PRIVACY POLICY

1. About this Privacy Policy

This Privacy Policy explains how Cristina Massage Yoga Mindfulness collects, uses, stores and protects personal information when providing massage, mindfulness, yoga-informed movement and related services. It is intended to explain clearly how information about clients is handled and what rights clients and relevant representatives have in relation to their personal information. I aim to handle personal information respectfully, securely and only where it is relevant and necessary for the servicesI provide.

2. Who I am

Cristina Massage Yoga Mindfulness is a sole-trader practice operated by Cristina Gri.I provide massage and wellbeing services to adults and to children and adults with complex needs, including people who may communicate primarily or entirely through non-verbal communication. For data protection purposes, I am responsible for deciding how and why personal information is used in connection with my services. If you have any questions about this Privacy Policy or how I use personal information, please contact me at:

Email: cristina@cristinamassage.com

3. What information I collect

Depending on the circumstances, I may collect and keep information such as:

• the client's name and date of birth;

• contact details where relevant;

• information about the person completing forms or providing consent;

• information about the client's communication methods, including verbal and non-verbal communication;

• information about how the client communicates agreement, refusal or a wish to stop;

• information about health conditions, diagnoses, injuries, medication and relevant medical history;

• information about mobility, positioning, sensory needs and responses to touch;

• information about allergies, skin sensitivities and other relevant safety considerations;

• professional recommendations or restrictions relevant to massage;

• information about the client's preferences, goals and expectations;

• consent records;

• initial clinical assessment information;

• observations made during massage sessions;

• information about the client's responses, comfort, communication and participation during sessions; and other information that is relevant and necessary to provide massage safely and appropriately.

I aim to collect only information that is relevant and necessary for the purpose for which it is being collected.

4. Information about health and disability

Some information I collect is health information or other information that may be considered special category personal data under UK data protection law.

This may include information about:

• physical or neurological conditions;

• disabilities and complex needs;

• medication where relevant to massage;

• epilepsy or seizures;

• bone fragility;

• mobility and positioning;

• sensory needs;

• skin conditions or sensitivities; 

• other information that may affect how massage can be provided safely.

I only collect and use this type of information where it is relevant to providing, documenting or managing the client's services and where there is an appropriate lawful basis and additional legal condition for processing it.

5. Where information comes from

Information may be provided directly by the client or by someone acting on their behalf. Depending on the client's circumstances, information may also be provided by:

• a parent or guardian;

• a person with appropriate authority to provide information or consent;

• a teacher or teaching assistant;

• a support worker or carer;

• a residential or educational organisation;

• a healthcare or other relevant professional;

• another person involved in supporting the client.

I may also create information myself through professional observation and clinical record-keeping during assessments and massage sessions. Where information is obtained from someone other than the client, I aim to handle it appropriately and provide relevant privacy information in accordance with data protection requirements.

6. Why I use personal information

I use personal information where necessary to:

• provide massage and related services safely and appropriately;

• understand the client's individual needs, communication and preferences;

• assess how massage should be adapted;

• identify relevant precautions or restrictions;

• record the client's participation and responses;

• maintain accurate professional records;

• monitor changes that may affect the provision of massage;

• communicate with clients, parents, guardians, authorised representatives or relevant organisations where appropriate;

• support periodic reviews or reviews of the client's support;

• provide relevant information or evidence where this is required to support or review funding;

• meet professional, legal and insurance responsibilities;

• respond to complaints, concerns or incidents;

• establish, exercise or defend legal claims where necessary; and

• protect the safety and wellbeing of the client or others where this is necessary.

I do not use client information for unrelated purposes unless there is an appropriate lawful basis for doing so.

7. Lawful basis for using information

UK data protection law requires me to have a lawful basis for using personal information and an additional condition when I process special category information, such as health information. I use the lawful bases and special category conditions that apply to the particular purpose for which information is being processed, including providing and documenting services, maintaining professional records, and meeting legal, professional and insurance responsibilities. My detailed assessment of the lawful bases I use is documented separately within my Clinical Documentation System.

Consent to massage is separate from the data protection lawful basis for processing personal information. Signing the Massage Consent Form does not, by itself, determine the lawful basis on which I process personal information.

8. Client voice, communication and choice

I recognise that clients communicate in different ways and that communication does not always involve speech. Where appropriate, I record information about how the client communicates:

• agreement or a YES;

• refusal, NO or STOP;

• comfort and enjoyment;

• discomfort, distress or overwhelm; 

• changes in response during interaction or massage.

The client's verbal and non-verbal communication is considered when providing and adapting massage. A client may communicate a wish not to participate, to change something or to stop through words, sounds, gestures, eye gaze, facial expression, movement, changes in muscle tone, withdrawal or other established forms of communication.

I aim to respect the client's communication, choices and boundaries throughout the service.

