Privacy policy

MOVE is run by Jonathan Talks, a sole trader based in Barry, Vale of Glamorgan, working across Barry, Cardiff, Penarth, Dinas Powys and the Vale. MOVE is the data controller for the information described here. Contact: 07502 323400 or jonathan@move.cymru.

What is collected

Enquiries. When you use the contact form on this site: your name, phone number, email address, the service you are asking about and anything you write in the message field.

Clients. Before your first session you complete a health screening. That covers relevant medical history, injuries, medication, pregnancy where applicable, training history, and for coaching clients your food intake, sleep and lifestyle notes. Sessions produce written notes: measurements, range of motion readings, what was treated or trained, and what to do next.

Payments. Deposits and session fees are handled by bank transfer or a card payment provider. MOVE sees the amount, the date and your name. MOVE never sees or stores your full card number.

Site usage. This site does not use advertising or tracking cookies, and there is no analytics profile built about you. The hosting provider keeps standard server logs, including IP address, for security purposes.

Why it is used, and the legal basis

Replying to your enquiry and arranging sessions — legitimate interests, and the performance of our agreement once you book. Keeping session and treatment records — legitimate interests and legal obligation, since insurance and professional body guidance require them. Taking payment and keeping financial records — legal obligation. Health information is special category data and is handled on the basis of your explicit consent, given in the screening form, which you can withdraw at any time.

Marketing is only sent if you ask for it, and every message includes a way to stop it. Your data is never sold, rented or used to build advertising profiles.

Client measurements and photographs

Numbers or photographs are only published — on this site, on social media or anywhere else — with your separate written consent, given specifically for that use. Consent can be withdrawn at any time and the material is removed. Refusing has no effect on the service you receive.

Who else sees it

Only the suppliers needed to run the business: the website and form host, the email provider, the payment provider, the scheduling tool and, where relevant, an accountant and the insurer. Each processes data on MOVE's instructions. Information is shared with a GP, physiotherapist or other clinician only with your consent, or where the law requires disclosure. Some providers store data outside the UK; where they do, transfers rely on UK adequacy regulations or the International Data Transfer Addendum.

How long it is kept

Enquiries that do not become bookings: up to 12 months. Client health and treatment records: eight years from your last session, in line with insurance and professional body guidance, and longer where a claim is open. Records for anyone under 18: until their 25th birthday. Financial records: six full tax years. Consent records are kept for as long as the consent is relied on.

How it is kept safe

Records are held in password-protected, encrypted accounts with two-factor authentication, accessible only to Jonathan. Paper screening forms are stored in a locked cabinet and destroyed once transferred. Health details are never discussed over social media or unsecured messaging.

Your rights

You can ask for a copy of what is held about you, have mistakes corrected, ask for deletion, restrict or object to processing, withdraw consent, or ask for your data in a portable format. Email jonathan@move.cymru and you get a response within one month. Deletion can be limited where insurance or tax law requires a record to be retained.

If you are not satisfied with the response, you can complain to the Information Commissioner's Office at ico.org.uk or 0303 123 1113.

Changes

When this policy changes, the date at the top changes with it. Material changes affecting current clients are notified by email.

To make an access, correction or deletion request, use the data request form. See also the professional conduct policy and service terms.