Client and Website Privacy Notice

Effective date: 20 September 2026

This privacy notice explains how Vitalis Performance & Wellness collects, uses, stores and shares personal information when you enquire, book, complete a health questionnaire, receive sports therapy, rehabilitation, sports massage or personal training, or use this website. It also explains your data-protection rights.

Health information receives additional protection under UK data-protection law. We only collect information that is relevant to providing safe and appropriate services, maintaining suitable records and operating the clinic.

1. Who is responsible for your information?

Vitalis Performance & Wellness is the data controller for personal information collected through this website and in connection with clinic services. This means that Vitalis decides why and how your information is used.

Questions or requests about your information can be sent to:

Email: hello@vitalisperformancewellness.co.uk
Telephone: 07989 302 871
Ringwood clinic: 8 Market Place, Ringwood, BH24 1AW

2. Information we collect

Depending on how you contact us and the services you receive, we may collect:

• Your name, date of birth, address, telephone number and email address.
• Parent or guardian details where the client is a child or young person.
• Emergency-contact details that you choose to provide. You should tell the emergency contact that you have given us their details.
• Appointment details, attendance history and communications with Vitalis.
• Health information relevant to assessment, treatment, rehabilitation or exercise, including symptoms, medical and injury history, medication, contraindications, assessment findings, treatment notes and outcomes.
• Exercise, rehabilitation and personal-training information, including goals, plans, measurements and progress.
• Clinical photographs or videos where they are useful and you have been informed about their purpose.
• Payment, invoice and transaction information. Card details are handled by the relevant payment provider and are not normally stored directly by Vitalis.
• Information you provide through enquiry forms, email, telephone, Cliniko or in person.
• Technical website information such as browser, device, approximate location, pages visited and cookie choices, where applicable.

Most information is provided directly by you. We may also receive relevant information from a parent or guardian, a person acting with your authority, another healthcare professional, an insurer or a referral source.

3. How we use personal information

We may use personal information to:

• Respond to enquiries and provide information you request.
• Arrange, confirm, change and manage appointments.
• Assess suitability for services and provide safe, appropriate care.
• Record assessments, treatment, rehabilitation and exercise plans.
• Communicate with you about appointments, care and relevant follow-up.
• Respond appropriately to an accident, medical emergency or safeguarding concern.
• Process payments, issue receipts and maintain accounting records.
• Operate, secure and improve the website and booking process.
• Meet legal, insurance, safeguarding and professional record-keeping obligations.
• Establish, exercise or defend legal claims where necessary.

4. Lawful bases for processing

Under UK data-protection law, the lawful basis depends on why information is being used. This may include:

• Contract: to arrange and provide services you request.
• Legal obligation: to meet tax, accounting, safeguarding or other legal duties.
• Legitimate interests: to operate the clinic, respond to enquiries, maintain security and manage the business, provided those interests do not override your rights.
• Consent: where you have made a clear choice, including optional analytics, direct marketing, promotional photographs or another genuinely optional use.
• Vital interests: in exceptional circumstances where processing is needed to protect someone’s life.

Health information is special-category data. Where applicable, we process it because it is necessary to provide and manage health-related care or treatment by a practitioner who owes a duty of confidentiality. We may also process relevant health information where necessary to establish, exercise or defend legal claims, to protect vital interests in a medical emergency, with explicit consent where that is the appropriate condition, or under another condition permitted by law.

Your acknowledgement that you have read this notice is not treated as consent for every use of your information. Where we rely on consent for an optional purpose, we will ask separately and you may withdraw that consent at any time.

5. Cliniko bookings and clinical records

Vitalis uses Cliniko to manage bookings, health questionnaires, client contact details, appointments, communications and clinical records. Cliniko processes this information on behalf of Vitalis as a data processor. Vitalis remains responsible for deciding how and why your client information is used.

Cliniko states that information for UK accounts is stored in the United Kingdom, encrypted in transit and at rest, and backed up regularly. Cliniko may use approved subprocessors to help provide its service. Appropriate contractual and data-protection safeguards are used where processing involves another country.

Before submitting the health questionnaire, you will be asked to confirm that you have read and understood this notice. The questionnaire also asks you to confirm that the information supplied is accurate and that you will tell us about relevant changes. These confirmations help us maintain safe and accurate records; they are not marketing consent.

