Skip to content

Privacy Policy

Last updated: 5 September 2026

1. Who we are

Nesly Pilates ("we", "us") runs a private Reformer Pilates studio in Crewe, Cheshire, and the booking website at www.nesly.co.uk. We are the data controller for the personal information described in this policy. Contact: pilates@nesly.co.uk, 07585 370 411.

2. What we collect

  • Account details: name, e-mail address, phone number, password (stored only as a secure hash by our authentication provider).
  • Health information (special category data): your answers to our health questionnaire, including injuries, medical conditions, pregnancy status, medication and emergency contact details. For duet sessions, the same information about your partner, which they provide themselves.
  • Booking and payment records: sessions booked, cancelled or attended, session credits, invoices and payments. Card details are entered directly with Stripe and never reach our servers.
  • Messages: anything you send us through the contact form, e-mail or WhatsApp.
  • Technical data: IP address, browser and device information in server logs, and, only if you accept analytics cookies, anonymised usage data from Microsoft Clarity.

3. Why we use it and our lawful basis

  • To run your bookings, credits and payments – performance of our contract with you (UK GDPR Art. 6(1)(b)).
  • Health information – to plan sessions that are safe for you and to respond appropriately in an emergency. We process it only with your explicit consent (Art. 9(2)(a)), which you give when you complete the health form. You can withdraw consent at any time by e-mailing us; we will then be unable to offer further sessions.
  • Service e-mails (confirmations, reminders, receipts, changes to your booking) – our contract with you and our legitimate interest in running the studio reliably (Art. 6(1)(f)).
  • Marketing – we only send news or offers if you have opted in; you can unsubscribe at any time.
  • Analytics cookies – your consent (PECR), given through the cookie banner.
  • Legal obligations – keeping financial records for HMRC (Art. 6(1)(c)).

4. Who we share it with

We never sell your data. We use the following processors, each bound by a data-processing agreement:

  • Supabase – database and authentication (hosted in London, UK).
  • Vercel – website hosting (global edge network; data processed in the EU/US under UK-approved transfer safeguards).
  • Stripe – card payments (Stripe Payments Europe Ltd, Ireland, and Stripe Inc., US).
  • Resend – transactional e-mails such as booking confirmations (US, UK-approved transfer safeguards).
  • Google Calendar – your name, phone number and session time are added to the instructor's private calendar so the studio schedule stays accurate. Health information is never sent to Google.
  • Microsoft Clarity – anonymised website analytics, only if you accept analytics cookies.

Where a processor is outside the UK we rely on the UK adequacy regulations or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.

5. How long we keep it

  • Account, booking and health information: while you are an active client and for 3 years after your last session, in line with the limitation period for personal-injury claims in England and Wales. It is then deleted or anonymised.
  • Invoices and payment records: 6 years after the end of the tax year, as required by HMRC.
  • Contact-form messages: up to 12 months.
  • Server logs: up to 30 days.

If you ask us to delete your account earlier we will do so, keeping only the financial records the law requires.

6. Security

Data is encrypted in transit (TLS) and at rest. Health information is visible only to the instructor and to you; every database table is protected by row-level security so one client can never see another's records. Access to the admin area is restricted to named accounts.

7. Cookies

  • Strictly necessary: the cookies that keep you signed in and remember your cookie choice. These do not need consent.
  • Analytics (optional): Microsoft Clarity records anonymised page usage (clicks, scrolling) to help us improve the site. It is loaded only after you choose "Accept analytics" and never for advertising.

You can change your choice at any time: .

8. Your rights

Under UK GDPR you can ask us to:

  • give you a copy of your data (access) and transfer it to you in a portable format;
  • correct anything inaccurate;
  • delete your data, or restrict how we use it;
  • stop processing based on legitimate interests or withdraw consent (including consent to health-data processing) at any time.

E-mail pilates@nesly.co.uk; we respond within one month. If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

9. Children

Our services are for adults aged 18 and over. We do not knowingly collect information from anyone younger.

10. Changes

We will post any changes here and update the date at the top. Significant changes will also be e-mailed to registered clients.

WhatsApp Book a session