Privacy Policy

Last updated: 31 July 2026

This privacy policy explains how I collect, use and protect your personal information when you visit this website, contact me, book a class or attend a Pilates session.

Who I am

This website is operated by Heidi Monsen, trading as Heidi Monsen Pilates. I am the data controller responsible for the personal information described in this policy.

Website: www.pilatesguildford.co.uk
Email: heidi@heidimonsen.co.uk
Telephone: 07887 916494
Location: Shalford, Guildford, Surrey, United Kingdom

Information I may collect

Depending on how you contact me or use my services, I may collect:

Your name, date of birth, postal address, email address and telephone number.
Your occupation, hobbies, sporting activities and Pilates experience.
Booking, attendance and payment information.
Details of an emergency contact.
Messages, enquiries and other correspondence.
Photographs, videos or testimonials, where you have agreed to their use.
Technical information about your use of the website, such as your IP address, browser, device and cookie information.

To help ensure that Pilates sessions are appropriate and safe, I may also collect health information, including:

Injuries, pain, restricted movement and relevant medical conditions.
Previous surgery, pregnancy or recent childbirth.
Medication that could affect your ability to exercise.
Information provided by a doctor, physiotherapist, osteopath or other practitioner, where you have authorised contact.
Your health, mobility and physical goals.

Health information is classed as “special category” personal data and receives additional protection under data protection law.

If you provide details of an emergency contact or another person, please make sure they are aware that you have supplied their information.

How I collect your information

I may collect information:

Directly from you through the website contact form, email, telephone or in person.
Through your client enrolment or health questionnaire.
Through Gymcatch when you create an account, make a booking or record a payment.
From a healthcare or other professional, but only where you have authorised this.
Automatically through cookies and similar website technologies.

How and why I use your information

I use personal information for the following purposes:

Enquiries and bookings

I use your contact details to answer enquiries, arrange sessions, administer bookings and communicate with you about classes. The lawful basis is taking steps at your request before entering into a contract and performing my contract with you.

Providing Pilates sessions

I use relevant information to manage your attendance, adapt sessions where appropriate and provide the service you have booked. The lawful basis is performance of a contract.

Health and safety

I use relevant health information to assess whether Pilates sessions are suitable for you and whether exercises need to be adapted. I rely on your consent and, for special-category health information, your explicit consent.

You may withdraw that consent, although I may then be unable to provide Pilates sessions safely. Withdrawal does not affect information already used lawfully before consent was withdrawn.

In an emergency, information may be used where necessary to protect your or another person’s vital interests.

Contacting a practitioner

I will only contact your doctor, physiotherapist, osteopath or another practitioner where you have given specific permission, unless there is a genuine emergency or I am legally required to do so.

Payments and financial records

I use transaction information to record payments, issue refunds and maintain tax and accounting records. The lawful bases are performance of a contract and compliance with legal obligations.

Payment card information entered through Gymcatch is handled by its selected payment provider. I do not receive or store your complete card details.

Business administration and legal claims

I may use records to manage the business, respond to complaints, maintain insurance records, prevent fraud or establish, exercise or defend a legal claim. The lawful bases are legitimate interests and, where appropriate, legal obligation. Health information needed for a legal claim may be processed under the legal-claims condition for special-category data.

Photographs and testimonials

I will only publish an identifiable photograph, video or testimonial where I have your permission. You may withdraw that permission for future use at any time.

Marketing

Service messages about a booking, cancellation or timetable change are not marketing.

If I send promotional emails or messages, I will do so only where you have agreed to receive them or where data protection and electronic-marketing law otherwise permits. You can unsubscribe at any time by contacting me or using the unsubscribe option provided.

Website operation and improvement

Technical information may be used to keep the website secure, understand how it is used and improve its performance. Where consent is required for cookies or similar technologies, they will not be used until that consent has been obtained.

Gymcatch and other service providers

Classes are booked through Gymcatch, which collects and processes information needed to manage accounts, bookings, attendance and payments. Gymcatch also has its own privacy policy, which applies when you use its website or app.

I may share information, where necessary, with:

Wix, which hosts this website and processes website contact-form submissions.
Gymcatch and the payment provider displayed during checkout.
Email, website, IT and secure-storage providers.
Accountants, bookkeepers, insurers and professional advisers.
Healthcare professionals, where you have authorised this.
Police, courts, regulators or other authorities where required by law.

These organisations may only use the information for the relevant service or legal purpose. I do not sell or rent personal information.

International transfers

Some website, technology or payment providers may process information outside the United Kingdom. Where this happens, I take reasonable steps to ensure that appropriate safeguards recognised under UK data protection law are in place, such as an adequacy decision or approved contractual protections.

How long information is kept

I keep personal information only for as long as it is reasonably needed:

Enquiries that do not lead to a booking are normally kept for up to 12 months after the last contact.
Client, attendance and health-and-safety records are normally kept for up to seven years after the final session, or longer where required by an insurer or in connection with a legal claim.
Financial and tax records are normally kept for six years after the relevant financial year.
Marketing details are kept until you unsubscribe or withdraw consent. A minimal record may then be kept to ensure that you are not contacted again.
Photographs and testimonials are kept while they remain in use or until permission is withdrawn.
Cookie and website information is retained according to the periods described in the separate cookie policy and the settings of the relevant service.

Information held by Gymcatch is also subject to Gymcatch’s retention policy.

Records are securely deleted or destroyed when they are no longer required.

Children’s information

Where a client is under 18, I require their parent or guardian to provide or approve the relevant personal and health information and to manage the booking. Information about a child will only be used to administer and safely provide the requested sessions.

Security

I take appropriate measures to protect personal information against accidental loss, unauthorised access, alteration or disclosure. Access is limited to those who reasonably need the information for the purposes described in this policy.

However, no internet or electronic-storage system can be guaranteed to be completely secure.

Your rights

Depending on the circumstances, you may have the right to:

Ask for a copy of the personal information held about you.
Ask for inaccurate or incomplete information to be corrected.
Ask for information to be deleted.
Ask for the use of your information to be restricted.
Receive certain information in a portable format.
Withdraw consent at any time.
Complain about how your information has been handled.

You also have the right to object to the use of your personal information where it is based on legitimate interests. You have an absolute right to object to its use for direct marketing.

Some rights are subject to legal exceptions. For example, information may need to be retained for tax, insurance or legal-claims purposes.

To exercise a right or raise a concern, contact:

heidi@heidimonsen.co.uk
07887 916494

Complaints

Please contact me first if you have a concern so that I can try to resolve it.

You may also complain to the Information Commissioner’s Office:

Website: www.ico.org.uk/make-a-complaint
Telephone: 0303 123 1113
Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Cookies and external websites

This website uses cookies and similar technologies. Further details should be provided on the separate Use of Cookiespage.

The website may link to Gymcatch, Facebook, Instagram and other external websites. Those organisations are responsible for their own privacy practices, and you should read their privacy policies when using their services.

Changes to this policy

I may update this policy if the website, services or legal requirements change. The latest version will be published on this page with its revision date.