Privacy Policy

Last updated: 28 August 2026

1. Who we are

Co Pilates is a home-based Pilates business providing one-to-one Classical Reformer Pilates sessions in Enfield.

For the purposes of UK data protection law, Co Pilates is the controller of the personal information described in this policy.

Business/contact name: Co Pilates / Kelly Ruddy
Address: 7 Ridge Crest, Enfield, EN2 8JU
Email: hello@copilates.co.uk
Telephone: 07903 723394
ICO registration number: [Insert if registered]

References in this policy to “Co Pilates”, “we”, “us” or “our” mean the person or business responsible for operating Co Pilates.

2. The information we collect

Depending on how you contact us and the services you use, we may collect:

• Your name, email address, telephone number and address.
• Enquiry, appointment and booking information.
• Records of correspondence by email, telephone, text message, WhatsApp or social media.
• Payment, transaction and invoice information.
• Emergency-contact details.
• Information about your Pilates experience, fitness level and personal goals.
• Health, injury, mobility, pregnancy, medication or accessibility information that you voluntarily provide.
• Consent, health-screening, waiver and attendance records.
• Reviews, testimonials, photographs or videos where permission has been provided.
• Marketing preferences.
• Technical information including your IP address, browser, device, website activity and cookie preferences.

We ask that you do not provide more personal or medical information than is reasonably necessary.

3. Health information

Information about your physical or mental health is “special category data” and receives additional legal protection.

We may need limited health information to:

• Decide whether a Pilates session is suitable for you.
• Adapt exercises safely.
• Understand injuries, mobility restrictions or relevant medical conditions.
• Respond appropriately during an emergency.
• Meet insurance, safeguarding or legal requirements.

We normally process this information with your explicit consent. In limited circumstances, information may also be processed where necessary to protect someone’s vital interests or to establish, exercise or defend legal claims.

Pilates instruction is not a substitute for medical diagnosis, advice or treatment. We may recommend that you seek advice from an appropriate healthcare professional before participating.

You may withdraw your consent to optional processing at any time. However, if relevant health information is required to provide sessions safely, we may be unable to continue providing the service.

4. How we collect information

We collect personal information:

• Directly from you when you enquire, book or attend a session.
• When you contact us by email, telephone, WhatsApp or social media.
• When you complete a health questionnaire, waiver or consent form.
• When you make a payment.
• When you visit our website or accept optional cookies.
• From another person where they book or enquire on your behalf.
• From a healthcare professional where you have authorised the disclosure.
• From publicly available sources where appropriate and lawful.

If you provide information about another person, you must have their permission to do so.

5. How and why we use your information

We may use personal information to:

• Respond to enquiries.
• Arrange, manage and deliver Pilates sessions.
• Assess suitability and adapt sessions.
• Send booking confirmations, reminders and service messages.
• Process payments and maintain financial records.
• Manage cancellations, complaints and disputes.
• Keep appropriate health, safety, consent and attendance records.
• Contact an emergency contact where necessary.
• Maintain and secure our website and business systems.
• Improve our services and understand how the website is used.
• Request or publish testimonials with permission.
• Send marketing communications where permitted.
• Comply with legal, regulatory, insurance and safeguarding obligations.
• Establish, exercise or defend legal claims.

6. Our lawful bases

Under UK data protection law, we rely on one or more of the following lawful bases:

Contract: Where processing is necessary to respond to a request before you book or to provide and manage the service you have purchased.

Legal obligation: Where we must maintain tax, accounting, insurance, safeguarding or other legally required records.

Legitimate interests: Where necessary for the reasonable operation of the business, including administration, service improvement, security, fraud prevention and the defence of legal claims. We consider the effect on your rights before relying on this basis.

Consent: Where you have made a clear choice, including for certain marketing, testimonials, photographs, optional cookies or health information.

Vital interests: In an emergency where processing is necessary to protect someone’s life and consent cannot reasonably be obtained.

Where we rely on consent, you can withdraw it at any time without affecting processing that took place before withdrawal.

7. Bookings, payments and communications

Bookings may be arranged by telephone, email, WhatsApp, social media or another booking service used by Co Pilates.

Payments may be processed by a bank or payment provider. We do not normally receive or store complete payment-card details when a third-party payment provider processes the transaction.

Communications sent through WhatsApp, Instagram, Facebook or another platform are also processed by the operator of that platform under its own privacy terms. Avoid sending sensitive health information through social media unless necessary.

Current booking and payment providers: [Insert the names of any booking, card-payment or accounting services used.]

8. Marketing

We may send information about Co Pilates sessions, availability, offers or related services where:

• You have consented; or
• The law permits us to contact an existing customer about similar services and you were given an opportunity to opt out.

You can unsubscribe at any time by using an unsubscribe option or contacting hello@copilates.co.uk.

We will not sell your information to other organisations for marketing.

9. Testimonials, photographs and social media

We will obtain permission before publishing an identifiable testimonial, photograph or video for promotional purposes.

You may withdraw permission for future use by contacting us. This may not always allow us to remove material already printed or legitimately shared by third parties, but we will take reasonable steps regarding content under our control.

