Privacy Policy
Last updated: May 2026
This policy explains what personal data Achilles Clinic collects from you, why we collect it, how we use it, and what rights you have. It applies to all clients and visitors of achillesclinic.co.uk.
1. Who We Are
Achilles Clinic is operated by Achilles Triumph Ltd, a company registered in England and Wales. We are the data controller for the personal data collected through this website and our booking system.
- Business name: Achilles Triumph Ltd, trading as Achilles Clinic
- Address: 260 Pentonville Road, London, N1 9JY, United Kingdom
- Email: info@achillesmethod.co.uk
- Website: achillesclinic.co.uk
2. What Data We Collect and Why
2.1 Booking and Contact Information
What: Your name, email address, phone number, and the service you have requested.
Why: To confirm your appointment, send booking reminders, and communicate with you about your session.
Lawful basis: Performance of a contract (Article 6(1)(b) UK GDPR).
2.2 Health and Medical Information
What: Medical history, current symptoms, medications, injuries, and other health information you provide via our intake form or during your session.
Why: To assess suitability for treatment, ensure safe delivery of soft tissue therapy, and maintain accurate clinical records.
Lawful basis: This is special category data under UK GDPR Article 9. We process it on the basis of your explicit consent (Article 9(2)(a)), and where necessary for the provision of health care (Article 9(2)(h)) under Schedule 1, Part 1(2) of the Data Protection Act 2018.
2.3 Payment Information
What: Payment card details are processed by Stripe, our payment provider. We do not store card numbers on our systems.
Why: To process payments for services.
Lawful basis: Performance of a contract (Article 6(1)(b) UK GDPR).
2.4 Marketing Preferences
What: Your email address, if you opt in to receive marketing communications.
Why: To send you clinical content, clinic updates, and promotional offers via Mailchimp, our email marketing platform.
Lawful basis: Your consent (Article 6(1)(a) UK GDPR). You can withdraw consent at any time using the unsubscribe link in any email.
2.5 Website Analytics
What: Anonymous usage data including pages visited, session duration, device type, and browser. Collected via Google Analytics.
Why: To understand how visitors use the website and improve its performance.
Lawful basis: Legitimate interests (Article 6(1)(f) UK GDPR). This data is anonymised and cannot be used to identify individuals.
2.6 Transactional Emails
What: Email address and booking-related content.
Why: To send booking confirmations, reminders, and receipts. We use Resend as our transactional email platform.
Lawful basis: Performance of a contract (Article 6(1)(b) UK GDPR).
3. How Long We Keep Your Data
- Booking and contact data: 7 years from last appointment (required for business records and insurance purposes).
- Clinical and health records: 8 years from the date of last treatment, in line with professional standards guidance for soft tissue therapy records in the UK. For clients under 18 at the time of treatment, records are retained until the client's 26th birthday or for 8 years, whichever is longer.
- Marketing preferences: Until you withdraw consent or request deletion.
- Analytics data: Google Analytics data is retained for 26 months, then automatically deleted.
- Payment records: Stripe retains transaction records in line with its own regulatory obligations and data retention policy.
4. Who We Share Your Data With
We do not sell or rent your personal data. We share data only with the following third-party service providers where necessary to operate the clinic:
Stripe
Payment processing · USA / EU
Standard Contractual Clauses, PCI DSS compliant
Mailchimp (Intuit)
Marketing email · USA
Standard Contractual Clauses, EU-US Data Privacy Framework
Resend
Transactional email · USA
Standard Contractual Clauses
Google Analytics
Website analytics · USA
Data Processing Amendment, anonymisation enabled
| Provider | Purpose | Location | Safeguards |
|---|---|---|---|
| Stripe | Payment processing | USA / EU | Standard Contractual Clauses, PCI DSS compliant |
| Mailchimp (Intuit) | Marketing email | USA | Standard Contractual Clauses, EU-US Data Privacy Framework |
| Resend | Transactional email | USA | Standard Contractual Clauses |
| Google Analytics | Website analytics | USA | Data Processing Amendment, anonymisation enabled |
All third-party providers are contractually required to protect your data and use it only for the purpose we have specified.
We may also disclose data where legally required, for example to HMRC, regulatory bodies, or law enforcement.
5. Cookies
Our website uses the following types of cookies:
- Essential cookies: Required for the website to function. These cannot be disabled.
- Analytics cookies: Set by Google Analytics to track anonymous usage data. You can disable these via our cookie banner or your browser settings.
- Marketing cookies: Set only if you interact with third-party booking or marketing widgets. You can manage these in your browser.
You can change your cookie preferences at any time using the cookie settings link in the site footer.
6. Your Rights Under UK GDPR
Under UK GDPR, you have the following rights regarding your personal data:
- Right to access — Request a copy of the personal data we hold about you.
- Right to rectification — Ask us to correct inaccurate or incomplete data.
- Right to erasure — Ask us to delete your data where there is no lawful reason to retain it.
- Right to restriction — Ask us to limit how we use your data while a dispute is resolved.
- Right to data portability — Request your data in a structured, machine-readable format.
- Right to object — Object to processing based on legitimate interests or for direct marketing.
- Right to withdraw consent — Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.
- Rights related to automated decision-making — We do not make automated decisions that have a legal or significant effect on individuals.
To exercise any of these rights, contact us at info@achillesmethod.co.uk. We will respond within one calendar month.
7. Right to Complain
If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the UK's supervisory authority:
We would always prefer to resolve concerns directly. Please contact us first at info@achillesmethod.co.uk.
8. Changes to This Policy
We may update this policy from time to time. We will notify you of material changes by email if you are a current client, and by updating the "Last updated" date at the top of this page. Continued use of the website after changes constitutes acceptance of the updated policy.