Privacy Notice

1. Who We Are (Data Controller)

This Privacy Notice applies to all personal data collected by PilatesCOREuk Ltd ("we", "us", "our"), a company registered in England and Wales. We operate the website backtoyou.pilatescoreuk.com and provide the "Back to You" spinal rehabilitation coaching programme led by Kim Karlsson, Level 4 Low Back Pain Rehabilitation Specialist and Clinical Pilates Instructor.

If you have any questions regarding this policy or how your data is handled, please contact our Data Protection Lead:

• Entity: PilatesCOREuk Ltd
• Lead Specialist: Kim Karlsson
• Registered Location: Upminster, Essex & Online (United Kingdom)
• Direct Contact Email: kim@pilatescoreuk.com

2. The Personal Data We Collect

Depending on how you interact with our website, services, and programmes, we may collect and process the following categories of data:

• Identity & Contact Details: First and last name, email address, phone/WhatsApp number, and postal address (if required for physical materials or billing).
• Health & Clinical Screening Information: When you complete a questionnaire, inquiry form, or consultation screening, you may provide information regarding back pain history, previous medical diagnoses (e.g., disc herniations, sciatica, stenosis), exercise limitations, pain severity, and lifestyle habits. Because this relates to health, it is classified as Special Category Personal Data under UK GDPR Article 9.
• Communication Records: Emails, SMS messages, inquiry forms, and consultation notes generated during your interactions with Kim Karlsson and our team.
• Technical & Usage Data: Internet Protocol (IP) address, browser type and version, time zone setting, operating system, page interaction data (such as scrolling, clicks, and video view duration), and campaign referral parameters (UTM tags).

3. Lawful Bases for Processing (UK GDPR Articles 6 & 9)

We only collect and process personal data when we have a valid lawful basis under the UK General Data Protection Regulation:

• Consent (Article 6(1)(a)): When you voluntarily request free resources (such as our 3-Part Video Routine or Core Reset Guide) or opt in to receive educational email updates from Kim Karlsson.
• Explicit Consent for Health Data (Article 9(2)(a)): When you voluntarily disclose back pain history, symptoms, or physical restrictions on booking forms so Kim Karlsson can assess your suitability for rehabilitation coaching and ensure exercises are safe for your specific spine.
• Contractual Necessity (Article 6(1)(b)): When processing is required to deliver the "Back to You" coaching programme, process payments, schedule consultations, and maintain ongoing coaching support.
• Legitimate Interests (Article 6(1)(f)): For running our website efficiently, securing our edge infrastructure against cyber threats, analysing page performance to improve user experience, and managing customer service.
• Legal Obligation (Article 6(1)(c)): To maintain statutory financial records, tax compliance, and clinical insurance records as required by UK law.

4. How We Use Your Data

We utilise your information specifically for the following purposes:

• To instantly deliver requested digital guides, videos, and rehabilitation resources to your inbox.
• To conduct clinical triage and suitability screening prior to accepting applicants into the 6-Week "Back to You" programme.
• To schedule, confirm, and host your 30-Minute Back Pain Breakthrough Consultations.
• To tailor movement modifications and exercise sequences to your individual back condition.
• To communicate service updates, appointment reminders, and relevant spinal health education.
• To monitor website functionality, troubleshoot errors, and prevent malicious traffic.

5. Third-Party Data Processors

We work with vetted third-party service providers (data processors) who handle data on our behalf under strict data processing agreements ensuring UK GDPR compliance:

We never sell, rent, or lease your personal information to any third parties for their own independent marketing purposes.

6. International Data Transfers

Some of our trusted technical providers (e.g., Cloudflare, GoHighLevel) store or process data on servers located outside the United Kingdom or European Economic Area. In such cases, we ensure adequate safeguards are in place, including the UK International Data Transfer Addendum (IDTA) or approved Standard Contractual Clauses (SCCs), ensuring your personal data receives the equivalent standard of protection as provided under UK law.

7. Data Retention

We only retain your personal data for as long as necessary to fulfil the purposes for which it was collected:

• Inquiry & Lead Data: If you download a free guide or inquire about our services, we retain your contact details for 24 months from your last engagement, unless you choose to unsubscribe sooner.
• Client Coaching & Health Records: In compliance with UK clinical coaching standards, professional indemnity insurance requirements, and statutory tax obligations, records of enrolled clients are retained for 7 years following completion of services.
• Website Analytics Logs: Anonymised and aggregated analytics logs are retained by our analytics providers for up to 13 months.

8. Your Rights Under UK GDPR

Under the UK General Data Protection Regulation and the Data Protection Act 2018, you possess substantial statutory rights regarding your personal information:

• Right to be Informed: You have the right to clear, transparent information on how we collect and use your data (as set out in this notice).
• Right of Access: You can request a copy of the personal data we hold about you (Subject Access Request).
• Right to Rectification: You can request that inaccurate or incomplete information be corrected immediately.
• Right to Erasure ("Right to be Forgotten"): You may request the deletion of your personal data where there is no compelling lawful reason for continued processing (subject to statutory health record retention requirements).
• Right to Restrict Processing: You have the right to block or suppress further processing of your personal data in certain circumstances.
• Right to Data Portability: You may request your data in a structured, commonly used, machine-readable format.
• Right to Object: You can object at any time to processing based on legitimate interests or direct marketing. Every marketing email we send contains an instant one-click unsubscribe link.
• Right to Withdraw Consent: Where processing relies upon your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, simply email Kim Karlsson at kim@pilatescoreuk.com. We will respond within one calendar month in accordance with UK statutory requirements.

9. Lodging a Complaint with the Supervisory Authority

If you believe that our processing of your personal data infringes data protection legislation, we invite you to contact us directly first so we can promptly address your concerns. You also have the right to lodge a formal complaint with the UK's independent data protection regulator:

• Regulator: Information Commissioner's Office (ICO)
• Website: ico.org.uk
• Helpline: 0303 123 1113
• Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

10. Policy Updates

We may update this Privacy Notice periodically to reflect modifications in our operational practices, services, or legal obligations. When updates are published, the "Last Updated" date at the top of this page will be revised.