Vesta Wellbeing — Privacy Policy
Last updated: 27 September 2026
Applies to: www.vestawellbeing.co.uk, its contact and newsletter forms, and bookings made through the linked Acuity Scheduling page.
1. Who is responsible for your information?
The data controller is Laura Weddell, trading as Vesta Wellbeing (“I”, “me”, “my”). I decide why and how your personal information is used.
You can contact me about this policy or your information at hello@vestawellbeing.co.uk.
2. Information I collect
Depending on how you interact with Vesta Wellbeing, I may collect:
• Enquiries: your first and last name, email address, and the message you send through the Contact page form. Please avoid including sensitive health details in a general enquiry unless they are needed to respond.
• Bookings and services: your name and contact details, the service or class you select, appointment date and time, booking and cancellation records, and any information you provide in booking or intake forms or during a session.
• Health information: if you choose to provide it, information about relevant health conditions, injuries, allergies, symptoms, accessibility needs, and treatment/session notes. Health information is special-category personal data under UK data-protection law. I will only use information that is necessary for the safety, suitability, and delivery of the service you request.
• Payments and accounts: transaction and invoice details needed to confirm a booking, provide a refund, and keep required financial records. Card details are handled by the payment provider; Acuity Scheduling and/or Stripe.
• Newsletter: your email address and your subscription/unsubscribe status if you sign up for news and updates.
• Technical information: information generated when you use the site, such as device/browser details, IP address, and information stored or accessed through cookies or similar technologies. The exact technologies depend on the website, scheduler, and any analytics or embedded services in use.
You do not have to provide information that is optional. Some information, such as contact details needed to confirm a booking, is necessary for me to respond or provide the service. If you do not provide it, I may be unable to proceed with your enquiry or booking.
3. How and why I use your information
Purpose
Information used
UK GDPR basis (confirm before publishing)
Respond to an enquiry and discuss a possible booking
Name, email, message
Taking steps at your request before a contract where the enquiry concerns a service; otherwise my legitimate interests in responding to enquiries and running my business.
Arrange and provide a booking, class, or treatment; manage changes and cancellations
Contact and booking details, service history, relevant communications
Necessary to perform a contract with you or take steps at your request before entering into one.
Keep booking, payment, tax, and accounting records
Booking and transaction details - not card details.
Contract where relevant and legal obligation for records I must retain.
Send the newsletter or other marketing you asked to receive
Email address and subscription record
Your consent. I will provide an unsubscribe method in each marketing email and stop marketing when you unsubscribe.
Deal with legal claims, safety incidents, or lawful requests
Relevant records
Legal obligation or legitimate interests, depending on the circumstances.
4. Bookings and service providers
The website is hosted on Squarespace. The booking link directs you to Acuity Scheduling, which is part of the Squarespace suite. These providers process information to operate their services and may also handle technical information under their own privacy terms. Their notices are available at Squarespace Privacy Policy and Acuity’s data-privacy information.
I may also share limited information with the following providers where needed to provide a service or run the business:
• Payment processing: Stripe. QuickBooks.
• Email/newsletter delivery: MailerLite
• Website analytics, cookie, or embedded-content providers: Squarespace.
• Professional advisers and insurers: FitPro, Balens. Federation of Holistic Therapists. CIMSPA: where necessary for accounting, legal advice, insurance, or resolving a claim.
• Public authorities or emergency services: where required by law or necessary to protect someone’s vital interests.
I do not sell your personal information. I only give providers the information they need for their role and require appropriate privacy and security protections where applicable.
5. How long I keep information
I keep personal information only for as long as it is needed for the purpose for which it was collected, including any legal, accounting, insurance, or claims-handling requirements. I then securely delete it or anonymise it where appropriate.
Information
Retention period or criterion
Enquiries that do not lead to a booking
12 months after the enquiry is closed or the last meaningful contact,
Booking, client, and treatment/session records, including relevant health information
5 years
Invoices and financial records
Keep for at least 5 years after 31 January submission deadline for the relevant self-assessment tax year.
Newsletter details
Until you unsubscribe; I may retain a minimal suppression record so I can respect your opt-out.
6. Your data-protection rights
Depending on the circumstances and the lawful basis I use, you may have the right to:
• ask for a copy of your personal information;
• ask me to correct inaccurate or incomplete information;
• object to processing based on legitimate interests, and always object to direct marketing;
• receive certain information in a portable format; and
• withdraw consent where processing is based on consent.
These rights are not absolute in every situation. To make a request, email hello@vestawellbeing.co.uk and say what you are asking for. I may need to confirm your identity before acting. I will respond within the time required by law, and information requested will be provided within 28 days of request.
If you are unhappy with how I handle your information, please contact me first so I can try to resolve the issue. You can also complain to the UK Information Commissioner’s Office (ICO).
8. Security and automated decisions
I use reasonable technical and organisational measures to protect personal information. No method of sending or storing information is completely secure, so please contact me promptly if you believe information you sent may have been exposed.
9. Children and young people
Movement classes are suitable for ages 14 years and upwards. Treatments are suitable for ages 16 and upwards.
10. Changes to this policy
I may update this policy when my services, providers, or legal obligations change. The latest version will be published on this page, with its updated date at the top. If a change materially affects how I use information already collected, I will provide any additional notice required by law.