Privacy Policy

1. Introduction

TD Body Services LTD, trading as TD Performance Therapy, is responsible for the personal data described in this policy and acts as the data controller where it decides how and why that data is processed.

2. Information we collect

Identity and contact information

• Name, email address, phone number, date of birth, and postal address.
• Emergency contact details where you choose or are asked to provide them.
• Account identifiers, profile information, and authentication-related records.

Booking and payment information

• Appointments, services, therapists, locations, prices, status, and communications.
• Payment status and transaction references. Card details may be processed directly by a payment provider rather than stored by us.

Health information

Health information may be special category data under UK GDPR. It can include:

• Medical history relevant to treatment, current conditions, injuries, medications, and contraindications.
• Health questionnaires, consent records, treatment notes, session records, and reported outcomes.
• Training information, physical concerns, and goals that you share with us.

Technical and usage information

• IP address, browser and device information, timestamps, and security logs.
• Platform interactions, error information, and analytics relating to use of the website.

3. Legal basis for processing

Depending on the activity and information involved, we may rely on:

• Contract: to arrange and provide services, manage appointments, and administer payments.
• Legitimate interests: to operate and secure the platform, prevent misuse, improve services, and manage the business where those interests are not overridden by your rights.
• Consent: where consent is appropriate, including selected communications or processing activities.
• Legal obligation: where records or disclosures are required by law.
• Health data condition: an additional lawful condition is required when special category health data is processed. The condition used will depend on the context, such as explicit consent or provision of health-related services by a person subject to confidentiality obligations.

4. How we use your information

• To provide and adapt treatment services safely.
• To manage accounts, bookings, availability, payments, cancellations, and appointment records.
• To send service messages, confirmations, reminders, and relevant follow-up communication.
• To maintain continuity of care and appropriate professional records.
• To secure, troubleshoot, monitor, and improve the website and platform.
• To meet accounting, insurance, legal, safeguarding, and regulatory responsibilities.
• To send marketing only where we have an appropriate basis and provide a way to opt out.

5. Data sharing and service providers

We may share only the information reasonably necessary with:

• Therapists or authorised team members involved in providing and administering your service.
• Authentication, hosting, database, email, calendar, analytics, payment, and technical support providers acting under appropriate terms.
• Healthcare professionals where you ask us to coordinate or where another lawful basis applies.
• Professional advisers, insurers, law enforcement, courts, regulators, or public authorities where necessary or legally required.
• A successor organisation in connection with a genuine restructuring, merger, acquisition, or sale, subject to applicable data protection obligations.

We do not sell personal information or rent it to third parties for their own marketing.

Google services

Where enabled, Google services may be used for account sign-in or appointment calendar synchronisation. The platform requests only the scopes needed for the relevant feature. Access can be revoked through your Google Account settings, and Google's own processing is described in the Google Privacy Policy.

6. Data security

We use organisational and technical measures intended to protect personal data against unauthorised access, alteration, disclosure, or loss. Measures include role-based access, authentication, secure transport, supplier controls, logging, backups, and maintenance appropriate to the platform and the risks involved.

No internet service can guarantee absolute security. If we become aware of a personal data breach, we will assess and handle it in line with applicable legal obligations.

7. Data retention

We retain information only for as long as reasonably necessary for treatment, contractual, professional, insurance, tax, legal, security, and dispute-handling purposes. Retention periods can differ by record type and the age of the client.

Health and treatment records may need to be retained for an extended professional or legal period after the last treatment. Financial records are generally retained for the period required by UK tax and accounting rules. When information is no longer required, it is deleted, anonymised, or securely archived as appropriate.

8. Your data protection rights

Subject to the circumstances and exemptions in UK data protection law, you may have the right to:

• Request access to your personal data.
• Ask for inaccurate or incomplete data to be corrected.
• Ask for data to be erased or processing to be restricted.
• Object to processing based on legitimate interests or to direct marketing.
• Receive certain data in a portable format.
• Withdraw consent where processing relies on consent, without affecting earlier lawful processing.

To make a request, email support@tdperformancetherapy.co.uk. We may need to verify your identity and may retain information where law or professional obligations require it.

9. Cookies and analytics

The platform uses cookies or similar storage that is necessary for secure authentication, session management, preferences, and core functionality. We may also use privacy-conscious performance or usage analytics to understand whether pages work as expected and to improve the service.

You can control cookies through your browser. Blocking necessary cookies may prevent sign-in or other platform features from working correctly.

10. International data transfers

Some technology providers may process information outside the UK. Where UK personal data is transferred internationally, we use a lawful transfer mechanism where required, such as UK adequacy regulations, approved contractual clauses, or another safeguard recognised by UK law.

11. Changes to this policy

We may update this Privacy Policy when our services, suppliers, or legal obligations change. The date at the top identifies the current version. Material changes may also be communicated through the platform or by email where appropriate.

12. Contact and complaints

If you remain concerned about how your information has been handled, you may complain to the UK Information Commissioner's Office. Visit ico.org.uk for current guidance.

This policy should be read with our Terms of Service and Booking Policy.