Privacy Policy

Equilibrium: Fitness and Rehabilitation Services
Last updated: 19/08/2026

Equilibrium: Fitness and Rehabilitation Services respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains what personal information we collect, how we use it, how we protect it, who we may share it with and your rights in relation to your information.

This Privacy Policy applies to personal information collected through our website, booking systems, consultations, appointments, rehabilitation and fitness services, communications and other services provided by Equilibrium: Fitness and Rehabilitation Services.

1. Who We Are

Equilibrium: Fitness and Rehabilitation Services is responsible for the personal information collected and processed in connection with the services we provide.

For the purposes of applicable UK data protection legislation, Equilibrium: Fitness and Rehabilitation Services acts as the data controller for the personal information we process.

If you have any questions about this Privacy Policy, how we handle your personal information, or wish to exercise your data protection rights, please contact us through our Contact Us page.

Where appropriate, we may request additional information to verify your identity before responding to certain data protection requests.

2. What Information We Collect

Depending on the services you use, we may collect and process the following information.

Personal and contact information

This may include:

  • Name

  • Date of birth

  • Address

  • Telephone number

  • Email address

  • Emergency contact information

  • Parent or guardian information where applicable

Health and rehabilitation information

Where necessary to provide assessment, treatment, rehabilitation, fitness or falls prevention services, we may collect information including:

  • Medical history

  • Current and previous injuries

  • Symptoms

  • Diagnoses

  • Medication information

  • Relevant medical conditions

  • Previous treatment

  • Exercise and physical activity history

  • Assessment findings

  • Treatment and rehabilitation records

  • Progress and outcome information

  • Information relating to falls, mobility, balance or functional ability

  • Other information that you provide which is relevant to your care or rehabilitation

Health information is considered special category data under UK GDPR and is subject to additional protection.

We only seek to collect information that is reasonably necessary for the services we provide.

Appointment and service information

We may collect information relating to:

  • Appointment dates and times

  • Services booked

  • Attendance

  • Cancellations and missed appointments

  • Treatment and rehabilitation plans

  • Communications relating to your appointments

Payment information

Payments and invoices for our services are managed through Rehab Guru, which integrates with payment providers including Stripe.

Where you pay using the SumUp card machine, SumUp processes and retains the relevant payment transaction information.

We do not store complete payment card details ourselves.

Website and technical information

Our website is hosted and operated using Squarespace.

When you use our website, certain technical information may be collected automatically, which may include:

  • IP address

  • Browser and device information

  • Website usage information

  • Pages visited

  • Approximate location information

  • Cookies and similar technologies

The specific information collected will depend on the functionality and settings of our Squarespace website.

Website contact form

Our website includes a contact form which allows visitors to contact Equilibrium: Fitness and Rehabilitation Services without publicly displaying our email address.

The contact form may collect information such as:

  • Name

  • Email address

  • Telephone number, where provided

  • The contents of your message

Please do not submit detailed medical, clinical or other sensitive health information through the general website contact form.

If you are an existing or prospective client and need to provide health or clinical information, you should use the appropriate forms and registration process provided through Rehab Guru.

3. How We Collect Your Information

We may collect personal information:

  • Directly from you when you make an enquiry or book an appointment

  • Through our website contact form

  • Through registration and consent forms

  • During assessments and consultations

  • During treatment or rehabilitation

  • Through Rehab Guru's online booking system

  • Through email, telephone, text message or other communications

  • Through payment and invoicing systems

  • From a parent or legal guardian where appropriate

  • From another healthcare professional where you have requested or authorised information to be shared

  • From other sources where this is lawful and reasonably necessary

All client registration, consent and clinical forms are produced and managed through Rehab Guru.

4. Why We Use Your Information

We use your personal information for purposes including:

Providing services

To:

  • Assess your needs

  • Provide rehabilitation and treatment

  • Provide personal training, sport massage and falls prevention services

  • Develop and monitor rehabilitation programmes

  • Provide mobile/home appointments

  • Provide online coaching where offered

  • Monitor progress and outcomes

  • Maintain appropriate clinical records

Managing appointments

To:

  • Arrange and manage appointments

  • Send appointment confirmations and reminders

  • Communicate appointment changes

  • Manage cancellations and missed appointments

Payments and administration

To:

  • Process payments

  • Issue invoices

  • Manage refunds

  • Maintain financial and business records

  • Manage outstanding payments

Safety and professional responsibilities

To:

  • Maintain appropriate clinical and professional records

  • Identify when referral to another healthcare professional may be appropriate

  • Respond appropriately to concerns regarding your health or safety

  • Meet applicable professional, legal and insurance requirements

Website enquiries

To respond to enquiries submitted through our website contact form and provide information about our services.

