​

ORYZEN Massage and Recovery

Last updated: 10 August 2026

Oryzen Massage and Recovery (“we”, “us”, “our”) respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how we collect, use, store and protect personal information when you:

• visit or use our website;

• make an enquiry;

• book or receive a massage treatment;

• provide health, injury or treatment information;

• communicate with us by email, telephone, text message or social media;

• make a payment;

• interact with our marketing;

• use our online booking services; or

• otherwise interact with ORYZEN Massage and Recovery.

This Privacy Policy is intended to comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR), as applicable.

1. Who is responsible for your personal data?

The data controller responsible for your personal information is:

ORYZEN Massage and Recovery
Business address: Oryzen Massage and Recovery is a mobile massage service operating across London. We do not have a customer-facing physical premises.
Email: oryzenmassageandrecovery@yahoo.com
Website: www.oryzenmassageandrecovery.com

For data protection purposes, ORYZEN Massage and Recovery determines why and how your personal information is processed.

If you have any questions about this Privacy Policy or how we handle your information, you can contact us using the details above.

2. What personal information do we collect?

Depending on how you interact with us, we may collect the following categories of information.

Contact and identification information

This may include:

• full name;

• email address;

• telephone number;

• postal address;

• treatment address;

• booking details;

• communication preferences; and

• information you provide when contacting us.

Booking and treatment information

When you book or receive a treatment, we may collect:

• appointment date and time;

• treatment requested;

• treatment history;

• treatment preferences;

• information necessary to safely provide your treatment;

• relevant notes relating to your appointment; and

• information about previous or current injuries or physical conditions that you voluntarily provide.

Health and treatment information

For massage therapy, we may need information about your physical health, injuries, pain, mobility, medications or other circumstances relevant to providing treatment safely.

Some information relating to your health may constitute special category personal data under UK GDPR.

We only collect health information that is reasonably necessary for the relevant treatment, safety, record-keeping or legal purposes.

We will not intentionally collect excessive health information.

Payment information

Payments may be processed through third-party payment providers.

Where a third-party payment provider processes your payment, we generally do not receive or store your full payment card number, security code or other sensitive payment credentials.

We may receive information such as:

• payment status;

• amount paid;

• transaction reference;

• date of payment; and

• limited payment-related information.

Website and technical information

When you use our website, certain technical information may be collected, such as:

• IP address;

• browser type;

• device type;

• operating system;

• approximate location derived from technical information;

• pages visited;

• time spent on pages;

• referring website;

• website interactions; and

• information collected through cookies or similar technologies.

The exact information collected depends on the technologies and third-party services operating on our website.

Marketing information

If you interact with our advertising, social media or marketing content, we may receive information relating to that interaction.

For example, this may include:

• whether you interacted with an advertisement;

• which advertisement or campaign you interacted with;

• website visits resulting from advertising;

• social media interactions; and

• information provided when you contact us through a social media platform.

3. How do we collect your information?

We may collect personal information:

• directly from you;

• when you complete a booking form;

• when you contact us;

• during or following a treatment;

• when you make a payment;

• through our website;

• through our online booking system;

• through cookies and similar technologies;

• through social media platforms;

• through advertising platforms;

• when you subscribe to marketing communications;

• when you leave a review; or

• from third-party services involved in providing our business services.

We generally do not purchase personal information about customers from data brokers.

4. Why do we use your personal information?

We may use your personal information for the following purposes:

Providing our services

To:

• arrange and manage appointments;

• provide massage treatments;

• understand relevant treatment requirements;

• conduct appropriate treatment assessments;

• maintain appropriate treatment records;

• communicate with you about your appointment;

• provide aftercare information;

• manage cancellations or changes; and

• provide customer support.

Managing our business

To:

• maintain business records;

• process payments;

• manage accounts and transactions;

• prevent fraud;

• maintain appropriate insurance and business records;

• deal with complaints;

• establish, exercise or defend legal claims;

• comply with legal obligations; and

• protect the security of our systems and services.

Improving our services

We may use information to:

• understand how customers use our services;

• improve our website;

• improve our booking process;

• improve our treatments and customer experience; and

• analyse general business performance.

