a blood-testing or partner service;
• subscribe to our communications;
• attend an event or corporate activation;
• apply to work or collaborate with us; or
• otherwise interact with Equilibrium.

It also explains your data-protection rights.

2. Who is responsible for your information?

For the purposes of UK data-protection law, the principal controller is:

Equilibrium Wellness Limited, trading as Equilibrium

Company number: 14826613
Registered office: Inns Keep, Church Road, Milton-under-Wychwood, Chipping Norton, Oxfordshire, OX7 6LF
Trading address: Unit 25, Groves Yard, Shipton Road, Milton-under-Wychwood, Chipping Norton, Oxfordshire, OX7 6JP
Email: [email protected]

We have not appointed a statutory Data Protection Officer. Privacy enquiries are handled by our data-protection contact using the email address above.

Some organisations involved in providing our services, including Fresha, Vitall, payment providers, laboratories and certain practitioners, may also act as independent controllers for particular processing activities. Their own privacy policies will apply to the information they control.

3. Personal information we collect

The information collected depends on how you interact with us.

3.1 Identity and contact information

This may include:

• name;
• postal address;
• email address;
• telephone number;
• date of birth or age;
• emergency-contact details; and
• parent or guardian details where relevant.

3.2 Booking, membership and service information

This may include:

• services booked or purchased;
• appointment dates and attendance;
• booking changes, cancellations and no-shows;
• memberships, packages, credits and gift cards;
• preferences and service history;
• practitioner or staff member involved;
• booking notes;
• correspondence relating to your booking; and
• records showing that required forms or waivers have been completed.

3.3 Health and consultation information

Some Equilibrium services require us to collect information concerning your physical or mental health.

This may include:

• relevant medical conditions;
• symptoms or injuries;
• pregnancy status;
• allergies or sensitivities;
• medication information;
• blood pressure or cardiovascular considerations;
• previous reactions to heat, cold, light or massage;
• contraindications;
• mobility or accessibility requirements;
• wellbeing goals;
• consultation responses;
• treatment notes;
• suitability decisions;
• consent and waiver records; and
• information you choose to provide about changes to your health.

Health information is special-category personal data and receives additional legal protection.

We will only request health information that we reasonably consider relevant to safety, suitability, service delivery, professional standards, insurance or your stated wellbeing objectives.

3.4 Blood-testing and partner-service information

Where you use a blood-testing or diagnostic service provided through Vitall or another partner, information may include:

• test ordered;
• registration or activation information;
• sample status;
• appointment or fulfilment information;
• results or reports;
• consultation notes relating to the results; and
• communications with the testing provider or laboratory.

Vitall and participating laboratories may collect and control information directly.

The information made available to Equilibrium will depend on the service selected, the relevant provider arrangements and permissions you have given. We will not use test results for unrelated marketing or advertising.

3.5 Payment and transaction information

This may include:

• transaction amount;
• date and method of payment;
• payment status;
• refunds or credits;
• partial card details or payment token;
• receipts and invoices;
• billing address; and
• records required for accounting and fraud prevention.

Full payment-card details are normally processed by our payment or booking provider rather than stored directly by Equilibrium.

3.6 Website and technical information

This may include:

• IP address;
• browser and device information;
• approximate location;
• website activity and navigation;
• referring website or campaign;
• cookie identifiers;
• consent preferences;
• page interactions; and
• security or error logs.

Further information is available in our Cookie Policy.

3.7 Communications and marketing information

This may include:

• enquiries and correspondence;
• communication preferences;
• newsletter subscriptions;
• event or promotional registrations;
• email engagement information;
• responses to surveys;
• feedback, complaints and reviews; and
• records of your marketing consent or objection.

3.8 Images and premises information

Where appropriate, we may collect:

• CCTV images for security and incident management;
• photographs or videos from events;
• testimonials; and
• images you submit or agree may be used.

We will seek appropriate permission before using an identifiable customer image, video or testimonial for promotional purposes.

3.9 Corporate and professional information

Where you contact us in a business or professional capacity, we may collect:

• job title;
• organisation;
• business contact details;
• areas of responsibility;
• event or partnership requirements;
• proposal and contract information; and
• records of our professional relationship.

3.10 Recruitment and practitioner information

Where you apply to work, contract, practise or collaborate with us, we may collect:

• employment and professional history;
• qualifications and accreditations;
• insurance information;
• references;
• identity and right-to-work information; and
• other information relevant to assessing the relationship.