Communication

To communicate with you about your appointments, treatment, rehabilitation and other matters relating directly to the services you receive.

Where we wish to send you marketing communications that require consent, we will seek the appropriate consent and provide a way to withdraw it.

5. Our Lawful Bases for Processing Your Information

Under UK GDPR, we must have a lawful basis for processing personal information.

Depending on the circumstances, we may rely on:

  • Performance of a contract – where processing is necessary to provide services you have requested or to manage your agreement with us.

  • Legitimate interests – where processing is necessary for legitimate business purposes and those interests are not overridden by your rights and interests.

  • Legal obligation – where we are required to process or retain information to comply with a legal obligation.

  • Consent – where we ask you to provide consent for a specific use of your information and consent is the appropriate legal basis.

Because health information is special category data, an additional condition under Article 9 UK GDPR is required.

Where appropriate, health information may be processed for the purposes of providing or managing health or social care in accordance with applicable data protection legislation.

6. Health Information

Health information is collected because it may be necessary to assess your condition, identify appropriate rehabilitation or treatment, monitor your progress and provide services safely.

We aim to collect only information that is relevant and reasonably necessary for these purposes.

Health information will not be used for unrelated purposes unless there is an appropriate lawful basis for doing so.

Because health information is particularly sensitive, we take additional care with its security, access and storage.

7. Who We May Share Your Information With

We will not sell your personal information.

We may share relevant information where necessary and lawful with:

Healthcare professionals

Where appropriate, and where lawful, relevant information may be shared with healthcare professionals involved in your care, such as:

  • GP

  • Physiotherapist

  • Consultant

  • Other appropriate healthcare professionals

Information may also be disclosed where we are legally required or permitted to do so.

Service providers

We use trusted third-party providers to support the operation of our business, including:

  • Rehab Guru – booking, client forms, clinical records, rehabilitation programmes, invoicing and payment management.

  • Stripe – payment processing through Rehab Guru.

  • SumUp – card payment processing and transaction records.

  • Heidi Health – AI-assisted clinical documentation where applicable.

  • Squarespace – website hosting and associated website functionality.

These organisations may process personal information on our behalf or as independent data controllers depending on the nature of the service they provide.

8. Rehab Guru

We use Rehab Guru to manage various aspects of our client services.

This may include:

  • Appointment bookings

  • Client registration

  • Consent forms

  • Health questionnaires

  • Clinical notes

  • Rehabilitation programmes

  • Exercise programmes

  • Invoices

  • Payment processing

  • Client communications

Personal information provided through Rehab Guru is processed in accordance with Rehab Guru's own privacy and data protection arrangements as well as our responsibilities as the data controller.

9. Stripe

Payments made through invoices or booking services may be processed using Stripe through Rehab Guru.

Stripe may process payment and transaction information necessary to process your payment.

We do not normally receive or store your complete payment card details.

Stripe processes personal information in accordance with its own privacy policy and applicable data protection requirements.

10. SumUp

Where you make payment using our SumUp card machine, the payment is processed by SumUp.

SumUp may retain transaction and payment information associated with the transaction.

We do not store your complete payment card details ourselves.

11. Squarespace and Website Data

Our website is hosted and operated using Squarespace.

Squarespace may process certain information about website visitors, including technical information, IP addresses, device information and information collected through cookies or similar technologies.

Squarespace may also process information submitted through website features, including our contact form.

The use of cookies and similar technologies will be managed in accordance with applicable UK data protection requirements.

12. Website Contact Form

The contact form on our website is intended for general enquiries about our services, appointments and the business.

We ask visitors not to provide detailed medical or health information through the contact form.

Information submitted through the form will be used to respond to the enquiry and will be handled in accordance with this Privacy Policy.

We may retain contact form submissions for a reasonable period where necessary to respond to an enquiry, maintain appropriate business records or deal with a subsequent client relationship.

Where an enquiry does not result in a client relationship and the information is no longer required, it will be deleted or securely disposed of in accordance with our data retention procedures.

13. AI-Assisted Clinical Documentation – Heidi Health

We may use Heidi Health, an AI-assisted clinical documentation platform, to assist with creating clinical notes during consultations.

Where Heidi Health is used:

  • You will be informed before it is used during your consultation.

  • Heidi may process information from the consultation to assist in generating clinical documentation.

  • Heidi is used as a documentation aid and does not replace professional clinical judgement.

  • Clinical notes generated using Heidi will be reviewed and approved by the practitioner before being incorporated into your clinical records.

