1. Who We Are

The School of Natural Therapies (“we”, “us”, “our”) is a private training academy providing accredited professional qualifications and diplomas in massage and complementary therapies in the UK.

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, The School of Natural Therapies acts as the Data Controller for the personal information collected from our students, course applicants, tutors, and model clients.

Our registered address is:

The School of Natural Therapies
Unit 54 Battersea Business Centre
99–109 Lavender Hill
Battersea
London
SW11 5QL

If you have any questions regarding this policy or how your personal information is handled, please contact us using the details above, or reach our Data Protection Officer as set out in Section 8.

2. What Personal Data We Collect

We collect and process personal data to manage course applications, deliver practical and theoretical training, and issue accredited qualifications. This includes:

Identity Data: Full name, date of birth, title, gender.
Contact Data: Email address, telephone number, residential address.
Academic & Assessment Data: Prior qualifications, enrolment history, attendance records, student registration numbers, coursework, assignments, case studies, and practical/written exam results.
Financial Data: Payment details, billing address, bank details, invoice records, and instalment plan details (card payments are processed securely via external payment gateways and are not stored directly on our servers).
Health & Medical Data (Special Category Data): Medical history, contraindications to receiving massage, allergies, or physical health conditions disclosed on consultation forms for practical classroom training or model clinic practice.
Technical & Usage Data: IP address, browser type, and cookies collected when you browse our website.

3. How We Collect Your Data

We collect data directly from you when you:

Enrol in or enquire about a course via our website, email, or telephone.
Complete consultation forms or health history disclosures prior to practical training sessions.
Submit coursework, portfolio evidence, case studies, or sit examinations.
Complete course feedback forms, student surveys, or sign up for our newsletter.

4. Why We Collect Your Data & Our Lawful Bases

Under UK GDPR, we process your personal data using the following legal bases:

Purpose / Activity	Categories of Data	Lawful Basis (UK GDPR)
Course Administration: Processing enrolments, managing study progress, and delivering training.	Identity, Contact, Financial, Academic	Contractual Necessity: Required to deliver the training services you contracted us to supply.
Accreditation & Certification: Registering you with awarding bodies (iTEC / VTCT) and issuing certificates.	Identity, Contact, Academic	Contractual & Legal Obligation: Necessary to grant recognised, accredited qualifications.
Practical Peer & Model Training: Conducting safe practical massage sessions and checking contraindications.	Health / Medical Data (Special Category Data)	Explicit Consent (Article 9 UK GDPR): Required to ensure safe physical treatment during classroom practice.
Audit & Record Keeping: Retaining qualification evidence and assessment records for insurance/regulators.	Identity, Academic, Assessment	Legitimate Interests & Legal Obligation: Meeting requirements set by insurers (e.g., FHT) and awarding bodies.
Direct Marketing: Sending newsletters, course updates, and promotional materials.	Contact	Consent: You can unsubscribe at any time via the link in our emails or by contacting us directly.

5. Who We Share Your Data With

We do not sell, rent, or trade your personal data to third parties. We share information only with trusted service providers and partners where essential to operate the school and fulfil legal obligations:

Awarding & Accrediting Bodies: iTEC / VTCT and relevant professional bodies (such as FHT) for student registration, external quality verification, examination entry, and issuing certificates.
Insurers: Our professional indemnity and public liability insurers where required for audit purposes or defending potential claims.
Service Providers & Data Processors: Secure IT hosting, website management, email service providers, and cloud storage platforms operating under strict data processing agreements.
Payment Gateways: Third-party payment processors (e.g., PayPal, Stripe, or bank transfer systems) to securely process course fees.
Legal Authorities: If required to do so by law, court order, or regulatory bodies.

6. How Long We Keep Your Data

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected:

Academic & Qualification Records: Retained for 7 years after course completion to comply with awarding body regulations, verification requirements, and medical malpractice insurance standards.
Student Consultation & Medical Forms: Retained for 7 years following completion of training (or until age 25 for individuals under 18 at the time of treatment).
Financial & Tax Records: Retained for 6 years plus the current tax year in line with HMRC rules.
General Inquiries & Marketing Contacts: Held until you withdraw consent or for up to 12 months post-inquiry if no enrolment takes place.

7. Data Security

We implement strict physical and digital security measures to safeguard your information:

Paper consultation forms and physical student records are kept in locked, secure premises with restricted access.
Electronic records are stored on password-protected, encrypted systems and secure UK/EEA-compliant cloud servers.
Staff and tutors are bound by confidentiality obligations and access data strictly on a need-to-know basis.

8. Your Legal Rights Under UK GDPR

Under UK data protection law, you have specific rights regarding your personal information:

Right of Access: Request a copy of the personal data we hold about you (Subject Access Request).
Right to Rectification: Request correction of inaccurate or incomplete personal information.
Right to Erasure: Request deletion of your data (subject to our legal, insurance, and awarding body retention obligations).
Right to Restrict or Object: Object to or restrict certain types of data processing (such as direct marketing).
Right to Data Portability: Request that your personal data be provided to you, or transferred to another organisation, in a structured, commonly used format, in certain circumstances.
Right to Withdraw Consent: Where processing relies on consent (e.g., health forms or marketing), you may withdraw consent at any time.

To exercise any of these rights, please contact our Data Protection Officer at marcinnesmassage@gmail.com.

9. Complaints & Regulatory Body

If you have concerns about how we collect or process your personal data, please contact us first so we can resolve the matter directly.

If you remain dissatisfied, you have the right to lodge a complaint with the UK data protection regulator:

Information Commissioner’s Office (ICO)
Website: https://ico.org.uk
Helpline: 0303 123 1113

Signed: Marc Innes
Date: 21/07/2026

Privacy Policy