9. Who may receive information

I treat client information as confidential. I may share relevant information where this is necessary and lawful, for example:

• with the client or their authorised representative;

• with a parent, guardian or person with appropriate authority, where applicable;

• with an organisation involved in commissioning or supporting the client's care or service, where there is an appropriate lawful basis and the information is relevant — for example, as part of a periodic review, review of the client's support, or to provide evidence relevant to funding;

• with relevant healthcare or other professionals where information needs to be shared appropriately and lawfully;

• with my insurer or professional advisers where reasonably necessary;

• with professional or regulatory bodies where required;

• where disclosure is required by law or is necessary to protect someone from serious harm.

I do not routinely share full clinical records. Where information is shared with an organisation or professional, I aim to share only information that is relevant and necessary for the particular purpose.

10. Confidentiality

I treat information about clients as confidential and take reasonable steps to prevent unauthorised access, use or disclosure. I will not normally disclose confidential client information to another person or organisation without an appropriate lawful basis.

There may be circumstances where information needs to be disclosed without the client's permission, for example where disclosure is required by law or where it is necessary to protect someone from serious harm.

Where information needs to be shared for professional, organisational or funding purposes, I aim to share only the information that is relevant and necessary for that purpose.

11. How information is stored and protected

I use secure cloud-based services, including Google Workspace, to collect, store and manage relevant client information.

My Clinical Documentation System uses Google Workspace services, including Google Forms, Google Sheets and Google Docs, to support:

• Initial Clinical Profiles;

• Massage Consent records;

• Initial Clinical Assessments;

• ongoing Session Records.

For information processed through Google Workspace, I am the data controller and Google acts as a data processor for the relevant customer data. Google's Cloud Data Processing Addendum applies to these services.

Google states that Customer Data may be processed in countries where Google or its subprocessors have facilities.

Where UK data protection law requires safeguards for an international transfer, the applicable contractual or other lawful safeguards are used.

I use security measures appropriate to the sensitivity of the information, including access controls and two-step verification. Google also describes technical, organisational and physical security measures for Customer Data.

I aim to collect only information that is relevant and necessary for the purposes described in this Privacy Policy.

12. How long I keep records

I keep client records for as long as necessary to meet my legal, professional and insurance responsibilities.

As a member of the Complementary and Natural Healthcare Council (CNHC), I follow its current guidance on record retention. This currently requires client records to be kept safely for 8 years from the date of the client's last visit. For children, CNHC currently states that records should be retained until the client's 25th birthday, or 26th birthday if the client was 17 when treatment ended. My insurance arrangements also require appropriate records to be retained. I therefore retain records in accordance with the longest applicable professional, insurance or legal requirement. For vulnerable adults, records may need to be retained beyond the usual minimum period where limitation periods may be extended.

When records are no longer required, I will securely delete or dispose of them.

13. Your data protection rights

Under UK data protection law, you may have rights in relation to the personal information I hold about you or the client, depending on the circumstances.

These may include the right to:

• ask for a copy of personal information I hold;

• ask for inaccurate or incomplete information to be corrected;

• ask for information to be deleted where there is no legal or legitimate reason for me to continue keeping it;

• ask me to restrict how I use information in certain circumstances;

• object to certain uses of information;;

• ask for your information to be provided in a usable format in certain circumstances.

These rights are not absolute and may depend on the circumstances and the legal basis on which I am using the information.

If you would like to exercise a data protection right or ask how I use your information, please contact me at cristina@cristinamassage.com.

You also have the right to complain to the Information Commissioner's Office (ICO) if you are concerned about how your personal information has been handled.

14. Withdrawing consent

Where I rely on consent for a particular use of personal information, you can withdraw that consent at any time.

Withdrawing consent does not affect anything I have already done lawfully using your information before consent was withdrawn.

If you withdraw consent to massage, or the client or their authorised representative asks for massage sessions to stop, I will respect this and will not continue providing massage without an appropriate basis to do so.

Some information may still need to be retained after consent is withdrawn where I have a legal, professional or insurance requirement to keep it.

If you have any questions about withdrawing consent or how this affects the client's records, please contact me at cristina@cristinamassage.com.

15. Complaints

If you have a concern about how I have handled your personal information, please contact me first at cristina@cristinamassage.com so that I can try to resolve the issue.

You also have the right to complain to the Information Commissioner's Office (ICO) if you are concerned about howyour personal information has been handled.

Information about how to contact the ICO is available on its website.

16. Changes to this Privacy Policy

I may update this Privacy Policy from time to time to reflect changes in my services, how I use personal information, legal or professional requirements, or the systems I use to manage client information.

The current version will be made available alongside my services and will show the date it was last updated.

Where a significant change affects how client information is used or protected, I will take appropriate steps to make clients or relevant representatives aware of the change.

Last updated: September 2026