4. How we collect information

We may collect personal information:

Directly from you

For example, when you:

• contact us;
• book or purchase a service;
• complete a waiver or consultation form;
• attend an appointment;
• create an account;
• make a payment;
• subscribe to marketing;
• provide feedback; or
• communicate with staff or practitioners.

Through service providers and partners

This may include information received through:

• Fresha or another booking platform;
• Vitall and participating laboratories;
• payment providers such as SumUp;
• practitioners providing services at or for Equilibrium;
• event, corporate or referral partners; and
• website, communications and analytics providers.

Automatically

Technical and usage information may be collected when you interact with our website, emails, online booking tools or connected services.

From publicly available or professional sources

For business development, recruitment or partnership activity, we may obtain professional contact information from:

• company websites;
• professional networks;
• business directories;
• event information; and
• publicly available social-media profiles.

5. Why we use your information and our lawful bases

We only use personal information where we have a lawful basis.

5.1 Providing bookings, products and services

We use information to:

• process enquiries and bookings;
• create and manage customer accounts;
• deliver appointments, memberships and packages;
• take payment;
• administer cancellations, credits and refunds;
• communicate service information; and
• provide customer support.

Our lawful basis is generally that processing is necessary to enter into or perform a contract with you.

5.2 Assessing safety and suitability

We use relevant health information to:

• identify potential contraindications;
• assess whether a service appears suitable;
• adapt an experience where reasonably possible;
• support safe service delivery;
• record consent and safety information; and
• respond to an incident or emergency.

Our Article 6 lawful basis will generally be performance of our contract with you, compliance with a legal obligation, our legitimate interests in providing safe services, or protection of vital interests in an emergency.

Where health information is special-category data, our additional Article 9 condition will generally be your explicit consent. In limited circumstances, another condition may apply, such as protecting vital interests where a person is physically or legally unable to provide consent, or establishing, exercising or defending legal claims.

You may withdraw explicit consent, but this may mean that we cannot safely or lawfully provide a service that objectively requires the information.

5.3 Consultations and wellness programmes

We use consultation information to:

• understand your stated goals;
• provide the requested consultation or programme;
• record recommendations;
• coordinate relevant services; and
• review progress where this forms part of the service.

Our lawful basis will generally be performance of a contract. Where health information is involved, we will ordinarily rely on explicit consent as the additional special-category condition.

Equilibrium services are not a replacement for diagnosis, medical treatment or advice from a qualified healthcare professional.

5.4 Blood-testing services

We may use information to:

• facilitate access to a selected test;
• coordinate fulfilment or consultation activity;
• help you understand the service pathway;
• deliver an associated consultation you have requested; and
• manage payments and customer support.

Our lawful basis will generally be performance of a contract.

Where we receive or use health results, we will normally rely on explicit consent as the additional special-category condition.

Vitall, laboratories and clinical professionals may have their own lawful bases and professional obligations.

5.5 Payments, accounting and legal compliance

We use transaction and customer information to:

• process payments;
• maintain financial records;
• manage tax and accounting;
• prevent fraud;
• respond to chargebacks;
• comply with legal and regulatory requirements; and
• establish, exercise or defend legal claims.

Our lawful bases are performance of a contract, compliance with legal obligations and our legitimate interests in managing and protecting the business.

5.6 Service communications

We may send communications concerning:

• booking confirmations and reminders;
• changes or cancellations;
• forms and safety instructions;
• membership administration;
• payment or account issues;
• service updates; and
• information necessary to fulfil your booking.

These are service communications rather than marketing. Our lawful basis is generally performance of a contract or our legitimate interests in administering the service.

5.7 Marketing

With appropriate permission, or where otherwise permitted by law, we may send information about:

• services and memberships;
• events and collaborations;
• packages and promotions;
• retail products;
• educational or wellbeing content; and
• Equilibrium news.

Our lawful basis will generally be consent or, where permitted, our legitimate interests in promoting similar services to existing customers.

You can unsubscribe at any time through the link in an email or by contacting us.

We will not use health information or blood-test results to target advertising.

5.8 Website operation and improvement

We use technical and usage information to:

• operate and secure the website;
• diagnose problems;
• understand how people use the website;
• improve content and navigation;
• measure campaigns; and
• prevent misuse or fraud.

