4. How we use your information and why we are allowed to

The law requires us to have a valid reason, called a "lawful basis", for each use.

  
    What we doOur lawful basis

        Book, run and manage your sessions
        To carry out our agreement with you (contract)
      
        Take payment and keep financial records
        Contract, and our legal obligations for tax and accounting
      
        Use your health information to plan and coach your training
        Your explicit consent
      
        Reply to your enquiries and messages
        Our legitimate interest in answering you, or steps you ask us to take before booking
      
        Send session reminders and service updates
        Contract
      
        Send news and offers
        Your consent, or, if you are an existing client, our legitimate interest, with an easy way to opt out every time
      
        Measure and improve our website
        Your consent, through the cookie banner
      
        Show you our adverts on social media
        Your consent, through the cookie banner
      
        Deal with complaints, claims and insurance
        Our legitimate interest and our legal obligations

5. Who we share it with

We never sell your information. We share it only with services that help us run the studio, under contracts that require them to protect it, and only as much as each one needs.

Who	Why
Squarespace	Hosts our website, online shop and forms
Fresha	Our booking and client records system
Calendly	Booking consultation calls
[Stripe / PayPal / Square]	Processing card payments securely
[Google Workspace]	Email
Google Analytics	Understanding how people use our website, only if you accept cookies
Meta (Facebook and Instagram)	Measuring and showing our adverts, only if you accept cookies
WhatsApp	Messaging you, if you choose to contact us there
Our accountant, insurer and legal advisers	Running the business and meeting our obligations

Achilles Clinic

Our founder also runs Achilles Clinic, a separate company (Achilles Triumph Ltd) that provides soft tissue therapy. The two businesses use the same booking system, so Achilles Clinic can see the contact and booking details held in it. If you move between the clinic and the studio, for example from treatment into training, we share your training notes with Achilles Clinic only with your agreement.

When the law requires it

We may share information if the law requires us to, for example with HMRC or the police, or to protect someone's safety.

6. Transfers outside the UK

Some of the services above, such as Squarespace, Google and Meta, store information in the United States or elsewhere outside the UK. When that happens, we rely on the protections UK law allows, such as the UK Extension to the EU US Data Privacy Framework or the UK's approved data transfer agreements.

7. How long we keep it

We keep your information only for as long as we need it, then delete it or make it anonymous.

Information	How long we keep it
Client records, including health information and training notes	7 years after your last session, in case of an insurance or legal claim
Payment and accounting records	6 years, as tax law requires
Enquiries from people who did not book	12 months
Marketing list	Until you unsubscribe
Website analytics	14 months

If you ask us to delete your information sooner, we will, unless the law requires us to keep it, for example payment records for tax.

8. Cookies

Cookies are small files your browser stores. Our website uses three kinds:

Essential cookies make the site and checkout work. They are always on.
Analytics cookies (Google Analytics) show us which pages help people. They only run if you accept them.
Marketing cookies (Meta Pixel) measure our adverts. They only run if you accept them.

You can change your choice at any time using the cookie settings link at the bottom of every page. Our booking calendar (Calendly) only loads when you choose to book a call.

9. Marketing

We only send news and offers if you have agreed to receive them, or if you are a client and we think they will interest you. Every email has an unsubscribe link, and you can also just reply "stop". We never pass your details to other businesses for their marketing.

10. Your rights

You have the right to ask us for a copy of your information, to correct it if it is wrong, to delete it, to limit how we use it, to object to how we use it, and to receive it in a format you can take elsewhere. Where we rely on your consent, you can withdraw it at any time.

To use any of these rights, email info@afitness.org.uk. It is free, and we will reply within one month. We may ask you to confirm your identity first. Some rights have limits; for example, we may need to keep payment records for tax.

11. How to complain

If you are unhappy with how we have handled your information, please tell us first at info@afitness.org.uk. We will acknowledge your complaint within 30 days, look into it properly and tell you the outcome.

You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint or 0303 123 1113.

12. Keeping it safe

We keep client records in password-protected systems, limit access to the people who need it, and never keep health notes on paper in the studio. If a data breach ever puts you at risk, we will tell you and the ICO as the law requires.

You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint or 0303 123 1113.

We train under 18s only with the consent of a parent or guardian, who also agrees to how we use their information.

13. Changes to this policy

We review this policy at least once a year and whenever the way we use information changes. The date at the top shows when it was last updated.

Questions about your information?

Email info@afitness.org.uk, call 07897 732158, or write to Khang Fitness Ltd, 144 Liverpool Road London N1 1LA

Type	Examples	Where it comes from
Contact details	Name, email, phone number	You, when you enquire or book
Booking and payment details	Sessions booked, packages, payment confirmations. We never see or store your full card number.	You, our booking system and our payment provider
Health and injury information	Injury history, pain, operations, any plan from your physio or surgeon	You, at your assessment and during training
Training records	Your written plan, starting measures, progress notes	Us, during your sessions
Messages	Emails, WhatsApp messages, enquiry forms	You
Website use	Pages visited, device and browser type, approximate location	Cookies and similar tools (see section 8)

Monday to Saturday	9am to 7pm
Sunday	10am to 5pm

Privacy Policy

1. Who we are

3. Your health information