Privacy policy
Last updated: 12 November 2026
Therapy Plus Yorkshire ("we", "us", "our") respects your privacy. This policy explains what personal data we collect through our website and when you contact or book with us, why we collect it, the legal basis we rely on, who we share it with, how long we keep it and your rights under UK data protection law, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).
We do not sell your personal data or use it for marketing you have not requested.
Who we are
Therapy Plus Yorkshire is a trading name of Ellie Wilkinson, a sole trader. Ellie Wilkinson is responsible for the personal data described in this policy and acts as its data controller.
Address: 2a Woodhead Road, Holmfirth HD9 2JU.
For questions about this policy or your personal data, email [email protected] or call 07399 959494.
This policy covers our website at therapyplusyorkshire.co.uk, enquiries made through the contact methods described below and the information we hold when you book or receive a treatment.
What data we collect
When you send an enquiry. Our form asks for your name, email address and a message. You can also give your phone number and select the treatment you are interested in. We receive the details you submit, the page you sent the enquiry from and the date and time. Your name, email address and message are required so we can respond. If you do not want to use the form, you can contact us by phone or email instead.
When you contact us directly. If you phone, email or message us on social media, we keep the information you provide and our correspondence so we can respond and manage your enquiry.
When you book. Appointments are booked through Fresha. Fresha collects the details needed to make and manage your booking, such as your name, contact details and appointment history, and shares them with us so we can provide your treatment.
When you have a treatment. Before treatment, Ellie will ask about your health, any injuries, medical conditions, medication and relevant history so treatment is safe and suitable. We keep a record of this information and of the treatment provided.
When you visit the website. Our hosting and security provider processes technical information, such as your IP address, browser and device information and the pages requested, to deliver the website and protect it from abuse.
When you use the form. Cloudflare Turnstile processes technical signals from your browser and device to help distinguish genuine visitors from automated bots.
We do not collect payment card details through this website.
Health information
Information about your health is special category data and needs extra protection. We only collect it where you choose to provide it, either in an enquiry or during your consultation, and only use it to respond to you and to provide safe and suitable treatment. We rely on your explicit consent to process it. You can withdraw your consent at any time by contacting us, although we may not be able to provide treatment without the information we need to do so safely, and we may need to keep existing records for the reasons described below.
How we use your data and our legal basis
| Purpose | Data used | Legal basis |
|---|---|---|
| Responding to an enquiry or question | Contact details and your message | Taking steps at your request before entering into a contract; otherwise our legitimate interest in responding to people who contact us |
| Managing bookings and providing treatment | Contact details, booking details and treatment records | Performance of a contract |
| Assessing whether treatment is safe and suitable, and recording treatment | Health information you provide | Your explicit consent |
| Keeping appropriate records and dealing with queries, complaints or claims | Enquiry, booking, treatment and correspondence records | Legitimate interests in managing the business and establishing, exercising or defending legal claims |
| Meeting accounting, tax, insurance and other legal requirements | Relevant transaction and business records | Compliance with legal obligations |
| Delivering the website and maintaining security | Technical data | Legitimate interests in operating a functioning, secure website |
| Preventing spam and automated abuse of our form | Turnstile security signals | Legitimate interests in protecting our website and inbox |
Where we rely on legitimate interests, we consider the purpose of the processing, whether it is necessary and the effect on your rights and expectations. You can object to this processing using the contact details above.
Who we share your data with
We use service providers to run the website, receive enquiries and manage bookings. Where a provider acts as our processor, it processes personal data under the relevant contractual arrangements and our instructions.
Cloudflare. Cloudflare hosts the website through Cloudflare Pages, provides network security and runs the code that processes enquiry submissions. It handles technical data needed to deliver and secure the website, and submission data when the form is processed. See Cloudflare's privacy policy (opens in a new tab).
Cloudflare Turnstile. Turnstile is the security check used on our form. It loads when you start using the form. Your browser sends security signals to Cloudflare, and our server sends the resulting token and your IP address for verification before delivering an enquiry. Cloudflare states that these signals are used to detect and block bots rather than to identify, profile or target individuals. See the Turnstile privacy addendum (opens in a new tab).
Resend. Resend delivers enquiry submissions to us by email. It processes the information submitted in the form and associated email delivery information. See Resend's privacy policy (opens in a new tab).
