Privacy Policy

1. Who we are

Revitalise @ The Fit Club is a salon, aesthetics and wellness clinic based in Redditch, Worcestershire. In this policy, “Revitalise”, “we”, “us” and “our” means the Revitalise service that handles your booking, treatment, client care or enquiry.

For privacy questions, contact us at privacy@revitaliseatthefitclub.co.uk.

You can also contact us through the website at www.revitaliseatthefitclub.co.uk.

2. What information we collect

The information we collect depends on how you interact with us. It may include:

• your name, mobile number, email address and contact preferences;
• booking details such as service, staff member, appointment date, appointment time, price and payment status;
• messages you send us through booking forms, website forms, WhatsApp, SMS, email or social media;
• treatment notes, consultation information, consent records, contraindication checks, allergies, medication information or aftercare notes where relevant to the service;
• before-and-after photos or treatment photos where you provide them or agree for us to take them;
• payment and transaction references, although we do not store full card details;
• reviews, feedback, service preferences and complaint records;
• technical information such as website logs, device/browser data and local device settings used by our website, kiosk, wallboard or client tablet; and
• staff/admin login, PIN, audit and access information for the secure Revitalise admin system.

3. Why we use your information

We only use personal information where we have a lawful reason. The main reasons are set out below.

4. Treatment, health and special category data

Some aesthetics, wellness or treatment services may involve health-related information. This can include allergies, medication, treatment suitability, medical history, consultation answers, consent forms, clinical notes or treatment photos.

We only collect this type of information where it is relevant to the service, client safety, professional standards, insurance, record keeping or legal requirements. Access is limited to people who need it to provide, support or administer the service.

5. Booking messages, reminders and marketing

Transactional messages

We may contact you by SMS, email, phone, WhatsApp or similar channels about your booking, enquiry, treatment, care instructions, payment, cancellation or service issue. These are service messages, not marketing.

Marketing messages

We only send marketing where we have a valid reason to do so. Where we rely on consent, you can withdraw consent at any time. Where the soft opt-in applies, we will only use it for our own similar services and will give you a clear way to opt out.

We keep marketing preferences separate from appointment and client-care communications. If your marketing preference is unknown, we will not treat it as explicit consent.

6. Existing and imported client details

As Revitalise improves its booking and client-care systems, we may migrate existing client details from earlier Revitalise systems, booking exports, manual records, forms or staff-held records into the current Revitalise system.

We do this to continue managing appointments, client records, treatment history and aftercare consistently. We do not use a migration as permission to send marketing. Marketing consent must be recorded separately.

Where old records contain unnecessary or excessive free-text notes, we aim to minimise what we move and keep only what is relevant for client care, safety, admin, legal or insurance reasons.

7. Who we share information with

We do not sell client data. We only share it where needed to run Revitalise, provide services, meet legal obligations or use trusted suppliers.

Suppliers and systems may include:

• booking, diary and client-record systems;
• website and hosting providers, including Netlify and Supabase;
• file and document storage providers, including Cloudflare R2 where used for care documents and media;
• email delivery providers, including Resend;
• SMS providers, including SMS Works;
• payment providers, including SumUp and Stripe where used;
• consultation, consent or treatment-record systems such as FACES where used by staff;
• professional advisers, insurers, regulators or authorities where required; and
• individual staff members or self-employed practitioners at Revitalise who need the information for appointments, treatment or client care.

Where suppliers process data for us, we expect them to protect it and only use it for the instructed purpose.

8. Website, client tablet, kiosk and wallboard

Our website and clinic devices may use browser storage, cache storage or local storage to keep the site working, remember display preferences, improve performance, cache media or support staff/admin features.

The foyer wallboard is designed to show only limited appointment welcome information, normally a client first name and the relevant service area or staff member. It should not display full client names or private treatment notes.

Where clinic kiosk or tablet features use device camera access for motion/wake behaviour, this is intended for local device interaction only and not for recording, storing or identifying clients.

9. Reviews, images and social proof

We may display reviews or feedback on our website, social channels, clinic screens or marketing materials. We aim to use limited identifying information, such as first name or review platform name, unless you agree otherwise.

Before-and-after images, treatment photos or identifiable client images are only used for care, records or marketing where we have an appropriate reason and permission where required.

10. How long we keep information

We keep personal information only for as long as we reasonably need it. Retention periods may vary depending on the type of record.

• Booking and client contact records may be kept while you remain a client and for a reasonable period afterwards.
• Payment and accounting records may be kept for legal, tax and accounting reasons.
• Aesthetics, treatment and consent records may be kept for longer where needed for client safety, professional, legal or insurance reasons.
• Marketing opt-out records may be kept so we know not to contact you again for marketing.
• Temporary migration files, exports and staging data should be deleted once the migration has been checked and completed.

11. International processing

Some technology suppliers may process or support data from outside the UK. Where this happens, we aim to use reputable providers and appropriate safeguards, such as contractual protections, where required.

12. Security

We use practical security measures to protect personal information, including restricted admin access, staff authentication, role-based access where available, secure hosting, encrypted connections, supplier controls and operational checks.

No system is completely risk-free, but we work to keep access limited and proportionate. Staff should only access client data where they need it for their role.

13. Your rights

Depending on the circumstances, you may have rights to:

• ask what personal information we hold about you;
• ask us to correct inaccurate information;
• ask us to delete information where it is no longer needed or has been used unlawfully;
• object to some uses of your information;
• restrict how we use your information;
• request a copy of your information in a portable format; and
• withdraw consent where we rely on consent.

Some rights are not absolute. For example, we may need to keep certain records for legal, insurance, treatment safety or accounting reasons.

You can complain to the Information Commissioner’s Office if you are unhappy with how your data is handled. We would appreciate the chance to resolve the issue with you first.

14. Contact us

For privacy questions or requests, contact:

Revitalise @ The Fit Club
Redditch, Worcestershire
Email: privacy@revitaliseatthefitclub.co.uk

Please include enough detail for us to identify your record, such as your name, contact number, email address and the service or appointment you are asking about.