Privacy Policy

Last Updated: 15 September 2026

1. Introduction

Your privacy is important to us.

This Privacy Policy explains how Jan Normanton collects, uses, stores, shares and protects your personal information when you engage with our services, visit our websites, attend events, purchase products, enrol in courses or training programmes, or otherwise interact with our business. We are committed to processing personal information lawfully, fairly and transparently in accordance with:
 
•UK General Data Protection Regulation (UK GDPR)
•Data Protection Act 2018 •Privacy and Electronic Communications Regulations (PECR)
•Other applicable UK data protection legislation  

2. Who We Are

The Data Controller responsible for your personal information is: Jan Normanton Trading as:
•Embodied Therapies
•Return to Resilience
•The Soma Method
•The Soma Massage Method

Contact details: Email: hello@embodiedtherapies.co.uk

If you have any questions about this Privacy Policy or how your information is handled, please contact us using the details above.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO): https://ico.org.uk

We would appreciate the opportunity to address your concerns first.  

3. Services Covered by this Policy

This Privacy Policy applies to:

•Bodywork and therapeutic services
•Return to Resilience
•The Soma Method
•The Soma Massage Method
•Practitioner Training Programmes
•Online courses and memberships
•Workshops and retreats
•Educational events
•Marketing communications
•Website visitors
•Future wellbeing, educational and training services operated by Jan Normanton  

4. Age Requirement

Our services are intended for adults aged 18 years and over.

We do not knowingly collect personal information from individuals under the age of 18, unless consented for and signed by the individual’s primary and lawful caregiver.  

5. Personal Information

We Collect We may collect and process the following categories of personal information.

Identity Data This may include:
•First name
•Last name
•Title
•Date of birth (where relevant)

Contact Data

This may include:
•Postal address
•Billing address
•Email address
•Telephone number

Transaction Data
This may include:
•Products purchased
•Services booked
•Memberships
•Programme enrolments
•Payment history

Financial Data
Payment card information is processed by secure third-party providers such as Stripe and PayPal.

We do not have access to your complete payment card details and do not store them on our systems.

Technical Data
This may include:
•IP address
•Browser type
•Device information
•Operating system
•Time zone setting
•Website activity

Profile Data
This may include:
•Account details
•Course participation
•Preferences
•Feedback
•Survey responses

Usage Data
Information about how you use our websites, products and services.

Marketing and Communication Data
This may include:
•Marketing preferences
•Newsletter subscriptions
•Communication preferences
•Preferences regarding promotional content  

6. Programme and Training Data
If you enrol in Return to Resilience, The Soma Massage Method or any educational programme, workshop, retreat or practitioner training, we may collect:
•Registration information
•Attendance records
•Progress records
•Exercise submissions
•Assessment outcomes
•Certification records
•Feedback forms
•Programme participation records
•Community participation data
•Communications relating to programme delivery

This information is processed for programme administration, learner support, certification, quality assurance and service improvement purposes.  

7. Special Category Data
Due to the nature of our work, you may voluntarily provide information relating to:
•Physical health
•Emotional wellbeing
•Stress
•Burnout
•Trauma experiences
•Mental wellbeing
•Lifestyle factors

This information may constitute Special Category Data under UK GDPR.

Where Special Category Data is processed, we rely upon one or more of the following:
•Your explicit consent
•The provision of services requested by you
•The establishment, exercise or defence of legal claims
•Other lawful conditions permitted under Article 9 UK GDPR

We implement appropriate safeguards to protect Special Category Data and restrict access only to those who require it for legitimate business purposes.

We do not knowingly collect information relating to criminal convictions unless legally required to do so.  

8. Treatment Records
Where you attend bodywork, wellbeing or therapeutic sessions, we may retain treatment-related information including:
•Consultation forms
•Health information voluntarily provided by you
•Consent forms
•Treatment records
•Session notes
•Relevant communications

We only retain information necessary for the safe and effective delivery of services and compliance with professional, legal and insurance obligations.  

9. Training Case Studies

Participants attending practitioner training programmes may discuss case studies and professional experiences for educational purposes.

Participants should avoid sharing unnecessary personal information relating to third parties and should anonymise identifying information wherever possible.  

10. How We Collect Information

We collect information in several ways.

Direct Interactions

You may provide information by:
•Booking treatments
•Purchasing products
•Joining programmes
•Registering for events
•Completing forms
•Completing questionnaires
•Subscribing to newsletters
•Communicating with us by telephone, email or online

Automated Technologies
 
We may collect information automatically through:
•Cookies
•Analytics platforms
•Website logs
•Similar technologies

Please refer to our Cookie Policy for further information.

Third-Party Sources

We may receive information from service providers including:
•Stripe
•PayPal
•ActiveCampaign
•New Zenler
•Zoom
•Cal.com
•Zapier
•Google Analytics
•Meta (Facebook and Instagram)
•Website hosting providers

These providers may change from time to time as our services evolve.  

