Ver. 1.0

Privacy Policy

This Privacy Policy explains how SSC Scheduling, operated by So Slay Collective Ltd (“SSC”), and the relevant Lavender on the Hill treatment provider collect, use, store and protect your personal information when you use the Platform, create an account, make a booking, purchase a package or voucher, complete consultation forms, or receive treatment.

We are committed to protecting your privacy and handling your information in accordance with applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. WHO WE ARE

SSC Scheduling (“the Platform”) is operated by:

So Slay Collective Ltd

• Company Number: [INSERT]
• Registered Office: [INSERT]

The Platform provides booking, account management, package, voucher, consultation and communication services.

Treatment services are provided by the relevant Lavender on the Hill location selected during the booking process.

Depending on the circumstances, SSC and the relevant treatment provider may act as Data Controllers in relation to your personal information.

2. INFORMATION WE COLLECT

We may collect the following information:

Personal Information

• Full name
• Date of birth
• Address
• Email address
• Telephone number
• Occupation

Account Information

• Login credentials
• Appointment history
• Package information
• Voucher information
• Account preferences

Booking Information

• Appointment details
• Therapist details
• Location details
• Attendance records
• Cancellation records
• Service history

Payment Information

• Transaction references
• Payment status
• Payment provider references
• Saved payment tokens (where you choose to save a payment method)
• SSC and Lavender on the Hill do not store full payment card details.

Health Information

To provide services safely, we may collect:

• Medical history
• Current medical conditions
• Medications
• Allergies
• Pregnancy information
• Injury history
• Consultation forms
• Treatment objectives
• Treatment notes
• Clinical observations
• Other health information voluntarily provided by you

Health information is classified as Special Category Data under UK GDPR.

3. HOW WE COLLECT INFORMATION

Information may be collected when you:

• Create an account
• Make a booking
• Purchase a voucher
• Purchase a package
• Complete a consultation form
• Contact us
• Attend an appointment
• Communicate with our team
• Use the Platform

Information may also be collected automatically through the operation of the Platform.

4. WHY WE USE YOUR INFORMATION

We use your information to:

• Manage appointments
• Deliver treatments and services
• Assess treatment suitability
• Process payments
• Manage packages and vouchers
• Maintain treatment records
• Communicate regarding appointments
• Respond to enquiries
• Improve services and Platform functionality
• Comply with legal and regulatory obligations
• Protect the health and safety of clients and practitioners

5. LEGAL BASIS FOR PROCESSING

We process information under one or more of the following legal bases:

Contract

To provide bookings, accounts, vouchers, packages and related services.

Legitimate Interests

To operate, secure and improve our business and the Platform.

Legal Obligations

To comply with accounting, taxation, regulatory and legal requirements.

Provision of Health Services

Where health information is processed in connection with treatment, assessment or record keeping.

Consent

Where consent is specifically requested, including consultation forms and certain communications.

6. WHO WE SHARE INFORMATION WITH

We may share information with:

Practitioners

Relevant practitioners who require access to safely deliver treatment.

Payment Providers

Including TakePayments and other authorised payment providers.

Communication Providers

Including providers used to deliver:

• Email confirmations
• Appointment reminders
• SMS notifications
• WhatsApp notifications

This may include Twilio and associated service providers.

Technology Providers

Hosting, infrastructure, support and software providers assisting in the operation of the Platform.

Professional Advisers

Including accountants, insurers, legal advisers and other professional advisers where necessary.

Regulators & Authorities

Where required by law, safeguarding obligations, regulation or court order.

We do not sell your personal information.

7. TREATMENT RECORDS & THERAPIST NOTES

Practitioners may create professional records including:

• Consultation information
• Assessment findings
• Treatment notes
• Clinical observations
• Recommendations
• Aftercare advice

These records form part of your client record.

Therapist notes are not generally visible within the client dashboard.

8. UNDER-18 CLIENTS

Appointments for clients under 18 should be arranged by a parent or legal guardian.

Where required, consultation forms and consent documentation must be completed by a parent or legal guardian.

Additional safeguarding procedures may apply.

9. DATA RETENTION

We retain information only for as long as reasonably necessary.

Typical retention periods include:

Treatment Records

8 years following your last appointment.

Records Relating To Children

Until the client reaches age 25, or for 8 years following the last appointment, whichever is longer.

Financial Records

At least 6 years.

Account Information

For as long as reasonably necessary to operate the Platform and maintain associated records.

We may retain information for longer where required by law, insurance obligations, safeguarding requirements or legal claims.

10. YOUR RIGHTS

Subject to applicable law, you may have the right to:

• Access your information
• Correct inaccurate information
• Request deletion of information
• Restrict processing
• Object to processing
• Request transfer of information
• Withdraw consent where applicable

11. DELETION REQUESTS

Clients may request deletion of personal information.

However, SSC and the relevant treatment provider may be required to retain certain records where necessary for:

• Legal obligations
• Professional obligations
• Insurance purposes
• Safeguarding requirements
• Defence of legal claims

Some information may therefore be retained even where a deletion request has been made.

12. DATA SECURITY

We implement appropriate technical and organisational measures designed to protect information against:

• Unauthorised access
• Loss
• Misuse
• Alteration
• Disclosure

While reasonable steps are taken to protect information, no system can guarantee absolute security.

13. COMMUNICATIONS

We may send service-related communications including:

• Booking confirmations
• Appointment reminders
• Appointment changes
• Account notifications
• Voucher notifications
• Package notifications

These communications are necessary to provide our services.

We do not currently send marketing communications through the Platform.

Should marketing communications be introduced in future, appropriate consent and opt-out mechanisms will be provided.

14. COOKIES

The Platform uses cookies and similar technologies to support functionality, security and performance.

Further information can be found in our Cookie Policy.

15. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time.

The latest version will always be available through the Platform.

Continued use of the Platform following publication of an updated Privacy Policy constitutes acceptance of those changes.

16. CONTACT US

If you have questions regarding this Privacy Policy or your personal information, please contact us using the contact details provided on our website.

17. COMPLAINTS

If you are unhappy with how your information has been handled, please contact us in the first instance.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO):
www.ico.org.uk