Where practical, we may use aggregated or anonymised information for these purposes.

Marketing

Where legally permitted, we may use your personal information to send information about ORYZEN Massage and Recovery, including promotions, services, offers or updates.

We will comply with applicable direct-marketing rules under PECR and UK GDPR.

You can unsubscribe from marketing communications at any time.

5. Our lawful bases for processing

Under the UK GDPR, we must have a lawful basis for processing personal information.

Depending on the circumstances, we may rely on the following lawful bases.

Contract

We may process your information where it is necessary to enter into or perform a contract with you.

For example:

• arranging your booking;

• providing your treatment;

• communicating with you about your appointment; and

• processing information necessary to provide the service you have requested.

Legal obligation

We may process information where necessary to comply with a legal obligation.

This may include obligations relating to:

• accounting;

• taxation;

• financial records;

• legal claims;

• regulatory requirements; and

• other applicable legal obligations.

Legitimate interests

We may process information where necessary for our legitimate business interests, provided those interests are not overridden by your rights and interests.

Examples may include:

• operating and improving our business;

• maintaining customer records;

• preventing fraud;

• managing security;

• responding to enquiries;

• defending legal claims; and

• improving our services.

Where we rely on legitimate interests, we consider whether the processing is necessary and proportionate and whether your rights outweigh our interests.

Consent

In certain circumstances, we may rely on your consent.

Where we rely on consent, you have the right to withdraw it at any time.

Withdrawal of consent does not affect processing that took place before consent was withdrawn.

6. Health information and special category data

Massage treatment may require us to collect information concerning your physical health, injuries or other health-related circumstances.

Certain health information is classified as special category personal data under the UK GDPR and receives additional protection.

We will only process such information where we have both:

1. an appropriate Article 6 lawful basis; and

2. an applicable Article 9 condition for processing special category data.

Where appropriate, we may rely on explicit consent or another lawful condition available to us under data protection law.

Health information will only be collected and used where reasonably necessary for purposes such as:

• assessing treatment suitability;

• identifying relevant contraindications;

• planning and delivering treatment safely;

• maintaining treatment records;

• responding to treatment-related concerns;

• protecting your health and safety; or

• complying with legal obligations.

We will not use your health information for unrelated purposes without an appropriate lawful basis.

7. Treatment records

We may keep records relating to treatments you receive from ORYZEN Massage and Recovery.

Treatment records may include:

• appointment information;

• treatment type;

• relevant treatment notes;

• information you provide about injuries or physical conditions;

• relevant contraindications;

• treatment observations;

• aftercare information; and

• other information reasonably necessary to provide safe and appropriate services.

Treatment records are kept only for as long as reasonably necessary for the purposes for which they were collected, including legitimate business, insurance, legal and record-keeping requirements.

We regularly review the information we hold and aim not to retain personal information for longer than necessary.

8. Who do we share your information with?

We do not sell your personal information.

We may share personal information with carefully selected third parties where necessary to operate our business or provide our services.

These may include:

Website providers

Our website may be hosted or operated using third-party website technology, including Wix.

Wix may process information relating to website visitors and website users as necessary to provide website and related services.

Booking providers

Our online booking system may involve third-party booking technology, including Square.

Square may process information necessary to facilitate bookings, appointments and related services.

Payment providers

Payment information may be processed by third-party payment providers, including Square or other payment services made available to customers.

These providers process payment information under their own privacy policies and terms.

Professional advisers

We may share information with:

• accountants;

• insurers;

• legal advisers;

• professional advisers; or

• other professional service providers,

where reasonably necessary to operate our business, comply with legal obligations or establish, exercise or defend legal claims.

Government authorities and law enforcement

We may disclose personal information where required or permitted by law, including where necessary to:

• comply with a legal obligation;

• respond to lawful requests;

• prevent or detect crime;

• protect someone's safety; or

• establish, exercise or defend legal claims.

Advertising and analytics providers

Where you have given the required consent, our website may use third-party analytics, advertising or tracking technologies.

These may include services provided by companies such as Google, Meta or other advertising and analytics providers used by ORYZEN Massage and Recovery.

