Privacy Policy

Nü Wellness Club Ltd is the controller of the personal information described in this policy. This means we decide why and how it is used. Nü Wellness Club Ltd is registered in England and Wales with company number 16915170.

BUSINESS ADDRESS

Unit 5, Fairfield Road, Neath, SA11 3ES

PRIVACY CONTACT

info@nuwellnessclub.co.uk

WEBSITE

www.nuwellnessclub.co.uk

Practitioners renting treatment rooms operate independently. Where they control their own consultation and treatment records, they provide their own privacy notices. We explain who is responsible when arranging an appointment. This policy covers information held by Nü, rather than an independent practitioner’s clinical records.

Depending on how you use our services, we may collect your name, contact details, date of birth for age checks, emergency contact details, membership and account information, bookings, attendance, purchases, payment and refund records, communications, complaints and preferences. For under-18s, we may also collect necessary parent or guardian details and permissions.

When you send an enquiry through our website, we collect the details you choose to give us: your name, email address, phone number if provided, preferred contact method, the services you are interested in, your experience level, the membership you are considering, whether you are a member at another gym and which one, when you usually like to visit, any message you add, and the page you enquired from. Our enquiry form asks you not to share medical details. We also keep messages you send us through Instagram, and our replies.

For services requiring screening, we may collect relevant health information, such as injuries, medical conditions, pregnancy, medication, contraindications and accessibility needs. We ask only for information relevant to safe participation. Accident reports may also contain health information.

Our website or app may collect IP addresses, device and browser details, usage records, cookie identifiers and technical logs. Our Cookie Policy describes the technologies used. Stripe processes payment details; we use the payment information made available to us to administer transactions. We also collect CCTV images in shared areas and, with separate permission, promotional photos, videos and testimonials.

We collect information directly from you through forms, conversations, bookings, our website or app and correspondence. We may receive information from booking and payment providers, a person arranging a booking for you, or a practitioner where sharing is lawful. If you provide an emergency contact’s details, please tell them you have done so and refer them to this policy.

Bookings and memberships: We use contact, account, booking and payment information to provide the services you request, manage your membership, take payments and send essential service messages. Our lawful basis is performance of a contract, or taking steps at your request before entering a contract.

Enquiries and club administration: We use information, including enquiries sent through our website form, to answer questions, manage customer support, resolve complaints, protect accounts and improve service delivery. Our basis is our legitimate interests in running a safe and effective club and responding to customers. We assess these interests against your rights and expectations.

Legal and financial obligations: We use relevant records to meet tax, accounting and other legal duties. Our basis is compliance with a legal obligation. Where we pursue debts, handle disputes or defend claims, our basis is our legitimate interests in protecting our business and legal rights.

Health screening and service adaptations: Where we process health information on the basis of your explicit consent, consent is our Article 6 lawful basis and explicit consent is our Article 9 condition. We obtain a separate, specific consent statement before this processing. Accepting this policy or our general terms does not itself give that consent.

Accidents and emergencies: We use relevant information to respond to an incident and meet applicable reporting obligations. Our basis depends on the circumstances: legal obligation, legitimate interests or vital interests. Health information additionally requires an applicable special-category condition, such as legal claims where necessary, or vital interests where you are physically or legally incapable of consenting. We do not assume that every incident permits every use of health information.

Marketing: We send offers and updates by email and SMS only with your optional opt-in consent. Email and SMS choices are separate, so you can choose either, both or neither. Declining marketing does not affect access to services. Identifiable promotional photos, videos and testimonials also use separate consent.

Website and app security: Essential technical processing supports our legitimate interests in maintaining secure and reliable services. Vercel Web Analytics helps us understand website use, which supports our legitimate interests in understanding and improving our website. CCTV relies on our legitimate interests in premises security, crime prevention and investigation of safety incidents, balanced against your privacy.

We aim to collect screening information electronically through Mariana Tek, with signed paper forms as a backup. Access is limited to authorised staff who need it, and paper forms are stored in a locked cabinet. We do not use health information for advertising.

You may withdraw health-data consent by contacting us. This does not affect earlier lawful processing. If we cannot safely provide a particular session without relevant screening information, we explain why and any available alternatives. After withdrawal, we retain health information only where another applicable lawful basis and special-category condition permits or requires it, for example where necessary for legal claims.

You can unsubscribe from marketing emails, follow the opt-out instructions in messages, or contact us at any time. Essential booking, payment and service messages are separate from marketing. We may retain a minimal suppression record so that we respect your opt-out.

Your right to object to direct marketing is absolute. You may also object to processing based on legitimate interests; we will stop unless we have compelling legitimate grounds or need the information for legal claims.