Google. Google provides our email service (Gmail), which stores the enquiry emails we receive and our replies. See Google's privacy policy (opens in a new tab).
Fresha. Fresha provides our online booking system. When you book through Fresha, it also processes your information under its own privacy policy, available on the Fresha website.
Website support. Franks Media provides website maintenance and technical support and may access relevant information where needed to troubleshoot the website or enquiry delivery on our behalf.
Our fonts are hosted on our own website. Loading them does not connect your browser to Google Fonts or another external font provider.
We may also share relevant information with professional advisers, such as an accountant, legal adviser or insurer, or with authorities where disclosure is required by law. With your agreement, we may share relevant information with your GP or another healthcare professional involved in your care.
Cookies and similar technologies
We do not use analytics, advertising or marketing tracking cookies on this website.
Cloudflare's security services may use strictly necessary cookies or similar technologies to protect the website and prevent automated abuse.
Our Sports Massage page includes a video hosted on Facebook. Nothing is loaded from Facebook unless you press play. When you do, the video loads from Facebook, which may set cookies and collect information about your device under Meta's privacy policy (opens in a new tab).
You can manage cookies through your browser settings. Blocking security-related technologies may affect the website or prevent the form from sending. You can contact us by phone or email instead.
If we introduce non-essential cookies or similar technologies, we will update this policy and obtain consent where required before using them.
Automated security checks
Turnstile carries out an automated security check. If a submission fails this check, the form may not send. This does not affect whether we can help you or provide treatment. If you have trouble sending the form, call 07399 959494 or email [email protected]. We do not make decisions producing legal or similarly significant effects solely by automated means.
International transfers
Our service providers may process or allow access to personal data outside the UK. The countries involved depend on the provider and the service configuration. This includes possible processing in the United States by providers such as Resend, Cloudflare and Google.
Where a restricted international transfer takes place, we rely on an applicable UK adequacy arrangement or appropriate contractual safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with any additional measures required. You can contact us for more information about the safeguards relevant to your personal data.
How long we keep your data
We keep personal data only for as long as needed for the purpose for which it was collected.
| Data | Retention period |
|---|---|
| Enquiries that do not lead to a booking | Up to two years after our last contact, then deleted unless there is a specific continuing need |
| Client and treatment records, including health information | For the period required by our professional insurance and legal obligations after your last treatment |
| Booking records held by Fresha | For the period set by Fresha and our account settings |
| Accounting and tax records | For the period required by the applicable accounting and tax rules |
| Email delivery records | For the period specified by our email delivery provider and the settings applicable to our account |
| Hosting and security information | For the period applicable to the service and its security configuration |
We may keep relevant records for longer where needed to comply with a legal obligation or deal with an ongoing complaint, dispute or claim.
Your rights
Depending on the circumstances, you have the right to:
- request access to the personal data we hold about you;
- ask us to correct inaccurate or incomplete information;
- ask us to delete your personal data;
- ask us to restrict how we use your personal data;
- object to processing based on legitimate interests;
- receive certain personal data in a portable format; and
- withdraw consent where we rely on it, without affecting processing carried out before withdrawal.
These rights are subject to conditions and exemptions. For example, we may need to keep some records to meet legal or insurance obligations.
To make a request, email [email protected]. Requests are normally free of charge. We may need information to confirm your identity or clarify your request. We normally respond within one month, subject to any extension permitted by law, and will explain if one applies.
Complaints
To make a data protection complaint, email [email protected] or call 07399 959494 and explain your concern. We will acknowledge your complaint within 30 days, investigate without undue delay, keep you informed and tell you the outcome.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk/make-a-complaint (opens in a new tab) or by calling 0303 123 1113.
Keeping your data secure
We use appropriate technical and organisational measures to protect personal data. The website and enquiry submissions use HTTPS. Access to enquiries and client records is limited to Ellie and, where needed for technical support, Franks Media.
Enquiries are delivered to our email inbox rather than stored in a separate website database. Our hosting, security and email providers may keep processing or delivery records under their own service arrangements.
Links to other websites
Our website links to other websites, including Fresha, Facebook and Instagram. If you follow a link, the operator of that website is responsible for its own processing of your personal data. Please read its privacy information where relevant.
Changes to this policy
We may update this policy if our services or the way we use personal data changes. The date at the top shows when it was last updated.