Beyond Move Ltd Privacy Policy

Last updated: June 2025  |  Next review: June 2026

At Beyond Move we believe you have the right to know what data we hold about you, why we hold it, and how it is used. This policy is written plainly so you can make an informed decision about sharing your information with us.

Beyond Move Ltd is registered in England and Wales. Our studio is at 9 Cat Hill, Barnet, EN4 8HG. You can contact us at hello@beyondmove.com.

We are the data controller for the personal data described in this policy. We are registered with the Information Commissioner’s Office (ICO) under registration reference ZA569740.

1. What data we collect and why

Clients and prospective clients

When you enquire, book a class, or become a client, we collect:

  • Name, email address, phone number

  • Health information and medical history relevant to your Pilates practice — including neurological conditions, injuries, and post-surgical history

  • Emergency contact details

  • Class attendance records and session notes

  • Payment information (processed securely via our booking platform; we do not store card details ourselves)

We use this information to:

  • Deliver safe, appropriate movement sessions tailored to your needs

  • Communicate with you about bookings, cancellations, and studio updates

  • Meet our duty of care, particularly for clients with neurological or complex conditions

  • Process payments

Health data (special category)

Health information is special category data under UK GDPR. We collect it because it is necessary to provide safe Pilates instruction, particularly given our specialism in neurological rehabilitation and the Pető (Conductive Education) method. We rely on your explicit consent and our legitimate interest in providing a safe service. You can withdraw consent at any time — see section 5.

Website visitors

Our website uses cookies to understand how visitors use the site. Where cookies are not strictly necessary, we ask for your consent. You can manage cookie preferences at any time via your browser settings.

We may collect your IP address and basic usage data automatically. This does not identify you personally.

Teachers and contractors

If you work with us, we hold employment or contractor data, including your contact details, qualifications, DBS check records, and payment information. This is covered separately in your employment or contractor agreement and our staff privacy notice.

2. Legal basis for processing

We process your data on the following legal grounds:

  • Contract — to deliver the service you have booked

  • Legitimate interests — to run the studio safely and communicate with you about your sessions

  • Legal obligation — where the law requires us to keep records (e.g. financial records for HMRC)

  • Explicit consent — for health data and marketing communications

3. Who we share your data with

We do not sell your data. We share it only where necessary:

  • Our booking and studio management platform (currently Momence), which processes data on our behalf under a data processing agreement

  • Payment processors (e.g. Stripe), for secure payment handling

  • Our accountant, for financial record-keeping

  • Emergency services or medical professionals, if there is a risk to your health or safety

All third parties are required to handle your data in accordance with UK data protection law.

4. How long we keep your data

  • Client records: 7 years from your last session, in line with standard business and legal requirements

  • Health records: 8 years from last contact (or until age 25 if the client was a minor at the time)

  • Enquiry data where no booking follows: 12 months

  • Financial records: 6 years as required by HMRC

After these periods, data is securely deleted.

5. Your rights

Under UK GDPR you have the right to:

  • Access the personal data we hold about you

  • Correct inaccurate data

  • Request deletion of your data (where there is no legal reason to retain it)

  • Withdraw consent at any time (this does not affect processing carried out before withdrawal)

  • Object to or restrict how we process your data

  • Receive your data in a portable format

To exercise any of these rights, email hello@beyondmove.com. We will respond within one month.

6. How to raise a concern or complaint

If you have a concern about how we have handled your data, please contact us first:

We will acknowledge your complaint within 30 days and respond with an outcome without undue delay. This complaints process is a legal requirement under the Data (Use and Access) Act 2025, in force from 19 June 2026.

If you are not satisfied with our response, you have the right to escalate to the Information Commissioner’s Office (ICO):

7. Data security

We take reasonable technical and organisational measures to protect your data from loss, misuse, or unauthorised access. Access to client records is limited to Beyond Move staff who need it to deliver your sessions.

In the event of a data breach that is likely to affect your rights and freedoms, we will notify you and the ICO as required by law.

8. Photography and video

We may photograph or film studio sessions for marketing purposes. We will always ask for your explicit consent before doing so. Your consent is valid for two years and can be withdrawn at any time by contacting hello@beyondmove.com.

Our photography consent form is governed by UK GDPR and the Data Protection Act 2018 (not the repealed Data Protection Act 1998).

9. Changes to this policy

We review this policy annually and when legislation changes. The current version is always published at beyondmove.com. We will notify you of any significant changes.

Beyond Move Ltd  ·  9 Cat Hill, Barnet, EN4 8HG  ·  hello@beyondmove.com  ·  beyondmove.com