Privacy policy

Humble Bee Therapies trading as Humble Bee Therapies (“we”, “us”) is the controller of your personal information. Address: [Business address to be added]. Email: [Email to be added].

We are registered with the Information Commissioner's Office, registration number [ICO registration number to be added].

• Account details: your name, email address, phone number and password (stored only as a secure hash).
• Bookings: the treatment, date and time, and any notes you give us.
• Health information: your answers to the health questions when you book. See Health information.
• Orders: what you bought, your delivery address and contact details.
• Reviews: if you review a product you've bought or a treatment you've had, your rating and what you write, shown publicly with your first name and the first letter of your surname. You can edit or delete it yourself at any time.
• Gift vouchers: your name and email, the recipient's name, and their email if you ask us to send it to them.
• Messages: what you send through the contact form.
• Email sign-ups: your email address (and name, if you give it) when you tick the marketing box or use the welcome pop-up. From the pop-up we first email you to confirm it is really you, and only then add you to our list. We record when and where you signed up.
• Trade applications: if you apply for a Student or Professional account, the note you write and the proof of eligibility you upload (for example a college or professional membership document). Only we can see these, and they are used only to decide your application.
• Links you follow: if you arrive from one of our social media links, we count the visit (just the time, nothing about you). If you accept analytics cookies, we remember which link brought you for 30 days, so we can see which posts lead to bookings and orders. Otherwise it is forgotten when you close the page.
• Unfinished checkouts: if you start a booking or an order but don't finish, we keep which step you reached, what you'd chosen and, if you'd typed it, your name and email. Never your health answers or card details.
• Payments: handled by Stripe. We never see or store your card details; we receive only a confirmation and the last four digits.
• Website use: essential storage that keeps your basket and login working, and, only if you agree, analytics cookies. See our cookie policy.

Health information is “special category” data, so we only collect it with your explicit consent, which you give with a separate tick box when you book. We use it only to decide whether and how to give your treatment safely.

• Only your therapist can see it. It is stored in our secure database, encrypted in transit and at rest, and protected by access controls that stop anyone else, including other customers, from reading it.
• It is never used for marketing and never shared, unless the law requires it or there is a risk to your life.
• We keep it for 7 years after your treatment, in line with guidance for therapists' client records, then delete it automatically.
• You can withdraw consent at any time by contacting us. We will delete the information, although we may then be unable to treat you.

We use a small number of trusted services to run the business. They act on our instructions and may not use your information for their own purposes.

Where information leaves the UK, it is protected by the UK's adequacy regulations or the International Data Transfer Agreement or Addendum.

You can ask us to:

• give you a copy of your information;
• correct anything that's wrong;
• delete your information, where we don't need to keep it by law;
• restrict or object to how we use it;
• send it to you or another organisation in a common format;
• withdraw any consent you've given.

You can update your details and delete your account yourself from your account, or email us. We'll reply within one month. If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office at ico.org.uk, though we'd appreciate the chance to put it right first.

Everything travels over encrypted connections. Accounts require a verified email address. Each person can only ever read their own bookings, orders and health answers; this is enforced by the database itself, not just the website. Payments are handled entirely by Stripe.

Online booking and accounts are for adults. Treatments for under-18s need a parent or guardian's consent, arranged with us directly.

If we change how we use your information, we'll update this page and, for significant changes, email account holders.