Our lawful basis is our legitimate interests in maintaining and improving our digital services. Where cookies or similar technologies require consent, we will rely on your consent.

5.9 Security, CCTV and incident management

We may use information to:

• protect customers, staff, practitioners, visitors and property;
• deter or investigate theft, fraud or misconduct;
• manage accidents and incidents;
• support insurance matters; and
• respond to lawful requests from authorities.

Our lawful bases are legitimate interests, compliance with legal obligations and, where relevant, protection of vital interests or legal claims.

5.10 Business and corporate relationships

We may process professional information to:

• respond to corporate enquiries;
• prepare proposals;
• manage events and activations;
• develop partnerships;
• maintain professional relationships; and
• communicate relevant B2B services.

Our lawful bases are steps taken before entering a contract, performance of a contract and our legitimate interests in developing and operating our business.

5.11 Recruitment and practitioner management

We use applicant and practitioner information to assess suitability, establish working relationships, verify qualifications, manage services and comply with legal obligations.

Our lawful bases may include steps taken before a contract, performance of a contract, legal obligations and legitimate interests.

6. Our legitimate interests

Where we rely on legitimate interests, these may include:

• delivering efficient customer service;
• protecting customer and staff safety;
• securing our premises, website and systems;
• preventing fraud and misuse;
• improving our services;
• maintaining accurate records;
• managing complaints and legal claims;
• developing appropriate customer and business relationships; and
• promoting relevant services in a proportionate way.

We consider whether these interests are necessary and balanced against your rights and reasonable expectations.

7. Sharing personal information

We may share information where necessary with:

Booking and customer-management providers

We use Fresha or another nominated platform to support bookings, customer records, payments, memberships, communications and consultation forms.

For information processed on Equilibrium’s instructions, the platform may act as our processor. It may also act as an independent controller for aspects of its marketplace, user account, payment or platform services.

Testing and laboratory partners

Vitall, laboratories, sample-collection providers and relevant professionals may receive information needed to provide a test or associated service.

These organisations may act as independent controllers and will provide their own privacy information.

Payment providers

Payment information may be shared with SumUp, Fresha Payments, card networks, banks or other payment providers needed to authorise and administer a transaction.

Practitioners and staff

Relevant information may be made available to:

• massage therapists;
• consultants;
• session facilitators;
• customer-service staff;
• contractors; and
• other practitioners involved in providing your requested service.

Access will be limited to information reasonably needed for their role.

Some independent practitioners may also have separate professional record-keeping obligations and act as controllers for those records.

Technology and operational providers

We may use providers for:

• website hosting and development;
• secure data storage;
• email and office systems;
• communications;
• booking and customer management;
• analytics;
• marketing;
• IT support;
• cybersecurity; and
• document or form management.

These providers are only permitted to use information for agreed purposes and must apply appropriate safeguards.

Professional advisers and insurers

Information may be shared with accountants, solicitors, insurers, brokers and other professional advisers where reasonably necessary.

Authorities and legal recipients

We may disclose information where required or permitted by law, including to:

• courts;
• regulators;
• law-enforcement bodies;
• tax authorities;
• emergency services; and
• other competent authorities.

Business transfers

If Equilibrium is involved in a restructuring, investment, merger, acquisition or sale, relevant information may be shared with professional advisers and prospective or actual parties, subject to appropriate confidentiality and data-protection measures.

We do not sell personal information to advertisers or data brokers.

8. International data transfers

Some technology, booking, communications or support providers may process information outside the United Kingdom.

Where personal information is transferred internationally, we will take appropriate steps to protect it. Depending on the destination and provider, these may include:

• UK adequacy regulations;
• the UK International Data Transfer Agreement;
• an approved UK Addendum to standard contractual clauses; or
• another lawful transfer mechanism.

You may contact us for further information about safeguards relevant to your information.

9. How long we retain information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, tax, accounting, insurance and professional requirements.

