Privacy Policy

This policy explains what personal information Formé by Liv collects when you use this website, book a class or get in touch, why we collect it, and your rights over it. We keep it to what we genuinely need to run your classes safely.

Who we are

Formé by Liv runs Reformer Pilates classes at Sculptd Pilates, 105 Provence Dr, Bournemouth BH11 9FE. We are the data controller for the information described here. For anything privacy-related, email hello@formebyliv.com.

What we collect

• Your details: name, email address and (optionally) mobile number, when you create an account, book or contact us.
• Your account: your email and a securely hashed password. We never see or store your password itself.
• Bookings: the classes you book, cancel or join a waitlist for, and your attendance.
• Payments: handled by Stripe. We receive confirmation that a payment was made and its amount; your card details go directly to Stripe and never reach us.
• Health questionnaire: your answers about injuries, recent surgery, pregnancy and medical conditions, plus anything else you choose to tell us.
• Age confirmation: that you confirmed you are 16 or over, and when. We don’t ask for your date of birth.
• Messages: what you send through the contact form.
• Security data: to stop automated attacks, we briefly record scrambled (hashed) versions of IP addresses and email addresses that attempt to sign in, sign up, book or send messages. These can’t be read back and are deleted within a day.

Your health information

Health information is a special category of personal data under UK GDPR, so we treat it with extra care. We only collect it with your explicit consent, given when you tick the consent box, and only use it so your instructor can adapt exercises and keep you safe in class. It is only visible to studio staff, never shared with anyone else, and never used for marketing.

You can review and update your answers at any time from your account. You can withdraw consent by emailing us. We’ll then delete your answers, though without them we may not be able to offer you a place in class safely.

Why we use it (and our lawful basis)

• To provide your classes (performance of a contract): managing your account, bookings, waitlist places, payments, and emails about your bookings.
• To keep you safe (explicit consent): your health questionnaire.
• To answer your enquiries (legitimate interests): replying to messages you send us.
• To protect the website (legitimate interests): preventing fraud, spam and unauthorised access.
• To meet legal obligations: keeping payment and booking records for tax and accounting.

We don’t sell your data, and we don’t send marketing emails.

Who we share it with

We use a small number of trusted providers to run this service. They only process your data on our instructions:

• Vercel: website hosting (our servers run in London).
• Neon: our database, hosted in London (UK).
• Stripe: payment processing.
• Resend: sending booking and contact emails.

Some of these companies are based in the US. Where your data is handled outside the UK, it’s protected by recognised safeguards such as the UK–US Data Bridge or the ICO’s International Data Transfer Agreement.

How long we keep it

• Account and contact details: while your account is active, and deleted after 2 years with no bookings, or sooner if you ask.
• Health questionnaire: while you’re attending classes, and deleted within 2 years of your last class or as soon as you withdraw consent.
• Booking and payment records: 6 years, as required for tax purposes.
• Contact form messages: up to 12 months.
• Security data: less than 24 hours.

Cookies and similar technologies

We only use what the site needs to work: a secure cookie that keeps you signed in, and your browser’s session storage to remember small preferences (such as not replaying the opening animation). We use no analytics, advertising or tracking cookies.

Our map of the studio is provided by Google Maps. When it loads, Google may set its own cookies and receive your IP address under Google’s privacy policy.

How we protect it

Everything is encrypted in transit (HTTPS) and your data is stored in an encrypted database. Passwords are stored only as salted hashes, sign-in attempts are rate-limited, sessions expire automatically, and the back office is restricted to authorised studio staff.

Your rights

Under UK data protection law you have the right to:

• access a copy of the personal data we hold about you
• have inaccurate data corrected
• have your data deleted
• restrict or object to how we use it
• receive your data in a portable format
• withdraw consent (for your health questionnaire) at any time

To use any of these rights, email hello@formebyliv.com. We’ll respond within one month. If you’re unhappy with how we’ve handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We’d appreciate the chance to put things right first.

Age

Our classes and this website are for people aged 16 and over. We don’t knowingly collect data from anyone younger.

Changes to this policy

If we change how we use your data, we’ll update this page and the date at the top. For significant changes, we’ll let account holders know by email.