Privacy Policy

Date last updated: 17 June 2026

Contact Details

Name: Rachel Clasper, trading as Cotherstone House
Address: 13 Cotherstone Road, London, SW2 3NE
Phone: 07568 145741
Email: cotherstonehouse@gmail.com

The Type of Personal Information I Collect

To give professional reflexology treatments, and to make sure sauna use is safe for you, I will need to ask for and keep information about your health. I will only use this for informing reflexology treatments, sauna use, and any advice I give because of either. The information held is:

• Your contact details
• Medical history and other health-related information, including any health screening or contraindication questions
• Treatment details and related notes, including details of any sessions booked

How I Get the Personal Information and Why I Hold It

Most of the personal information I process is provided to me directly by you, for informing reflexology treatments, sauna use, and any advice I give because of either.

If you book a reflexology appointment, this is normally done through my online booking platform (see Third-Party Booking Platform below). If you book a sauna-only session, or wish to add a sauna session to a reflexology booking, this is normally arranged directly with me by email or phone, and I will ask you some health and contraindication questions before your sauna session to make sure it is safe for you to use.

I use the information that you have given me to:

• Provide you with the best possible treatment options, support and advice for reflexology and sauna use. I may share this information with the Association of Reflexologists, my professional body, if required for insurance or regulatory purposes, and with the Information Commissioner's Office, if legally required. If I have a genuine concern for your safety or wellbeing, for example, a medical emergency such as fainting during or after a sauna session, or a safeguarding concern, I may share relevant information with emergency services or another appropriate professional without your consent, where I believe this is necessary to protect your life, health or safety, or that of someone else.

Lawful Basis for Holding and Using Client Information

Under the UK General Data Protection Regulation (UK GDPR), the lawful basis I rely on for processing this information is:

1. Your consent: for sauna use specifically, I rely on your consent to ask and record health and contraindication screening questions, which you give when you sign my sauna waiver. You can withdraw this consent at any time by contacting cotherstonehouse@gmail.com, although please note that I may still be required to retain existing records for the period set out below.
2. I have a legal obligation: 'claims occurring' insurance requires records to be kept for 7 years after your last reflexology treatment or sauna session.
3. I have a legitimate interest, namely my requirement to retain the information to provide you with the best possible treatment options and advice, and to make sure sauna use and/or a reflexology treatment is safe for you based on the health information you have given me.
4. Vital interests and recognised legitimate interests: in a genuine emergency, such as a medical incident during or after a sauna session, or where I have a safeguarding concern about your welfare, I may rely on the need to protect your life or health, or the new 'Recognised Legitimate Interests' basis introduced by the Data (Use and Access) Act 2025, to share relevant information with emergency services or another appropriate professional.

As I hold special category data (i.e. health-related information), the additional condition I rely on depends on the service. For reflexology, I am treated as a Healthcare Professional for these purposes, in line with an agreement between the Association of Reflexologists and the Information Commissioner's Office, and I am bound by confidentiality requirements under the AoR Code of Practice and Ethics. For sauna use, I rely on your explicit consent, given when you sign my sauna waiver, to ask and hold health and contraindication screening information so I can assess whether sauna use is safe for you.

Third-Party Booking Platform

I use a third-party online booking platform, Cal.com (cal.eu), to manage reflexology appointment scheduling. When you book a reflexology appointment through this platform, it collects and processes your name, email address and appointment details on my behalf. It does not collect any health or medical information: that information is collected separately by me, directly, as set out above.

Cal.com acts as a data processor for this limited booking information. You can view their privacy policy at https://cal.com/privacy for further details on how they handle this data. Sauna-only bookings, and any sauna sessions added to a reflexology booking, are arranged directly with me by email or phone.

Protecting Your Personal Data

How I store your personal information

I am committed to ensuring that your personal data is secure. To prevent unauthorised access or disclosure, I have put in place appropriate technical, physical and managerial procedures to safeguard and secure the information I collect from you. I will contact you using the contact preferences you have given me.

I keep records of your health information and treatment for 7 years, in line with the requirements of my professional indemnity insurance and the guidance of the Association of Reflexologists, after which they are securely deleted. For reflexology, this includes the session notes I make recording the health information you have told me and the treatment given. For sauna, this includes your signed Health Declaration form. I may keep basic contact and booking information for longer for accounting purposes, in line with HMRC requirements.

Data breach notification

I have procedures in place to identify, investigate and respond to any suspected personal data breach. If a breach occurs that is likely to result in a risk to your rights and freedoms, I will notify the Information Commissioner's Office within the required timeframe, and I will notify you directly if the breach is likely to result in a high risk to you.

Your Data Protection Rights

Under data protection law, you have rights including:

• Your right of access: You have the right to ask me for copies of your personal information.
• Your right to rectification: You have the right to ask me to rectify personal information you think is inaccurate, or to complete information you think is incomplete.
• Your right to erasure: You have the right to ask me to erase your personal information in certain circumstances.
• Your right to restriction of processing: You have the right to ask me to restrict the processing of your personal information in certain circumstances.
• Your right to object to processing: You have the right to object to the processing of your personal information in certain circumstances.
• Your right to data portability: You have the right to ask that I transfer the personal information you gave me to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, I have one month to respond to you.

Please contact me at cotherstonehouse@gmail.com if you wish to make a request.

Therapist's Rights

• If you don't agree to me keeping records of information about you and your treatments, or if you don't allow me to use the information in the way I need to for treatments, I may not be able to treat you.
• I must keep your records of treatment for a certain period as described above, which may mean that even if you ask me to erase any details about you, I might have to keep these details until after that period has passed.
• I can move my records between my computers and IT systems without your permission, provided your details remain protected from being seen by others.

How to Complain

If you have any concerns about my use of your personal information, please refer to my GDPR Complaints Procedure, available at www.cotherstonehouse.co.uk/gdpr-complaints-procedure or on request by email.

Changes to This Policy

I may update this privacy policy from time to time. Any changes will be posted on this page with an updated date at the top.

---

Cotherstone House  •  Brixton, London SW2  •  www.cotherstonehouse.co.uk
cotherstonehouse@gmail.com  •  07568 145741