Privacy Policy

1. Who we are

Cocoon Therapy - Massage & Wellness is a women-only massage therapy practice based in East Putney, London. We are the data controller for the personal information you provide to us.

Contact: hello@cocoontherapy.co.uk  |  07933 274028

2. What data we collect

We collect personal information in three ways:

When you book or contact us:

• Name, email address, and phone number
• Booking history and booking details
• Emails or messages you send us, and our replies

When you buy or redeem a gift card:

• Purchaser and recipient contact details
• Gift-card value, redemption history, and any gift message you provide

When you complete our client forms:

• Health history, medical conditions, and medications
• Areas of concern, treatment preferences, and goals
• Signed consent and liability release

When you visit our website:

• Basic visit logs (page requests, timestamps, IP address, user-agent string, and approximate location from your IP)
• The page you landed on and the website or search you came from (if your browser shares it) so we can understand which channels (e.g. search engines, social media, printed leaflets, QR codes) bring people to the site
• Marketing tags such as utm_* parameters and ad-click identifiers (e.g. gclid, fbclid) when present in the link you clicked
• A randomly generated visitor identifier stored in your browser (no name or contact details) so repeat visits in the same browser are not double-counted
• If you use the optional Services helper, the general text you type when asking for treatment suggestions

We do not use Google Analytics, Meta Pixel or comparable advertising pixels on the website. The main visit log is held on our server; when approximate location reporting is enabled, an IP address is sent to the limited geolocation provider described below.

Emails sent by Cocoon may contain delivery, open and link-click tracking supplied by our email provider, Resend. We use this to understand whether important messages arrived and, in aggregate, which kinds of email are useful. Open and click figures are approximate because email privacy features and security scanners can create automated activity. Cocoon stores a keyed, non-readable recipient reference with event times and counts; it does not retain the tracking event's IP address, device details or full clicked URL in its analytics database. Recipient-level tracking identifiers and raw events are removed or anonymised after 90 days, while aggregate counts may be retained for longer.

3. How we use your data

We use your information to provide and administer our services:

• To assess suitability for treatment and adapt sessions to your needs
• To contact you about appointments or respond to enquiries
• To comply with our professional duty of care
• To provide gift cards, vouchers, receipts, and redemption records
• To prevent fraud, protect the website, investigate failed payments, and maintain operational records
• To send occasional marketing emails where you have consented or where the electronic-mail soft opt-in legally applies, with an unsubscribe option in every message

Online card payments are processed by Stripe or SumUp. Their hosted payment components collect your card details directly; Cocoon Therapy does not store your full card number or card security code. We retain limited payment references, amounts, status and refund information for reconciliation, fraud prevention and accounting.

4. Legal basis for processing

Under UK GDPR, we rely on the following legal bases:

• Explicit consent — for processing special-category health data collected through our consultation forms. This is requested separately from consent to treatment and can be withdrawn at any time
• Consent or the PECR soft opt-in — for marketing emails where its requirements are met, with the right to opt out at any time
• Contract — to fulfil your booking and deliver your treatment
• Legitimate interests — for website visit logging, traffic-source analytics, and email delivery and aggregate engagement reporting, to keep services secure and operational and understand which communications are useful
• Legal obligation — for accounting, tax, and record-keeping duties

5. How we store your data

Your client forms, treatment notes, booking contact details, mirrored client emails and operational alert content are encrypted at rest and held behind access-controlled staff accounts protected by multi-factor authentication. Access is limited to people who need the information to provide or administer your treatment, and we do not send full health forms by unencrypted email. We take proportionate precautions to protect information from unauthorised access, alteration, loss or disclosure.

