Legal

Privacy policy

Last updated 8 September 2026

This policy explains what personal information Mourad Massage Therapy collects about you, why, who else handles it, how long it is kept, and the rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Who is responsible for your information

The data controller is Mohamed Mourad, trading as Mourad Massage Therapy, a sole trader operating from a private studio at 230 Belsize Road, London NW6 4BT, and travelling to clients across London.

For anything about your information or this policy, contact:

There is no separate data protection officer; the controller deals with these requests directly.

What is collected

When you book or enquire — by the website form, WhatsApp, phone, text or email — your name, phone number, email address if you give one, the studio or the address and postcode for a mobile visit, your preferred date and time, the treatment and length, and anything you tell the therapist about injuries, health conditions, pregnancy, recent surgery or medication.

During and after a treatment — a brief written record of the consultation and the work done, kept so that repeat appointments can build on the last and so there is a record if a question arises later.

Payments — the amount, date and method. Card payments are handled by the card terminal or its provider; card numbers are not seen or stored by the therapist. Bank transfers show the name on the sending account.

When you visit this website — the site sets no cookies and runs no analytics (see Cookies and tracking below). The company that hosts the site keeps standard server logs — your IP address, the time of the request, the page and your browser type — for security and to keep the site running. The studio page loads a map from OpenStreetMap; opening that page sends your IP address to OpenStreetMap so the map can load. No other page contacts a third party.

Why it is collected, and the lawful basis

Your information is used only for the purposes below. It is never sold, and it is not used for marketing.

  • Arranging, confirming and delivering your appointment — including travelling to the right address and adapting the treatment to what you disclose. Lawful basis: performance of a contract with you (UK GDPR Article 6(1)(b)).
  • Replying to an enquiry that does not lead to a booking — Lawful basis: legitimate interests (Article 6(1)(f)): responding to someone who has contacted the business. You can object to this at any time.
  • Keeping accounting and tax records of payments received. Lawful basis: legal obligation (Article 6(1)(c)), under the Companies Act and HMRC rules.
  • Keeping a treatment record and handling a complaint, claim or insurance matter. Lawful basis: legitimate interests (Article 6(1)(f)): being able to show what treatment was given and to defend a claim.

Health information

Information about injuries, health conditions, pregnancy, recent surgery or medication is special category data under UK GDPR Article 9. It is collected only to decide whether a treatment is suitable and to carry it out safely. The condition relied on for processing it is your explicit consent (Article 9(2)(a)), given when you disclose it for that purpose; where a treatment record is later needed to establish, exercise or defend a legal claim, Article 9(2)(f) also applies.

You can decline to give health information, or withdraw your consent later by contacting the therapist. If information needed to make a treatment safe is withheld, some treatments may not be offered.

Who else processes your information

A small number of service providers process personal data on the controller's behalf, under contract and only on instructions:

  • FormSubmit (formsubmit.co) — delivers submissions from the website booking form by email. FormSubmit is operated from the United States.
  • WhatsApp and Meta Platforms — carry messages if you choose to book or enquire that way, under WhatsApp's own terms and privacy policy. Meta is based in the United States and Ireland.
  • The website hosting provider — stores and serves the website files and keeps the server logs described above.
  • OpenStreetMap Foundation — serves the map embedded on the studio page only, when that page is opened. The OpenStreetMap Foundation is based in the United Kingdom.
  • The mobile network and email provider used for calls, texts and email.
  • If website analytics are ever added, this list and the Cookies section will be updated first and a consent banner introduced.

Transfers outside the UK. Where a provider is in the United States (FormSubmit, Meta), the transfer is made under the safeguards in UK GDPR Article 46 — the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, and, where the provider is certified, the UK Extension to the EU–US Data Privacy Framework. You can ask for details of the safeguard relied on.

How long it is kept

  • Treatment records (consultation notes and health information) — kept for seven years after your last appointment, in line with professional-body and insurer guidance, then securely deleted. For a client under 18, records are kept until their 25th birthday.
  • Booking and contact details for clients — kept for the same seven years alongside the treatment record.
  • Enquiries that do not lead to a booking — deleted within 12 months.
  • Accounting records (payments, invoices) — kept for six years plus the current tax year, as HMRC requires.
  • WhatsApp and text message threads — kept on the phone for up to two years, then deleted.
  • Website server logs — kept by the hosting provider for a short period, typically under 30 days.

You can ask for your information to be deleted sooner; see your rights below.

Your rights

Under UK GDPR you have the right to:

  • be informed about how your data is used — this policy;
  • access a copy of the personal data held about you;
  • rectification — have inaccurate data corrected;
  • erasure — have data deleted, where there is no overriding legal reason to keep it (accounting records and, usually, treatment records must be kept for the periods above);
  • restriction — have processing paused while a concern is resolved;
  • object to processing based on legitimate interests;
  • data portability — receive the data you provided in a common electronic format;
  • withdraw consent to the use of health information at any time, without affecting what was done before.

To exercise any of these, contact elsayedmourad72@yahoo.co.uk or +44 7438 427434. A response is given within one month. There is no charge unless a request is clearly excessive.

Complaints

If you are not satisfied with how your information has been handled, you can complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, or call the ICO helpline on 0303 123 1113. Raising it with the therapist first is welcome but not required.

Cookies and tracking

This website sets no cookies and uses no analytics or tracking of any kind. Nothing is stored in your browser. The only third-party request any page makes is the OpenStreetMap map on the studio page, described above, and it loads only when that page is opened. If analytics are added in future, this policy will be updated and a consent banner will be shown before any non-essential cookie or tracker is set.

Changes to this policy

If this policy changes, the new version replaces this one here and the "last updated" date at the top changes. Material changes affecting existing clients will be mentioned at the next appointment or by message.