Privacy & Cookie Policy

This policy explains how Perfection Clinic Ltd, trading as Rosae Fitness ("Rosae Fitness", "we", "us", "our") collects, uses, shares and protects your personal data when you visit our website, book a class, buy a class pack, order in our café, or contact us. We are committed to protecting your privacy and handling your data in line with the UK GDPR and the Data Protection Act 2018.

01Who we are & how to contact us

Perfection Clinic Ltd (trading as Rosae Fitness), registered in England & Wales under company no. 15534208 with its registered office at 7 Quixote Crescent, Rochester, England, ME2 3XB, is the data controller responsible for your personal data. We are a women-only fitness studio based in Rochester, Kent (Medway), also offering all-ages gymnastics and a wellness café.

• Email: RosaeAbrahams@Rosae-Fitness.co.uk
• Phone: 07415 329119
• Website: www.rosae-fitness.co.uk

If you have any questions about this policy or how we handle your data, please contact us using the details above.

02What personal data we collect

We only collect the data we need to provide our services safely. Depending on how you interact with us, this may include:

• Identity & contact details — your name, email address and phone number.
• Booking details — the classes, sessions or gymnastics slots you book, your attendance history, class packs and credits, and any preferences you tell us.
• Payment information — card payments are taken securely through our payment processor, Stripe. We do not see or store your full card number; we receive limited confirmation details (such as the payment result and last four digits) to manage your booking.
• Café / drink orders — items you order and any allergy or dietary information you give us.
• Health information — the answers you give in our health questionnaire / PAR-Q (Physical Activity Readiness Questionnaire), including injuries, medical conditions, pregnancy or post-natal status, and any emergency contact you provide. See section 4.
• Messages & enquiries — the content of messages you send us by email, WhatsApp, Instagram, our website or our messaging/booking tools.
• Technical & usage data — where you consent to analytics cookies, information such as your device type, browser, pages viewed and how you found us (see Cookies).

03How we use your data & our lawful bases

Under UK GDPR we must have a "lawful basis" for each use of your data. The table below sets out what we do and why.

Where we rely on consent, you can withdraw it at any time (for example, unsubscribe from marketing or reject analytics cookies) without affecting the lawfulness of processing before you withdrew it.

04Health & special category data

Health information is "special category data" under Article 9 of the UK GDPR and is given extra protection. We collect it so we can advise you safely, adapt exercises, and respond appropriately in an emergency — for example if you disclose an injury, a medical condition, or that you are pregnant or post-natal.

We rely on your explicit consent to process this information (given when you complete our health questionnaire / PAR-Q), and, where necessary to protect your life or someone else's, on vital interests. We keep health information to the minimum needed, share it only with the coach delivering your session, and store it securely. You can ask us to update it at any time, and it is important that you keep it accurate.

05Who we share your data with

We do not sell your personal data. We share it only with trusted service providers ("processors") who help us run the studio, and only as far as needed. These currently include:

• Stripe — secure card payment processing.
• Cloudflare — website hosting, security, and our booking database and storage (Cloudflare D1 and KV).
• Meta (Facebook/Instagram), WhatsApp & ManyChat — messaging, enquiries and booking follow-ups where you contact us through those channels.
• Apple / iCloud (CalDAV) — calendar scheduling of your bookings.
• Google — reviews and, only if you accept analytics cookies, website analytics.

Each provider processes your data under contract and their own privacy terms. We may also disclose data where required by law, to protect our legal rights, or in connection with a sale or reorganisation of the business.

06International transfers

Some of our providers (such as Stripe, Cloudflare, Google and Meta) may process data on servers outside the UK. Where they do, we rely on appropriate safeguards recognised under UK data protection law — such as UK "adequacy" regulations or the International Data Transfer Agreement / Addendum and Standard Contractual Clauses — so that your data stays protected to UK standards.

07How long we keep your data

We keep personal data only for as long as we need it:

• Booking and account data — for the duration of your relationship with us and generally up to 2 years after your last activity, so we can manage credits and answer queries.
• Health / PAR-Q information — for as long as you train with us and a reasonable period afterwards, then securely deleted.
• Payment & accounting records — up to 6 years, to meet UK tax and accounting requirements.
• Marketing preferences — until you unsubscribe or ask us to stop.

When we no longer need your data, we securely delete or anonymise it.

08How we protect your data

We use appropriate technical and organisational measures to keep your data safe, including encryption in transit (HTTPS), access controls, using reputable processors, and limiting who can see health information. No system is completely secure, but we take reasonable steps to protect against unauthorised access, loss or misuse, and we will notify you and the ICO where we are legally required to in the event of a data breach.

09Your rights

Under UK data protection law you have the right to:

• Be informed about how we use your data (this policy).
• Access a copy of the data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — ask us to delete your data ("right to be forgotten"), where applicable.
• Restrict or object to certain processing.
• Data portability — receive certain data in a portable format.
• Withdraw consent at any time where we rely on consent.

To exercise any of these rights, contact us using the details in section 1. We will respond within one month. There is normally no charge, and we may need to verify your identity first.

10Children's data & safeguarding

Our fitness classes are for adults. Our gymnastics classes are open to children. Where a participant is under 18, we take the booking and health information from, and rely on the consent of, a parent or guardian, who remains responsible for the child. We collect only what we need to keep children safe and deliver the session, hold it securely, and handle it in line with our safeguarding responsibilities. Parents/guardians can access, correct or ask us to delete their child's data at any time.

11Cookies

Cookies are small files stored on your device. We use them in line with the Privacy and Electronic Communications Regulations (PECR) and UK GDPR. When you first visit, our banner lets you accept or reject non-essential cookies, and we remember your choice. You can change it at any time by clearing your browser storage for this site.

Strictly necessary cookies (always on)

These are essential to run the site and cannot be switched off — for example remembering your booking basket, keeping the checkout session working, and keeping the site secure. They do not require consent.

Analytics cookies (only with your consent)

If you accept, we may use analytics (such as Google Analytics 4) to understand how visitors use the site so we can improve it. These load only after you consent. If you reject, no analytics or marketing cookies are set. Any marketing/tracking from messaging tools (e.g. ManyChat/Meta) is likewise gated behind your consent.

12Changes to this policy & how to complain

We may update this policy from time to time. The "last updated" date at the top shows when it last changed; where changes are significant, we will make this clear.