Retention depends on the record and why it is needed. Treatment and client records are normally retained for up to 7 years after the last treatment, subject to applicable professional, insurance and legal requirements. Accounting and transaction records are retained for the period required by UK tax and accounting law. Failed or abandoned checkout data, raw website logs and operational alerts are retained only for the shorter period needed for security, troubleshooting and reconciliation. Marketing suppression records are retained so that we can continue to honour an opt-out. Records are deleted or anonymised when the relevant period or purpose ends, unless a legal claim or other legal duty requires longer retention.

6. Service providers and international transfers

We share personal data only with service providers needed to operate the practice. These include payment processors; transactional email and calendar providers; booking platforms where you use those platforms; website hosting and security providers; and a limited IP-geolocation provider for approximate traffic reporting. Email sending and its delivery/open/click events are processed by Resend. Payment processing is currently provided by Stripe and SumUp. Where a booking originates through Treatwell, the relevant booking information is processed through that platform. Generic operational push notifications may be delivered through a notification provider and do not contain client names, health information or message contents.

Some providers may process information outside the UK. Where UK personal data is transferred internationally, we rely on an applicable UK adequacy regulation or contractual safeguards such as the UK International Data Transfer Agreement or UK Addendum, as appropriate. You may contact us for more information about the safeguard used for a particular provider.

Where an administrator deliberately uses the optional email-draft assistant, the relevant conversation text may be sent to OpenAI to prepare a draft which staff review before sending. This feature is not used to make treatment decisions.

We also offer an optional Services helper that can suggest treatments based on the text you type. If you use it, your request and a limited public catalogue of our services may be sent to OpenAI to generate suggestions. The helper does not access your client records, booking history, payment details, or health forms, and it does not make bookings or decisions about your care. We use basic technical information, such as IP address and browser user-agent, to rate-limit and protect this feature from abuse. Please keep requests general and do not include medical records or private health details.

7. Cocoon Rewards and client profiles

Where you join or use Cocoon Rewards, we process information needed to operate and secure your loyalty profile. This may include your name, email address, telephone number, authentication method, booking history, eligible spending, points earned or redeemed, referrals, corporate eligibility and records of corrections or suspected misuse.

You do not need to create a conventional password account. Secure access may use Google Sign-In, a passkey protected by your device unlock, or a single-use link or code sent to your email address. For a passkey we retain the credential’s public key, an opaque credential identifier, security counter and limited technical information needed to recognise and revoke it; Cocoon does not receive or store your fingerprint, facial image or device PIN. Where you verify an email address, we may use it to identify and link previous eligible direct bookings made using that address, including bookings completed before Cocoon Rewards launched. We do not provide access to booking history or reward balances merely because someone enters an email address: ownership must first be verified.

We use this information to administer rewards, calculate and redeem points, award eligible founding-client rewards, connect bookings to the correct client, provide transactional account and security messages, investigate errors or suspected misuse, and maintain appropriate financial and audit records. Loyalty participation does not automatically subscribe you to promotional marketing, which is managed separately.

We retain loyalty and transaction information only for as long as reasonably necessary for accounting, legal claims, security, fraud prevention, dispute resolution and operation of the scheme. You may ask us to close your loyalty profile, although limited records may be retained where legally required or reasonably necessary.

8. Your rights

Under UK GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct inaccurate or incomplete data
• Erasure — request deletion of your data (subject to legal retention obligations)
• Restriction — ask us to limit how we use your data
• Object — object to processing based on our legitimate interests, including website analytics, and object at any time to direct marketing
• Withdraw consent — at any time, where processing is based on consent
• Portability — receive your data in a structured, machine-readable format

To exercise any of these rights, contact us at hello@cocoontherapy.co.uk. We will respond within 30 days.

If you have a concern about how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

These rights can be limited in some circumstances, including where information must be retained to meet a legal obligation or establish, exercise or defend a legal claim.

9. Changes to this policy

We may update this policy from time to time. The current version will always be available on this page with the date it was last revised.

10. Contact

For any questions about this policy or your data, please contact:

Cocoon Therapy - Massage & Wellness
hello@cocoontherapy.co.uk
07933 274028