The providers used may change over time.

We will only use non-essential cookies and similar technologies where the required consent has been obtained.

9. International transfers

Some of the third-party service providers we use may process personal information outside the United Kingdom.

Where personal information is transferred outside the UK, we will take appropriate steps to ensure that the transfer is lawful under applicable UK data protection legislation.

Depending on the circumstances, this may include:

• an adequacy decision;

• UK International Data Transfer Agreements;

• UK Addendum to approved contractual safeguards;

• appropriate contractual protections; or

• another lawful transfer mechanism.

Where required, we will also implement appropriate supplementary safeguards.

10. How long do we keep your information?

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected.

Different types of information may therefore be retained for different periods.

For example:

Type of informationTypical retention approach

EnquiriesFor as long as reasonably necessary to deal with the enquiry and any resulting relationship

Booking informationFor as long as reasonably necessary for business and record-keeping purposes

Treatment recordsFor as long as reasonably necessary for treatment, insurance, legal and professional record-keeping purposes

Financial recordsFor the period required by applicable tax and accounting obligations

Marketing informationUntil you unsubscribe, object, or the information is otherwise no longer required

Website analytics informationAccording to the applicable analytics provider's retention settings

Cookie consent recordsFor an appropriate period to demonstrate compliance

Legal/complaint recordsFor as long as reasonably necessary to resolve and defend the relevant matter

Retention periods may be extended where necessary to comply with a legal obligation or establish, exercise or defend legal claims.

When information is no longer required, we will securely delete it or anonymise it where appropriate.

11. Data security

We take reasonable and appropriate technical and organisational measures to protect personal information against:

• unauthorised access;

• accidental loss;

• destruction;

• alteration;

• disclosure; and

• other unlawful or unauthorised processing.

Security measures may include:

• password protection;

• access controls;

• secure online systems;

• device security;

• software updates;

• appropriate third-party security measures; and

• limiting access to personal information to people who need it.

However, no method of storing or transmitting information over the internet is completely secure.

We cannot guarantee absolute security, but we will take appropriate steps to protect your information.

12. Your data protection rights

Under UK data protection law, you may have the following rights:

Right to be informed

You have the right to know how and why we process your personal information.

This Privacy Policy provides that information.

Right of access

You may request a copy of the personal information we hold about you.

This is commonly known as a Subject Access Request (SAR).

Right to rectification

You can ask us to correct inaccurate or incomplete personal information.

Right to erasure

In certain circumstances, you can ask us to delete your personal information.

This is sometimes known as the “right to be forgotten”.

This right is not absolute and may not apply where we have a lawful reason to retain the information.

Right to restrict processing

In certain circumstances, you can ask us to restrict how we process your information.

Right to data portability

In certain circumstances, you may have the right to receive personal information you provided to us in a structured, commonly used and machine-readable format and to have it transmitted to another organisation.

Right to object

You may have the right to object to certain processing, including processing based on legitimate interests.

You have an absolute right to object to direct marketing.

Rights relating to automated decision-making

You have rights in relation to certain solely automated decisions that produce legal or similarly significant effects.

ORYZEN Massage and Recovery does not ordinarily make solely automated decisions producing legal or similarly significant effects about customers.

13. How to exercise your rights

To exercise any of your data protection rights, contact:

ORYZEN Massage and Recovery
Email: oryzenmassageandrecovery@yahoo.com
Address:  Oryzen Massage and Recovery is a mobile massage service operating across London. We do not have a customer-facing physical premises.

Please provide enough information for us to identify you and understand your request.

We may need to verify your identity before releasing personal information.

We will normally respond to valid requests within one month.

If your request is complex or you make a large number of requests, the applicable legal time limit may be extended where permitted by law. We will inform you if this applies.

In most circumstances, exercising your data protection rights is free.

14. Direct marketing

We may contact existing customers or prospective customers about ORYZEN Massage and Recovery services, offers or promotions where permitted by applicable law.

Electronic marketing, including email and text marketing, is subject to the Privacy and Electronic Communications Regulations (PECR) as well as UK data protection law.

Where consent is required, we will obtain it before sending relevant marketing communications.