Please avoid entering unnecessary medical details into general website enquiry fields. Relevant health information should be provided through the Cliniko questionnaire or discussed with your practitioner.

6. Website hosting, email and other service providers

We may use trusted suppliers to provide website hosting, email, booking, payment, accounting, analytics, IT support and professional services. These providers may process personal information only where needed to supply their services and are expected to use appropriate safeguards.

The website is hosted through Hostinger. Some service providers may store or process information outside the United Kingdom. Where this occurs, appropriate legal safeguards should be used, such as adequacy regulations or approved contractual protections.

7. Cookies and analytics

The website may use essential cookies required for security and basic operation. Optional analytics or similar technologies should only be used after consent where required. You can manage your choices through the cookie banner and read more in the Cookie Policy · Accessibility.

7A. Website measurement tools

With your consent, Vitalis may use Google Tag Manager, Google Analytics 4 and Microsoft Clarity. These services help measure website use, traffic sources, page views, clicks, scrolling and general interaction patterns. Microsoft Clarity may provide heatmaps and session recordings. Sensitive clinical information should not be entered into general website fields, and the secure Cliniko booking system is used for appointment information.

You can reject optional analytics and continue using the website. Your choice can be changed using the “Privacy & Cookies” link in the footer.

8. Sharing personal information

Vitalis does not sell or rent personal information. Information may be shared only where reasonably necessary, including with:

• Cliniko and other suppliers supporting appointments and clinic administration.
• Payment processors, accountants, insurers, legal advisers or IT providers.
• Your GP, another healthcare professional, an insurer or another third party where you ask or authorise us to share information, or where another lawful basis applies.
• Emergency services, safeguarding bodies, regulators or public authorities where disclosure is required or permitted by law.

9. Retention

Information is retained only for as long as reasonably necessary for the purpose for which it was collected and to meet legal, insurance and professional requirements. Clinical and training records are kept in accordance with the requirements that apply to the service, the client's age, Vitalis's insurer and any relevant professional guidance. A record may be kept longer where there is an ongoing complaint, safeguarding matter, legal claim or another lawful reason.

Financial and tax records are normally retained for the period required by HM Revenue & Customs. Unsuccessful or general enquiries are normally deleted sooner when they are no longer needed. Marketing preferences are retained until you unsubscribe or we determine that the record is no longer required.

10. Security

Reasonable organisational and technical measures are used to protect personal information, including secure systems, access controls, unique user accounts, strong passwords, multi-factor authentication where available, device security, confidentiality requirements and limiting access to people who need the information for their role. No internet transmission or storage system can be guaranteed completely secure, but appropriate steps are taken to reduce risk.

If a personal-data breach occurs, Vitalis will investigate it, take appropriate action and notify the Information Commissioner's Office and affected individuals where the law requires this.

11. Your data-protection rights

Depending on the circumstances, you may have the right to:

• Ask for a copy of the personal information held about you.
• Ask for inaccurate or incomplete information to be corrected.
• Ask for information to be erased where the law allows.
• Ask for processing to be restricted.
• Object to processing based on legitimate interests or direct marketing.
• Receive certain information in a portable format.
• Withdraw consent at any time where processing relies on consent.
• Complain to the Information Commissioner's Office.

Some rights are subject to legal exceptions, including the need to retain clinical, financial or legal records. We may need to confirm your identity before responding. Vitalis does not make decisions about your care or access to services solely through automated decision-making.

12. Information required to provide services

We need sufficient identity, contact and relevant health information to assess suitability, provide services safely and maintain appropriate records. You do not have to provide information, but if relevant information is withheld we may be unable to provide treatment or training safely. Optional marketing and promotional permissions are never a condition of receiving services.

13. Complaints

Please contact Vitalis first so that concerns can be addressed. You also have the right to complain to the Information Commissioner's Office, the UK regulator for data protection. Information about making a complaint is available at ico.org.uk/make-a-complaint.

14. Third-party websites

This website may link to third-party websites. Those organisations are responsible for their own privacy practices, and you should review their privacy information before submitting personal data.

15. Changes to this notice

This notice may be updated when services, suppliers, legal requirements or business practices change. The effective date at the top of this page will be updated when material changes are made. Where appropriate, we will draw significant changes to the attention of existing clients.