11. How We Use Personal Information

We use personal information to:
•Provide services and products
•Deliver training programmes and courses
•Manage bookings and registrations
•Process payments
•Provide customer support
•Maintain business records
•Improve services
•Ensure participant safety
•Issue certifications
•Comply with legal obligations
•Send marketing communications where permitted  

12. Lawful Bases for Processing

We rely on one or more of the following lawful bases:

Contract
Where processing is necessary to fulfil an agreement with you.

Legitimate Interests
Where processing is necessary to:
•Operate and improve our business
•Protect our services
•Understand customer needs
•Maintain records

We always balance our legitimate interests against your rights and freedoms.

Consent

Where you have given consent, including certain marketing activities and processing of Special Category Data where required.

Legal Obligation

Where processing is necessary to comply with legal, regulatory, taxation or insurance requirements.  

13. Marketing Communications

You may receive marketing communications from us if:
•You have subscribed to receive them;
•You have requested information; or
•You are an existing customer and applicable law permits us to contact you regarding similar products, services, courses or events.

You may unsubscribe at any time by:
•Clicking the unsubscribe link in our emails; or
•Contacting us directly.

We do not sell or rent personal information to third parties.  

14. Disclosure of Personal Information

We may share information with trusted service providers where necessary, including:
•Payment processors
•Learning management systems
•Marketing platforms
•Website hosts
•Cloud storage providers
•Accountants
•Solicitors
•Insurers
•IT support providers
•Regulatory authorities where legally required

All third parties are required to process information securely and in accordance with applicable data protection legislation.  

15. International Data Transfers

Some third-party providers may process personal information outside the United Kingdom.

Where this occurs, we ensure that suitable safeguards are in place, including:
•UK Adequacy Decisions
•International Data Transfer Agreements (IDTAs)
•UK Addendum to Standard Contractual Clauses
•Other lawful transfer mechanisms recognised under UK GDPR

Further information regarding international transfer safeguards is available upon request.  

16. Data Security

We implement appropriate technical and organisational measures designed to protect personal information from:
•Unauthorised access
•Accidental loss
•Alteration
•Disclosure
•Misuse

Access is restricted to individuals who require information for legitimate business purposes.

We maintain procedures to manage suspected data breaches and will notify relevant authorities and affected individuals where required by law.  

17. Data Retention

We retain personal information only for as long as reasonably necessary. Typical retention periods include:
Treatment Records Up to seven years following the final appointment unless a longer retention period is legally required.
Financial Records At least six years in accordance with UK accounting and tax requirements.
Training and Certification Records For as long as reasonably necessary to verify qualifications, certifications and professional training history. Marketing Data Until consent is withdrawn or you unsubscribe.
Programme Participation Records For the duration of participation and for a reasonable period afterwards to support administration, certification and legal obligations.

Where appropriate, personal information may be anonymised and retained for statistical, research or business development purposes.  

18. Certification Records

Where participants complete professional training programmes, including The Soma Massage Method, we may retain records relating to:
•Attendance
•Assessments
•Qualification outcomes
•Certification status
•Continuing Professional Development activities

We may also process reasonable verification requests where a participant requests confirmation of training completion or certification status.  

19. Photography, Video and Testimonials

Photographs, video recordings, testimonials and participant feedback may be collected during workshops, retreats, training programmes and events.

Explicit consent will be obtained before identifiable photographs, videos or testimonials are used for marketing or promotional purposes.

You may withdraw consent for future use at any time.

Withdrawal of consent does not affect material lawfully published before consent was withdrawn.  

20. Automated Decision Making

We do not undertake automated decision-making or profiling that produces legal or similarly significant effects on individuals.  

21. Your Rights Under UK GDPR you may have the right to:
•Access your personal information
•Correct inaccurate information
•Request deletion of information
•Restrict processing •Object to processing
•Request transfer of information
•Withdraw consent
•Lodge a complaint with the ICO.

Requests should be submitted to: hello@embodiedtherapies.co.uk We will normally respond within one month.  

22. Third-Party Websites

Our websites may contain links to third-party websites. We are not responsible for their privacy practices and recommend reviewing their privacy policies before submitting personal information.  

23. Cookies

Our websites use cookies and similar technologies to:
•Enable website functionality
•Measure website performance
•Analyse visitor behaviour
•Improve user experience
•Support marketing and advertising activities

Non-essential cookies, including analytics and advertising cookies, will only be placed on your device where you have given consent. You can manage cookie preferences through your browser settings and our cookie consent tools. Please refer to our Cookie Policy for further information.  

24. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in legislation, regulatory guidance or business practices.

The latest version will always be published on our website and the effective date shown at the top of this document.  

Contact Jan Normanton Embodied Therapies | Return to Resilience | The Soma Method | The Soma Massage Method

Email: hello@embodiedtherapies.co.uk

If you have any questions regarding this Privacy Policy or your personal information, please contact us using the details above.