You can unsubscribe from marketing communications at any time.

You can also object to direct marketing at any time.

To unsubscribe, you can:

• use the unsubscribe link included in an email;

• follow the instructions provided in the relevant communication; or

• contact us using the details in this Privacy Policy.

Stopping marketing communications will not prevent us from sending important service-related communications where those communications are necessary, such as appointment confirmations or changes to bookings.

15. Cookies and similar technologies

Our website may use cookies and similar technologies.

Cookies are small files or technologies that can store or access information on your device.

We may use cookies for purposes including:

• website functionality;

• security;

• remembering preferences;

• analytics;

• measuring website performance;

• understanding how visitors use our website;

• advertising; and

• measuring the effectiveness of marketing campaigns.

Strictly necessary cookies

Some cookies may be necessary for the website to function properly.

These may be used without consent where an applicable legal exemption applies.

Non-essential cookies

Analytics, advertising and other non-essential cookies or similar technologies will only be used where the required consent has been obtained.

You should be provided with appropriate choices to accept or reject non-essential cookies.

You can change your cookie preferences through our website's cookie settings where this functionality is available.

Because third-party services and website technology can change, the exact cookies used by our website may change over time.

We will update our cookie information where appropriate.

16. Social media

ORYZEN Massage and Recovery may operate social media accounts, including platforms such as Instagram and TikTok.

If you interact with us through social media, the relevant platform may independently collect and process information about you.

Social media platforms operate under their own privacy policies and terms.

We may receive information that you choose to provide to us through these platforms, such as messages, comments or other interactions.

We are not responsible for the privacy practices of third-party social media platforms.

17. Reviews, photographs and video

We may ask customers whether they would like to provide a review, photograph, testimonial or video relating to our services.

We will not assume that you have agreed to the public use of your photograph, video, testimonial or other identifiable content simply because you have received a treatment.

Where appropriate, we will obtain the necessary permission before using identifiable customer content for marketing or promotional purposes.

If your image, name, voice, testimonial or other identifiable information is used with your permission, you may withdraw that permission for future use by contacting us.

Withdrawal of permission does not necessarily require us to remove material that has already been lawfully published where removal is technically impossible or disproportionate, but we will consider reasonable requests.

18. Children and young people

Our services are primarily intended for adults.

We do not knowingly collect personal information from children except where necessary to provide a service and where an appropriate parent, guardian or other lawful basis is in place.

Where we become aware that we have collected personal information from a child without an appropriate lawful basis, we will take reasonable steps to delete it.

19. Third-party websites

Our website or social media pages may contain links to third-party websites.

These websites operate independently and have their own privacy policies.

We are not responsible for the privacy practices, content or security of third-party websites.

You should review the privacy policy of any third-party website before providing personal information.

20. Data breaches

If we become aware of a personal data breach, we will assess the incident and take appropriate steps in accordance with applicable data protection law.

Where required by law, we will notify the Information Commissioner's Office and/or affected individuals within the applicable legal timeframe.

21. Complaints

If you have concerns about how ORYZEN Massage and Recovery handles your personal information, we encourage you to contact us first so that we can investigate and attempt to resolve the issue.

You also have the right to complain to the UK's data protection regulator:

Information Commissioner's Office (ICO)

Website: [ICO website]

The ICO is the independent supervisory authority responsible for data protection in the UK.

22. Changes to this Privacy Policy

We may update this Privacy Policy from time to time.

Changes may be necessary because of:

• changes to our services;

• changes to the technology we use;

• changes to our suppliers;

• changes to data protection law;

• changes to regulatory guidance; or

• changes to how we process personal information.

The latest version will be published on our website with the relevant “Last updated” date.

We recommend checking this page periodically.

23. Contact us

If you have questions about this Privacy Policy, your personal information, or how ORYZEN Massage and Recovery processes your data, contact:

ORYZEN Massage and Recovery
Email: oryzenmassageandrecovery@yahoo.com
Address: Oryzen Massage and Recovery is a mobile massage service operating across London. We do not have a customer-facing physical premises.
Website: www.oryzenmassageandrecovery.com

Last updated: 10 August 2026