Staff ask separately before using identifiable photos, videos or testimonials on our website, social media or in promotions. Taking part is optional. We record your permission and the agreed uses. To withdraw it, email us. We stop future consent-based use and remove material from channels we control where applicable. We cannot guarantee removal of copies independently shared by others or recall printed material already distributed.

We share information only where needed for the purposes above. Recipients may include authorised staff and instructors; booking, membership, app and customer communication providers; payment processors; website hosts and IT support; accountants, legal advisers and insurers; and emergency services or public authorities where lawfully required.

We use Mariana Tek for booking and membership administration, including the timetable, account and membership tools on our website; Xplor Growth for customer communications and marketing; Stripe for payments; Vercel for website hosting, and Vercel Web Analytics and Speed Insights for website analytics and performance; and Resend to deliver website enquiries to our team and send you a confirmation of your enquiry. We share only the information necessary for the relevant purpose. Providers acting as processors follow our instructions under appropriate agreements. Some providers act as separate controllers for their own purposes, including certain payment and legal obligations.

We share relevant information with independent practitioners only where needed and lawfully permitted, and explain their role. We do not sell your personal information. If the business is transferred or reorganised, necessary records may be shared with advisers or a successor subject to appropriate safeguards and notice where required.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent are excluded from every category of sharing described above and will not be shared with any third parties.

Technology providers may process information outside the UK or permit overseas access. Where this amounts to a restricted international transfer, we must use an applicable UK adequacy regulation or appropriate safeguards, such as the UK International Data Transfer Agreement or UK Addendum to approved contractual clauses, with the required assessment. Contact info@nuwellnessclub.co.uk for information about applicable safeguards and how to obtain a copy, subject to necessary redactions.

We retain only information necessary for its purpose, legal duties and relevant claims, then securely delete or anonymise it. Our routine periods are:

A dispute, investigation or legal duty may justify retaining relevant records longer. Information no longer needed is removed earlier. Retention of health information for claims must be necessary and meet the conditions for special-category data; a retention period does not authorise every possible use of the information.

We use appropriate technical and organisational measures to protect information, including controlled access and secure systems. We require processors to protect information and use it only as authorised. Access is limited according to role and need. No system is completely risk-free; we handle personal data breaches in accordance with applicable law.

CCTV records video only, with audio disabled, in reception, the front desk and other shared areas. It does not cover changing rooms, toilets or private treatment rooms. Signs alert visitors to its use. Only authorised management can access footage; relevant extracts may be disclosed to police, insurers, advisers or others lawfully handling an incident.

Our website does not set cookies. We use Vercel Web Analytics to understand visits and improve the website. Vercel Web Analytics does not use cookies or store anything on your device. It records the pages visited, the referring website, approximate location (country, region or city), browser, operating system and device type, and groups each visit using a temporary identifier created from the incoming request, which is discarded after 24 hours. We only see aggregated statistics. We also use Vercel Speed Insights, which measures page loading performance without cookies. This relies on our legitimate interests in understanding and improving our website.

Our Cookie Policy identifies the technologies, providers, purposes and durations in use. Other websites and social media platforms have their own privacy notices.

Depending on the circumstances, you may ask to access your information and receive a copy; correct inaccurate or incomplete information; erase information; restrict its use; or receive certain information in a portable format. You may withdraw consent at any time and object as explained in section 6. These rights have conditions and exceptions; we will explain any restriction that applies.

Contact our privacy contact in section 1 to make a request. We normally respond within one month, subject to lawful extensions or pauses, and will explain any delay. Requests are normally free. We may request proportionate information to verify your identity before disclosing personal information.

If you have a concern about how we use your information, please contact us so we can investigate and respond. You may also complain to the Information Commissioner’s Office (ICO), the UK data protection regulator, at any time. Visit ico.org.uk/make-a-complaint or call 0303 123 1113.

Some information is needed to enter or perform a membership or booking contract, and some is needed to meet legal requirements. We identify mandatory fields and explain the consequences of not providing information. Without required contact or payment details, we may be unable to complete a booking. Health screening requirements are explained in section 5.

Suitability for a service may be assessed by authorised staff or an appropriate practitioner. If we introduce solely automated decisions with legal or similarly significant effects, we will explain the processing, significance, likely consequences and applicable safeguards before use.

Under-18s may attend eligible services subject to relevant age limits, parent or guardian consent and supervision, and medical supervision where required. We explain service-specific conditions before booking. We collect only necessary information about the young person and responsible adult, provide age-appropriate privacy information and establish who can give required consent.

A young person’s rights and capacity to consent depend on the circumstances and their understanding. Parental involvement does not automatically give unrestricted access to the young person’s records. We do not knowingly direct marketing to children.

We review this policy when our services or information practices change. The latest version will be available on our website and on request. We will communicate material changes where appropriate. A revised notice does not replace consent where fresh consent is required.