Our usual retention periods are:

• General enquiries: normally up to two years after the enquiry is resolved.
• Booking, membership and customer-service records: normally up to six years after the end of the customer relationship or relevant transaction.
• Financial and transaction records: normally six years after the end of the relevant financial year, or longer where required by law.
• Health waivers, consultation records and treatment notes: generally up to seven years after the last relevant service, subject to professional, insurer and legal requirements.
• Records relating to a person under 18: these may be retained for a longer period where necessary to protect the individual and address legal or insurance requirements.
• Accident, incident, complaint and legal-claim records: for the applicable limitation period and for as long as a claim or investigation remains possible or active.
• Marketing records: until you unsubscribe, withdraw consent or we determine that the information is no longer current. We may retain a minimal suppression record to ensure that your preference continues to be respected.
• Unsuccessful recruitment records: normally up to six months after the process ends, unless a longer period has been agreed.
• CCTV: normally up to 30 days, unless footage is required for an incident, investigation, insurance matter or legal claim.
• Cookie and analytics information: for the period stated in our Cookie Settings tool.

We may anonymise information so that it can no longer identify you. Anonymised information may be retained for research, analysis and business planning.

10. Information security

We use appropriate organisational and technical measures designed to protect personal information against:

• unauthorised access;
• accidental loss;
• misuse;
• alteration;
• disclosure; and
• destruction.

Measures may include:

• access controls;
• password protection;
• secure hosted systems;
• staff and contractor confidentiality;
• limited access to health information;
• supplier due diligence;
• device and account security; and
• procedures for managing suspected data incidents.

No digital system can be guaranteed completely secure. If we become aware of a personal-data breach, we will assess it and notify affected individuals and the Information Commissioner’s Office where legally required.

11. Your responsibilities

Please help us maintain accurate and secure records by:

• providing complete and current information;
• informing us when relevant information changes;
• protecting your account credentials;
• using designated secure forms for health information; and
• avoiding unnecessary sensitive information in ordinary email or social-media messages.

If you provide information about another person, you must have the authority or lawful basis to do so.

12. Children and young people

Our website is not designed to invite children to provide personal information independently.

Where a service is available to someone under 18, we may require:

• involvement or consent from a parent or guardian;
• additional safety information;
• age verification; and
• specific booking or supervision arrangements.

Parents and guardians should avoid providing more information about a child than is reasonably necessary for the service and its safe delivery.

13. Automated decision-making

We do not currently make decisions about customers using solely automated processing that produces legal or similarly significant effects.

We may use automated tools for routine functions such as reminders, booking availability, fraud indicators or marketing segmentation, but material service and safety decisions will involve appropriate human oversight.

14. Your data-protection rights

Depending on the circumstances, you may have the right to:

• be informed about how your information is used;
• request access to the personal information we hold about you;
• ask us to correct inaccurate or incomplete information;
• request deletion of information;
• request restriction of processing;
• object to processing based on legitimate interests;
• object to direct marketing at any time;
• request transfer of information in a portable format;
• withdraw consent where processing relies on consent; and
• raise concerns about automated decision-making.

These rights are not absolute. For example, we may need to retain information to comply with law, establish or defend a legal claim, maintain financial records or protect another person’s rights.

We may ask for information to verify your identity before responding to a request.

We will normally respond within one month, although the period may be extended where permitted for a complex request.

15. Withdrawing consent

Where we rely on your consent, you can withdraw it at any time.

You can:

• unsubscribe using the link in a marketing email;
• change cookie choices through Cookie Settings; or
• contact [email protected].

Withdrawal does not affect processing that took place before consent was withdrawn.

Withdrawing consent to necessary health-data processing may mean that we cannot continue with a particular service where we cannot safely provide it without that information.

16. Complaints

Please contact us first so that we have the opportunity to investigate and resolve your concern.

You also have the right to complain to the UK Information Commissioner’s Office.

Information about making a complaint is available through the ICO’s official website.

17. Third-party websites

Our website may link to Fresha, Vitall, payment providers, social-media platforms, partners and other websites.

These organisations operate their own services and privacy practices. We recommend reviewing their privacy information before providing personal information.

Equilibrium is not responsible for the content or privacy practices of websites that we do not control.

18. Changes to this policy

We may update this Privacy Policy to reflect changes in:

• our services;
• booking or technology providers;
• data-processing activities;
• legal or regulatory requirements; or
• our organisational structure.

The latest version will be published on this page with the revision date updated.

Where a change materially affects how we use existing information, we will take reasonable steps to bring it to your attention.

19. Contact us

To ask a question, exercise a data-protection right or raise a privacy concern, contact:

Equilibrium Wellness Limited
Unit 25, Groves Yard
Shipton Road
Milton-under-Wychwood
Chipping Norton
Oxfordshire
OX7 6JP

Email: [email protected]