Who I am
 

This Privacy Policy explains how Noemi Mas (“I”, “me”, “my”) collects, uses and protects the personal information you provide through www.noemimas.com and my related services.
 

I am the data controller for your information. You can contact me at contact@noemimas.com. I am registered with the Information Commissioner’s Office (ICO), registration number ZC229204.
 

Information I collect

• Information you give me: your name, age, email, phone number, and the details of your next of kin and/or medical professional (kept in case I ever needed to reach them if you were at risk). When we work together I also collect information about your injury, health, sport, and what you’d like help with. This is provided through my contact form, booking, intake forms and our sessions.

• Information collected automatically: when you visit the website, standard technical data such as IP address, browser type, pages visited and time spent, used only for security and website statistics.
   

Sensitive (special category) information

Some of what you share — about your health, injury history and mental wellbeing — is “special category” personal data under UK GDPR, which needs extra protection.

• I collect it only to provide my services to you, and only what’s necessary.

• My lawful basis for using this sensitive information is your explicit consent (given when you complete your intake and agree to work with me). The general contract between us covers the rest of your personal data.

• I keep it secure and share it with no one without your consent, except: where I’m required to by law (such as a court order); where there’s a risk of serious harm to you or someone else; where a referring GP or healthcare professional requires a report (a copy is available to you on request); or, occasionally, when I discuss a case in professional supervision — where I only ever use your first name. You can withdraw consent at any time.
   

How I use your information

To respond to your enquiries; to plan and deliver your sessions and programme; to create your personalised recordings and materials; to handle bookings and payments; to send you essential emails about your sessions; and, only if you’ve opted in, to send newsletters. With your permission only, I may record a call for my own training and professional development. I’ll always ask first, and you’re free to say no. Automatic data is used only for security and website statistics.
 

Who I share it with

I use trusted third parties to run my practice, and share only what’s needed:

• Calendly for scheduling and bookings

• Stripe for payments (I never see or store your full card details)

• SignWell for signing your intake paperwork

• WhatsApp for messages between sessions

• Google Meet for video sessions and calls

• My email provider for email correspondence
   

Your session recordings and notes are kept by me (see Storage and security below), not with a third party. I don’t sell your information to anyone.
 

How long I keep it

I keep your information only as long as necessary — for active clients, for the duration of our work plus 7 years for insurance and professional record-keeping, after which it’s securely deleted. Enquiries that don’t become clients are deleted after 12 months.
 

Your rights

Under UK GDPR you have the right to: be informed; access your data; have it corrected; have it erased; restrict or object to processing; withdraw consent; and data portability. To exercise any of these, email me at contact@noemimas.com — it’s free and I’ll respond as soon as possible. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.
 

Storage and security

I store your information securely and take reasonable steps to protect it. Electronic records — including any session notes and recordings — are held on a password-protected computer, any handwritten notes are kept in a locked filing cabinet, and your phone number is saved in my password-protected business phone under your first name and last initial. Only I have access. No transmission over the internet can be guaranteed 100% secure, but I take your privacy seriously and act quickly if anything goes wrong.
 

Data breaches

If a breach occurs that risks your rights, I’ll take appropriate action and notify you and the ICO where required by law.
 

Children

My services are for adults aged 18 and over. I don’t knowingly collect personal information from anyone under 18.
 

Cookies

My website uses cookies to help it work and to understand how visitors use it. When you first visit, you can accept or decline non-essential cookies through the cookie banner, and you can change your choice at any time in your browser settings.
 

Changes

I may update this policy from time to time. The latest version will always be on this page, with the date updated below.
 

Contact

Questions about this policy or your data? Email contact@noemimas.com.
 

Last updated: 26 September 2026