NUAA Collective — Privacy Policy

Last updated: September 2026

Nuaa Collective (“Nuaa”, “we”, “us” or “our”) respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains what information we collect, why we collect it, how we use and protect it, and your rights in relation to your personal data.

1. Who we are

Nuaa Collective provides physiotherapist-led Pilates and wellbeing classes for women.

For the purposes of UK data protection law, Nuaa Collective is the controller of personal information covered by this Privacy Policy.

Contact: cathy@nuaacollective.co.uk
Website: www.nuaacollective.co.uk

2. Information we may collect

Depending on how you interact with Nuaa, we may collect:

  • your name and contact details, including email address and telephone number;

  • booking, attendance and course information;

  • communications and enquiries you send to us;

  • payment and transaction information;

  • information you provide through health screening or participation questionnaires;

  • relevant information about injuries, medical conditions, symptoms or physical limitations;

  • pregnancy and postnatal information where relevant to your participation; and

  • other information you choose to provide where it is relevant to providing our services.

We aim only to collect health information that is reasonably necessary to help us provide appropriate and safe classes.

Health information, including pregnancy-related information where it reveals information about your health, can constitute special category personal data and receives additional protection under UK data-protection law.

3. Why we use your information

We may use personal information to:

  • administer bookings and payments;

  • provide the classes or services you have requested;

  • communicate with you about your bookings and courses;

  • manage attendance and class capacity;

  • understand relevant health considerations and adapt exercise appropriately;

  • respond to enquiries;

  • maintain appropriate business and financial records;

  • meet our legal, regulatory and insurance obligations; and

  • establish, exercise or defend legal claims where necessary.

4. Our lawful bases

We process personal data only where we have an appropriate lawful basis.

Depending on the purpose, this may include:

Contract — where processing is necessary to provide a class, course or service you have booked or requested.

Legal obligation — where we need to retain or process information to comply with a legal requirement.

Legitimate interests — where it is reasonably necessary for the operation and protection of NUAA and those interests are not overridden by your rights.

Consent — where we specifically ask for your consent for a particular use of your information.

Health information requires an additional condition under Article 9 of the UK GDPR as well as an Article 6 lawful basis.

Where Nuaa relies on explicit consent to process health information for screening and appropriate participation in classes, we will ask you to provide a clear affirmative agreement to that processing. You may withdraw that consent by contacting us, although this will not affect processing that took place lawfully before withdrawal.

If information is necessary for us to assess whether and how you can safely participate, withdrawing consent may mean that we are unable to continue providing the relevant service.

5. Health information

We collect relevant health information to help us understand whether there are factors that should be considered when you participate in Nuaa classes.

This may include information about injury, medical conditions, pregnancy, postnatal recovery or other relevant health circumstances.

We will not use this information for unrelated marketing purposes.

We ask clients to keep us informed if relevant health circumstances change.

The ICO requires organisations processing special-category data to identify and document both an Article 6 lawful basis and an appropriate Article 9 condition.

6. How your information is collected

We may collect information:

  • directly from you;

  • through Nuaa's website;

  • through our booking and class-management system;

  • through health questionnaires or participation forms;

  • when you email, message or otherwise contact us; and

  • when you attend our classes.

7. Service providers and sharing your information

We use third-party service providers to help operate Nuaa. These may include providers of:

Booking and class management, including Gymcatch.

Payment processing, including Stripe.

Website hosting and website services, including Squarespace.

We may also share information with professional advisers, insurers, regulators or authorities where reasonably necessary or legally required.

We do not sell your personal information.

Where our service providers process personal information outside the UK, we take reasonable steps to ensure appropriate data-protection safeguards apply.

8. How long we keep information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including to meet legal, accounting, insurance and record-keeping requirements.

Different categories of information may therefore be retained for different periods.

Health and screening information will not be retained indefinitely simply because you once attended a Nuaa class. We will periodically review the information we hold and securely delete or anonymise information that is no longer reasonably required.

9. Keeping your information secure

We take reasonable organisational and technical measures to protect personal information from unauthorised access, alteration, disclosure or loss.

Access to health and other sensitive information is limited to those who reasonably require it for the relevant purpose.

10. Marketing

We will only send direct electronic marketing where we have an appropriate lawful basis to do so.

You can unsubscribe from marketing communications at any time using the unsubscribe option provided or by contacting us.

Administrative messages relating to a booking, payment or course are not marketing communications and may still be sent where necessary to provide the service you have requested.

11. Your data-protection rights

Depending on the circumstances, UK data-protection law gives you rights in relation to your personal information, which may include the right to:

  • request access to personal information we hold about you;

  • ask us to correct inaccurate information;

  • ask us to erase information in certain circumstances;

  • ask us to restrict certain processing;

  • object to certain processing;

  • request transfer of certain information; and

  • withdraw consent where processing relies upon consent.

To exercise your rights, contact cathy@nuaacollective.co.uk.

You also have the right to raise a concern with the Information Commissioner's Office (ICO), the UK's data-protection regulator.

Information Commissioner's Office

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our services, systems or legal obligations. The latest version will be published on our website.