Last updated: 16 August 2026
Who we are
Four Quartets Bodywork is the practice of Max Gammell, sole trader. Max Gammell is the data controller for the personal information described in this notice.
For privacy questions or requests, email hello@fourquartetsbodywork.com.
Information we collect
Depending on how you contact or book with Four Quartets Bodywork, we may collect:
- your name, email address, telephone number and other contact details;
- enquiry messages and correspondence;
- appointment, booking, attendance and service information;
- information you provide in pre-session forms, including health, treatment, consent and accessibility information;
- treatment records and clinical notes;
- payment status, transaction references and invoice information, although Four Quartets Bodywork does not receive your full card details;
- your communication and optional marketing preferences; and
- limited technical and security information generated by the website and service providers, such as IP address, browser/device information and server logs.
Health and treatment information is special-category personal data and is handled with additional care.
How we collect information
We collect information directly from you when you contact us, book, complete a form, attend a session, make a payment or correspond with us. Information is also generated through the services used to manage bookings, payments, email, invoices and treatment records.
Why we use information and our lawful bases
We use personal information only where we have a lawful basis:
- to respond to enquiries and take steps you request before booking — steps before entering into a contract and our legitimate interest in responding to enquiries;
- to arrange, provide and administer appointments and bodywork services — performance of our contract with you;
- to understand relevant health information, plan and provide sessions safely, record consent and maintain treatment notes — performance of our contract and your explicit consent to the processing of the health information you choose to provide;
- to take and reconcile payment, issue invoices and keep required business and tax records — performance of our contract and compliance with legal obligations;
- to maintain accurate records, protect clients and the practice, handle complaints and establish, exercise or defend legal claims — legitimate interests, legal obligations and, for special-category information where necessary, the legal-claims condition;
- to keep systems and communications secure and prevent misuse — our legitimate interests in running a secure practice; and
- to send optional marketing email — your consent. You may withdraw this consent at any time by emailing us.
Where information is necessary to arrange or safely provide a session, we may be unable to proceed if it is not provided. Withdrawing consent does not affect processing that was lawful before withdrawal and does not prevent information being retained where another lawful basis or legal obligation applies.
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
Service providers and other recipients
We use carefully selected services to operate the practice. Depending on your interaction, information may be processed by:
- WriteUpp, provided by Pathway Software (UK) Limited, for online booking, client records, forms, appointment communications, treatment notes and invoices;
- Stripe and the relevant card, bank or wallet providers for secure payment processing and fraud prevention;
- Google Workspace for practice email and related communications;
- Hostinger, WordPress, LiteSpeed Cache and Contact Form 7 for website hosting, security and contact-form delivery. Contact Form 7 currently emails submissions to the practice mailbox and does not store them in WordPress;
- Xero, if an invoice is exported for bookkeeping; and
- professional advisers, insurers, regulators, courts, law-enforcement bodies or other parties where disclosure is necessary and lawful.
We do not sell personal information or share it with third parties for their own marketing.
International transfers
Some service providers or their subprocessors may process information outside the UK. Where UK data-protection law requires safeguards, the relevant provider uses an approved transfer mechanism such as an adequacy regulation, the UK Extension to the EU-US Data Privacy Framework, the UK International Data Transfer Agreement or Addendum, or approved contractual clauses. You may contact us for more information about the safeguards relevant to your information.
How long we keep information
We keep information only for as long as reasonably needed for the purpose for which it was collected and for applicable legal, accounting, insurance, safeguarding and legal-claims requirements.
The criteria depend on the information and context. Enquiries are kept for as long as needed to respond and manage the relationship. Booking, payment and invoice records are kept for the period needed to provide the service and meet business, tax and legal obligations. Health information, consent records and treatment notes are kept for the period reasonably required for continuity of care, professional and insurance obligations, safeguarding and the establishment, exercise or defence of legal claims. Marketing preferences are kept until consent is withdrawn or the information is no longer needed.
WriteUpp’s published terms state that patient data is retained while the service is supplied and deleted within 45 days after the WriteUpp contract ends unless applicable law requires it to be kept.
Security
We use access controls, secure service providers and appropriate organisational measures intended to protect personal information against loss, misuse, unauthorised access, alteration or disclosure. No internet or storage system can be guaranteed to be completely secure.
Your rights
Depending on the circumstances and lawful basis, you may have the right to:
- ask for access to your personal information;
- ask for inaccurate or incomplete information to be corrected;
- ask for information to be erased;
- ask for processing to be restricted;
- object to processing based on legitimate interests;
- receive information you provided in a portable format; and
- withdraw consent where processing is based on consent.
You have an unconditional right to object to direct marketing.
To exercise a right, email hello@fourquartetsbodywork.com. We may need to verify your identity before acting on a request. Some rights are subject to legal limits and may not apply in every situation.
Complaints
Please contact us first so we can try to resolve your concern. You also have the right to complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint.
Cookies and external services
See our Cookies page for information about the current website audit. When you follow the booking link, you leave this website and use WriteUpp’s separate booking service. WriteUpp, Stripe and any payment method you choose apply their own privacy and cookie information to that service.
Changes to this notice
We may update this notice if the practice, providers or legal requirements change. The date at the top shows when it was last updated.