Comments or messages posted publicly on social media may be visible to other users.

10. Cookies and website information

Our website may use cookies and similar technologies to:

• Operate essential website functions.
• Remember settings and preferences.
• Protect the website from misuse.
• Measure website performance and visitor numbers.
• Display embedded or third-party content.
• Support advertising or social-media features, if enabled.

Some essential and qualifying low-risk technologies may be used without consent where the law permits. Where an exemption applies to statistical or functionality technologies, we will provide clear information and a simple way to object where required.

Non-essential advertising, profiling or similar tracking technologies will not be activated before valid consent is obtained.

You can manage optional technologies through the website’s cookie controls and your browser settings. Withdrawing consent must be as easy as giving it.

A separate cookie policy or cookie table should identify the technologies actually used, their providers, purposes and durations.

11. Who we share information with

Where necessary and lawful, information may be shared with:

• Website, hosting, email and IT-support providers.
• Booking, payment, accounting and business-administration providers.
• Insurers and professional advisers.
• Healthcare professionals where you have requested or authorised this.
• Emergency services where necessary.
• Regulators, courts, law-enforcement agencies or public authorities where required.
• Prospective purchasers or professional advisers if the business is reorganised or sold.

Service providers acting on our behalf may only use information for the agreed purpose and must protect it appropriately.

We do not sell personal information.

12. International transfers

Some suppliers, including website, email, cloud, payment, WhatsApp and social-media providers, may process information outside the United Kingdom.

Where personal information is transferred internationally, we will use an approved legal mechanism where required, such as UK adequacy regulations, the UK International Data Transfer Agreement or an approved UK Addendum, together with appropriate safeguards.

You may contact us for more information about relevant safeguards.

13. How long we keep information

We retain information only for as long as reasonably necessary. Typical periods are:

• General enquiries that do not become bookings: up to 12 months.
• Booking, client and service records: normally up to 6 years after the last session.
• Health screening, consent, waiver and incident records: normally up to 6 years after the last session, or longer where required by insurance, safeguarding or legal advice.
• Financial, invoice and tax records: normally 6 years after the relevant accounting period.
• Marketing information: until you unsubscribe, withdraw consent or the information is no longer required.
• Website security records: for the period reasonably required to identify and investigate security issues.
• Complaints and legal claims: for as long as necessary to resolve the matter and meet applicable limitation periods.

These periods may be adjusted where information must be retained for an ongoing complaint, legal claim, safeguarding matter or regulatory requirement.

Important: Retention periods should be checked against Co Pilates’ insurance policy and professional-body requirements.

14. Security

We take reasonable organisational and technical measures to protect personal information, including access controls, appropriate passwords, secure systems, backups and limiting access to people who need the information.

No internet or email system is completely secure. Please contact us promptly if you believe personal information has been lost, misused or disclosed improperly.

15. Automated decisions

Co Pilates does not currently expect to make decisions about clients based solely on automated processing where those decisions have legal or similarly significant effects.

If this changes, we will provide appropriate information and safeguards, including the ability to request human intervention, express your point of view and challenge a significant automated decision.

16. Children

Our services and website are not directed specifically at children.

Where we agree to provide services to someone under 18, we may require consent and contact information from a parent or guardian and will consider the child’s age, understanding and best interests.

We do not knowingly use children’s information for targeted advertising.

17. Your rights

Subject to legal conditions and exemptions, you may have the right to:

• Be informed about how your information is used.
• Request access to your personal information.
• Ask us to correct inaccurate or incomplete information.
• Ask us to erase information.
• Ask us to restrict its use.
• Object to processing based on legitimate interests or direct marketing.
• Receive certain information in a portable format.
• Withdraw consent at any time.
• Challenge certain automated decisions.
• Complain about how your information has been handled.

We may ask for information to confirm your identity. We will make reasonable and proportionate searches when responding to an access request.

If we reasonably require clarification or further information to respond, the applicable response period may be paused until that information is received, as permitted by law.

There is normally no fee for exercising these rights. A reasonable fee may be charged, or a request refused, where the law permits this because a request is manifestly unfounded or excessive.

18. Data-protection complaints

If you are concerned about how we use your information, please contact:

Kelly Ruddy / Co Pilates
Email: hello@copilates.co.uk
Address: 7 Ridge Crest, Enfield, EN2 8JU

Please include enough information for us to understand and investigate the complaint.

We will acknowledge a data-protection complaint within 30 days, investigate it appropriately and respond without undue delay. We will explain the outcome and any action taken.

You also have the right to complain to the Information Commissioner’s Office:

Information Commissioner’s Office
Website: https://ico.org.uk/make-a-complaint/
Telephone: 0303 123 1113

We would appreciate the opportunity to address your concern first, but you are not required to contact us before approaching the ICO.

19. Third-party websites

The website contains links to services including WhatsApp, Instagram and Facebook. We do not control those external websites or their privacy practices.

You should review the privacy information provided by an external service before submitting personal information to it.

20. Changes to this policy

We may update this policy when our services, suppliers or legal obligations change.

The latest version will be published on this website with its revision date. Where a change materially affects how we use existing client information, we will take reasonable steps to notify those affected.