Privacy Policy

Last updated: 15th July 2026

I am committed to protecting your privacy and handling your personal information responsibly.

This policy explains what information I collect, why I collect it, and how I use and protect it.

Who I am

Nat Pilates London is a private Reformer Pilates studio based in King's Cross, London. I am Natalia, a Polestar-certified Pilates instructor and Registered Nurse, and I am the sole person running this business.

For the purposes of UK data protection law, I am the data controller responsible for your personal information.

You can contact me at:

Website: www.natpilates.com
Email: nataliabarbosa@gmail.com
Location: King's Cross, London

Information I collect

When you contact me, book a session, complete a health form, or otherwise interact with my website or services, I may collect the following personal information:

Contact and booking information

Name, email address, and telephone number
Booking history and session records
Communications between us
Information relevant to your booking or enquiry

Health information (special category data)

Because of the clinical nature of my sessions, I collect health-related information including:

Medical history, current conditions, and injuries
Conditions such as hypermobility, Ehlers-Danlos Syndrome (EDS), chronic pain, and musculoskeletal issues
Pre and postnatal status, menopausal status, and women's health information
Pelvic floor health and related concerns
Medications and relevant clinical information

This information is essential to deliver sessions that are safe, personalised, and appropriate for your body. I treat all health data with the highest level of care and confidentiality.

Technical information

My website may automatically collect certain technical information, such as your IP address, browser type, device information, and website usage data through cookies and analytics tools.

Why I collect your information and my lawful basis

Under UK GDPR, I must have a lawful basis for processing your personal data. For health data (special category data), an additional condition is required.

Contact and booking data

Contract: to manage your bookings and deliver the services you have requested
Legitimate interests: to communicate with you about your sessions, cancellations, and scheduling
Legal obligation: to comply with legal, tax, and regulatory requirements

Health data

Explicit consent: I ask for your explicit consent before collecting and using your health information. You can withdraw this consent at any time, though this may affect my ability to safely deliver sessions
Vital interests: in rare emergencies, I may need to use your information to protect your health or safety

How I use your information

I use your personal information to:

Deliver safe, personalised Pilates sessions tailored to your body and health needs
Manage bookings, scheduling, and cancellations
Communicate with you about your sessions, programme, and any relevant updates
Maintain accurate client records for continuity of care
Improve my website and client experience
Meet my professional, legal, and regulatory obligations

I will only use your information for purposes related to providing my services and running my business.

Payments

All payments for sessions and packs are made by bank transfer directly to me. I do not use third-party online payment processors, and I do not store or have access to any card or banking details beyond what you choose to share with me directly.

Payment transaction records are kept for up to 7 years in line with HMRC requirements.

Website hosting and service providers

This website is hosted by Wix.com. Your data may be stored through Wix's secure data storage, databases, and applications. Wix operates in compliance with applicable data protection regulations. You can view Wix's own privacy policy at wix.com/about/privacy.

Bookings may be managed through Google Calendar, and communications may take place via WhatsApp or email. These providers process limited personal data (such as your name and contact details) in accordance with their own privacy policies. I do not share your health information through these platforms beyond what you choose to send me directly.

Sharing your information

Your personal information will not be sold or shared with third parties for marketing purposes.

I may only share your information:

Where required by law or by a regulatory authority
To protect the rights, safety, or welfare of clients or others in an emergency
With trusted service providers necessary for running my business, such as my website hosting provider

I do not share your health information with any third party without your explicit consent.

How long I keep your information

I retain your personal information for as long as necessary to provide my services and meet my legal obligations:

Client records and health information: up to 7 years after your last session, in line with standard practice for health-related services
Payment and transaction records: up to 7 years for financial record-keeping in line with HMRC requirements
Enquiries that did not lead to a booking: up to 12 months

After these periods, your data will be securely deleted.

How I protect your information

I take reasonable steps to protect your personal information and keep it secure.

Measures I take include:

Storing client records in password-protected systems
Limiting access to your data to myself only
Not sharing health information with any third party without your consent
Using Wix's secure hosting infrastructure for website data

Your rights under UK GDPR

You have the following rights regarding your personal data:

Right to access: you can request a copy of the personal data I hold about you
Right to rectification: you can ask me to correct any inaccurate or incomplete information
Right to erasure: you can ask me to delete your data, subject to legal obligations
Right to restrict processing: you can ask me to limit how I use your data
Right to data portability: you can request your data in a portable format
Right to object: you can object to me processing your data based on legitimate interests
Right to withdraw consent: where I rely on consent (particularly for health data), you can withdraw it at any time

To make a request regarding your personal information, or to exercise any of these rights, please contact me at nataliabarbosa@gmail.com.

I will respond within one month.

Cookies and website data

My website (www.natpilates.com) uses cookies to support essential site functions, improve your browsing experience, and help me understand how visitors use the site.

When you first visit, you can choose which non-essential cookies to accept through the cookie banner, and you can also manage cookie preferences through your browser settings at any time.

Analytics data collected is aggregated and does not identify you personally.

Changes to this policy

I reserve the right to update this privacy policy from time to time to reflect changes in my practices or legal requirements. Any changes will be posted on this page and will take effect immediately upon publication.

I will notify existing clients of any significant changes by email.

How to make a complaint

If you have any questions or concerns about how I handle your personal data, please contact me directly in the first instance and I will do my best to resolve any issues promptly.

If you remain unhappy, you have the right to complain to the UK's data protection regulator:

Information Commissioner's Office (ICO)

Website: www.ico.org.uk
Helpline: 0303 123 1113

Contact

For any questions regarding this privacy policy or how your information is handled, please contact:

Email: nataliabarbosa@gmail.com
Website: www.natpilates.com

This policy is written in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.