  • You may withdraw your consent to the use of Heidi at any time.

Further information regarding Heidi Health's processing of personal information is available through its own privacy documentation.

14. International Transfers

Some of the third-party service providers we use may process or store information outside the United Kingdom.

Where personal information is transferred outside the UK, we will ensure that appropriate safeguards are in place as required by applicable UK data protection legislation.

The safeguards used may include adequacy regulations, standard contractual clauses or other lawful transfer mechanisms where applicable.

15. How We Protect Your Information

We take reasonable and appropriate technical and organisational measures to protect personal information against:

  • Unauthorised access

  • Loss

  • Accidental destruction

  • Unauthorised alteration

  • Unlawful disclosure

  • Other inappropriate use

Access to client information is limited to individuals and systems that reasonably require access for legitimate business, clinical or legal purposes.

No electronic storage or transmission system can be guaranteed to be completely secure. However, we take reasonable steps to reduce the risks associated with processing personal information.

16. How Long We Keep Your Information

Clinical and client records will normally be retained for 7 years from the date of the client's last treatment or contact, unless a longer retention period is required by law, professional requirements, insurance requirements or other applicable obligations.

This may include:

  • Assessment records

  • Clinical notes

  • Treatment records

  • Rehabilitation programmes

  • Consent forms

  • Relevant correspondence

  • Other information forming part of the client's clinical record

Financial and administrative information may be retained for different periods where required to meet legal, accounting or tax obligations.

Website contact form submissions and routine enquiries may be retained for different periods depending on their nature and purpose.

When information is no longer required, it will be securely deleted or otherwise disposed of appropriately.

17. Your Data Protection Rights

Depending on the circumstances, you have rights under UK data protection legislation including:

  • The right to be informed about how your information is used.

  • The right to access personal information we hold about you.

  • The right to request correction of inaccurate or incomplete information.

  • The right to request erasure of your information in certain circumstances.

  • The right to request restriction of processing in certain circumstances.

  • The right to object to certain processing.

  • The right to data portability in certain circumstances.

  • The right to withdraw consent where processing is based on consent.

These rights are subject to certain legal exemptions and limitations.

For example, information may need to be retained where there is a legal, professional, insurance or other lawful requirement to do so.

18. How to Exercise Your Rights

If you wish to exercise any of your data protection rights, please contact us through our [Contact Us] page.

We may need to verify your identity before providing access to personal information or making changes to your records.

We will respond to valid requests within the timeframe required by applicable data protection legislation.

19. Confidentiality

Information relating to your health, treatment and rehabilitation will be treated as confidential.

We will only disclose confidential information where:

  • You have provided appropriate consent;

  • Disclosure is necessary for your ongoing care and is lawful;

  • We are required to do so by law;

  • Disclosure is necessary to protect someone from serious harm; or

  • Another lawful basis for disclosure applies.

20. Children and Young People

Where services are provided to clients under the age of 18, additional information may be collected from or provided by a parent or legal guardian.

We will take appropriate steps to protect the personal information of children and young people in accordance with applicable data protection requirements.

21. Marketing

We may occasionally contact you about services, programmes, classes, offers or other information that may be relevant to you.

Where consent is required for marketing communications, we will obtain the appropriate consent before sending them.

You can withdraw your consent or opt out of marketing communications at any time.

Withdrawing marketing consent will not affect the provision of treatment, rehabilitation or other services you have requested.

22. Cookies and Website Analytics

Our website is operated using Squarespace and may use cookies and similar technologies.

Some cookies are necessary for the website to operate correctly, while others may be used for analytics or other purposes.

The specific cookies used may change over time depending on the functionality and services enabled on the website.

Where required, consent will be obtained before non-essential cookies are used.

Further information about the cookies used on the website will be provided through our cookie information or cookie consent mechanism.

23. Data Breaches

If we become aware of a personal data breach, we will assess the breach and take appropriate action in accordance with our legal and regulatory obligations.

Where required by law, we will notify the Information Commissioner's Office and/or affected individuals.

24. Complaints

If you have concerns about how we have collected or used your personal information, please contact us through our Contact Us page so that we can investigate and attempt to resolve your concerns.

You also have the right to complain to the Information Commissioner's Office (ICO) if you believe your personal information has not been handled appropriately.

Information about making a complaint can be obtained from the ICO website.

25. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our services, technology, legal requirements or how we process personal information.

The latest version will be published on our website.

Last updated: 19/08/2026

Equilibrium: Fitness and Rehabilitation Services
BASRaT Registered Sport Rehabilitator

Contact: Please use the Contact Us page on our website.