Privacy Policy

Privacy Policy
Effective Date: July 2026

Pop-up Pilates (“we”, “our”, or “us”) takes your privacy seriously. This privacy policy outlines how we collect, use, store, and protect your personal information in accordance with applicable UK data protection laws.

Data Controller

Pop-up Pilates is the data controller of your personal data. If you have any questions about your data or wish to exercise your rights, please contact our Data Protection Officer (DPO), Lauren McLeod, at 56 Weyland Road, Headington, Oxford OX3 8PD, or admin@pop-up-pilates.com.

How We Collect Personal Data

We may collect personal data through various means, including:

  • In person
  • By letter
  • By email
  • By phone
  • Through our website
  • When you complete a Health Screening Form

By disclosing personal information verbally, in writing, or electronically, you consent to our use of that information to provide our services.

Types of Data We Collect

We may collect the following types of personal data: contact details (phone number, address, email address), enquiry source (how you heard about us), date of birth, emergency contact details, occupation, GP name and address (if appropriate), general medical information, and medical documentation such as letters from medical professionals, radiology reports, and clinical notes (if appropriate).

If you have provided personal data for a next of kin, it is your responsibility to ensure they are aware of and accept the terms of this Privacy Policy.

Use of Google Analytics

We use Google Analytics to analyse and monitor our website. This may include traffic data, location data, and communication data. This information helps us create reports about our website’s performance but does not identify you personally.

Who Can Access Your Data

Access to your personal data is restricted to those who need it to fulfil administrative functions or provide services to you. These may include:

  • Business administration staff
  • Physiotherapists and other authorised Pilates instructors

We will only share your personal data with third parties at your request or when required by law.

Sharing Your Data with Third Parties

We may share your personal data with third parties in the following cases:

  • Referrals: If you have consented, we may refer you to a GP, consultant, or specialist (e.g., orthopaedic consultant).
  • Legal obligations: We may be required to share your data with authorities or other third parties as required by law.

How We Use Your Personal Data

We process and store personal data to provide services to you and comply with legal regulations (e.g., HCPC and CSP guidelines for medical records). Our purposes for collecting and processing your data include:

  • Understanding your medical background and symptoms
  • Providing and fulfilling services
  • Communicating with you regarding appointments/classes
  • Sending exercise programs by email
  • Notifying you about changes to services or providing customer support
  • Collecting data to improve our services
  • Detecting, preventing, and addressing technical issues
  • Sending news, offers, and information (unless you opt out)

How We Store Your Data

We store your personal data securely, both digitally and in paper form. We take appropriate technical and organisational measures to protect your data, including:

  • Storing data on secure IT systems, backed up off-site
  • Using password protection and anti-virus software on all devices
  • Securing paper records with appropriate measures

Our clinic patient system is Nookal, our online booking system is Glofox, and we also use Microsoft 365 and Practice Pal to manage administrative records.

Use of AI Tools

We use AI tools — Claude AI and Microsoft Copilot — to support administrative tasks such as drafting communications and managing spreadsheets. Access to Claude AI is limited to a small number of authorised staff, and Microsoft Copilot is only accessed through our staff’s secure Microsoft 365 accounts. AI tools are only used with information a staff member has actively chosen to share with them — they do not automatically read your emails or other communications.

Your health and medical information — including Health Screening Forms, GP correspondence, radiology reports and clinical notes — is never entered into these AI tools in a form that identifies you. Where a staff member needs AI assistance with an email that mentions a health matter, any details that could identify you are removed first. Formal medical documentation is never entered into these AI tools in any form, whether identifiable or not.

This information is stored solely within our secure clinical systems — Nookal and Microsoft Forms — and in spreadsheets accessible only via authorised @pop-up-pilates.com accounts.

If we transfer personal data outside of the United Kingdom — including through our use of AI tools or other software providers based overseas — we ensure that your data is protected in line with UK data protection laws.

Data Retention

We retain personal data only for as long as necessary to fulfil the purposes outlined in this Privacy Policy. The standard retention period for medical records is 8 years, in accordance with CSP guidelines.

Accessing Your Data

You have the right to access the personal data we hold about you. To request access to your information, please contact us at lauren@pop-up-pilates.com.

Data Security

We implement robust internal policies and security features to prevent unauthorized access to your personal data. However, please note that the transmission of information via the internet and email is not completely secure, and any data transmission is done at your own risk.

Mandatory and Optional Data

In order to provide our services, we require certain personal data. In cases where providing some data is optional, we will clearly indicate which information is required.

Your Rights Under UK GDPR

Under the UK General Data Protection Regulation (UK GDPR), you have several rights with respect to your personal data:

  • Right to Rectification: If your data is inaccurate, you can request correction.
  • Right to Erasure: You can request the erasure of your personal data in certain circumstances.
  • Right to Restrict Processing: You can request that we limit the processing of your data.
  • Right to Object: You can object to the processing of your data, including direct marketing.
  • Right to Data Portability: You can request to transfer your data to another service provider.
  • Right to Withdraw Consent: If we process data based on your consent, you can withdraw that consent at any time.

To exercise these rights, please contact us at admin@pop-up-pilates.com. We will respond to your request within one month.

Changes to This Privacy Policy

This privacy policy may be updated periodically to reflect changes in our practices or legal requirements. Please review this policy regularly to stay informed about how we are protecting your personal data.

Contact Us

If you have any questions or concerns regarding this privacy policy or our data practices, please contact us at:

Email: lauren@pop-up-pilates.com
Postal Address: 56 Weyland Road, Headington, Oxford OX3 8PD

Contact Us

If you have any questions or concerns regarding this privacy policy or our data practices, please contact us at:

Email: lauren@pop-up-pilates.com
Postal Address: 56 Weyland Road, Headington, Oxford OX3 8PD