Privacy Policy

Last updated: March 2026

This privacy policy explains how Sana, trading as Massage by Sana ("I", "me", "my"), collects, uses and protects the personal information you provide when contacting me or booking a massage appointment. I am committed to protecting your privacy and handling your data responsibly in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Who I am

Massage by Sana is a sole trader massage therapy service based in Birmingham, West Midlands. You can contact me at:

What personal data I collect

When you contact me to enquire about or book a massage, I may collect the following information:

  • Your name — so I know who I'm speaking with
  • Your phone number — to confirm your booking and communicate with you
  • Your address or location — if you request an out-call appointment
  • Health information you choose to share — for example, injuries, medical conditions or preferences relevant to your treatment. You are never obligated to share this, but it helps me provide the safest and most effective session possible.

I do not collect payment card details. Payments are accepted in cash or via bank transfer only.

How I use your data

Your personal information is used solely for the purpose of providing massage therapy services. Specifically, I use it to:

  • Confirm and manage your appointments
  • Contact you regarding your booking
  • Tailor your treatment to your individual needs and health requirements
  • Follow up after a session if necessary

I will never sell, share or pass your personal data to third parties for marketing purposes. Your data will not be used for any purpose other than delivering the service you have requested.

Legal basis for processing

Under UK GDPR, I process your personal data on the following legal bases:

  • Contractual necessity — to fulfil the booking you have made with me
  • Legitimate interests — to manage my appointments and communicate with clients
  • Consent — for any health information you voluntarily share with me

How long I keep your data

I retain basic contact information (name and phone number) for as long as we have an ongoing client relationship. If you have not booked an appointment in 12 months and have not been in contact, I will delete your details. Any health information shared is held only for the duration of our working relationship and deleted upon request.

Your rights

Under UK GDPR, you have the following rights regarding your personal data:

  • Right of access — you can ask me what data I hold about you
  • Right to rectification — you can ask me to correct inaccurate data
  • Right to erasure — you can ask me to delete your data
  • Right to object — you can object to how I use your data
  • Right to restriction — you can ask me to limit how I use your data

To exercise any of these rights, please contact me directly via WhatsApp or phone. I will respond to all requests within one month.

Data security

Your contact details are stored on my personal device and accessed only by me. I take reasonable steps to keep this information secure. Booking conversations take place via WhatsApp, which uses end-to-end encryption.

Cookies

This website does not use tracking cookies, analytics software or advertising scripts. No personal data is collected through visiting this website.

Changes to this policy

I may update this privacy policy from time to time. The current version will always be available on this page with the date of the last update shown at the top.

Complaints

If you have concerns about how I handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.