Last updated: 11 July 2026
| Who this document applies to Clients, prospective clients, Therapists, provider personnel, website visitors, account holders, room partners, suppliers and other people whose personal information is processed through the Wellbeing Rooms platform. |
1. Controller and contact details
The controller is Purely Nordic Ltd trading as Wellbeing Rooms, company number 11865119, of 107 Sherland Road, Twickenham TW1 4HB, United Kingdom.
Privacy enquiries and data-protection complaints can be submitted electronically at https://wellbeingrooms.com/contact-page/ or by post to the registered address marked “Privacy”.
You may complain to the UK Information Commissioner’s Office (ICO). We ask that you contact us first so we can investigate. We will acknowledge a data-protection complaint within 30 days and respond without undue delay.
2. Our role and scope
Wellbeing Rooms is a digital marketplace and technology provider, not a therapist or healthcare provider. Therapists are independent controllers for their clinical records, therapy content, safeguarding records and professional communications outside the platform. This Privacy Policy covers our platform processing, not a Therapist’s separate clinical processing.
3. Data-minimisation and sensitive information
• The platform is not designed to store therapy notes, diagnoses, treatment plans, detailed medical records, safeguarding files or session recordings.
• Do not put detailed clinical or highly sensitive information into general booking, message, review, support or profile fields. Use the secure process designated by the Therapist for clinical information.
• The fact that a person searches for or books therapy, selected issue categories, accessibility needs or matching preferences may reveal or imply health or other sensitive information. We treat such information with additional safeguards.
4. Personal information we collect
| Category | Examples |
| Identity and contact | Name, username, email, telephone, postal address where needed, age confirmation, account identifiers and authentication information. |
| Account and booking | Therapist viewed or selected, appointment time, duration, location or online option, availability, booking status, cancellations, attendance status, high-level preferences and booking references. |
| Provider and professional | Profile, image, biography, qualifications, professional membership or registration, insurance, identity and bank verification, tax status, fees, availability, complaints and platform-performance information. |
| Payment and transaction | Amounts, currency, receipts, refunds, chargebacks, payout records, processor tokens, limited card metadata, invoices, fraud and risk signals. We do not normally store full card details. |
| Communications and content | Platform messages, contact forms, support tickets, emails, complaints, reviews, feedback, surveys and administrative records. |
| Technical and usage | IP address, device and browser information, operating system, logs, security events, cookie identifiers, page interactions, approximate location and analytics data. |
| Marketing | Communication preferences, consents, opt-outs, campaign interactions and referral source. |
| Room, access and safety | Room bookings, access records, incident and damage reports, and venue CCTV or access information where a venue separately provides notice. |
| Limited special-category data | High-level wellbeing or therapy preferences, issue categories, accessibility information and information inherently revealed by seeking or booking therapy. We do not seek clinical records. |
5. How we collect information
• Directly from you when you browse, register, create a listing, search, book, pay, communicate, review, request support or use a room.
• From a Therapist, client, clinic, venue, professional body, insurer, payment provider, identity or fraud provider, supplier or public register where relevant to verification, booking, payment, safety or legal compliance.
• Automatically from devices, cookies, logs and similar technologies.
6. Purposes and lawful bases
| Purpose | Typical basis |
| Provide accounts, listings, search, booking, calendars and communications | Contract; legitimate interests in operating and securing the marketplace. |
| Process payments, payouts, refunds, accounting and chargebacks | Contract; legitimate interests; legal obligations for tax, accounting, fraud and records. |
| Verify Providers and manage platform safety | Legitimate interests in trust, fraud prevention, quality and safety; legal obligations where applicable. |
| Handle support, complaints, disputes, safety incidents and legal claims | Contract; legitimate interests; legal obligation; vital interests in rare emergencies; establishment, exercise or defence of legal claims where sensitive data is involved. |
| Use optional health or wellbeing preferences for matching or booking | Article 6 contract or consent as appropriate; explicit consent under Article 9 where required, or another lawful Article 9 condition in exceptional circumstances. |
| Send booking, payment, security and legal service messages | Contract; legitimate interests; legal obligation. |
| Marketing and promotions | Consent where required by PECR or local law; lawful soft opt-in where available; legitimate interests for permitted business-to-business communications. Opt-out is always available. |
| Analytics, development, security and fraud prevention | Legitimate interests; consent for non-essential cookies or tracking where required. |
| Comply with law and protect rights | Legal obligation; legitimate interests; legal claims; recognised legitimate interests where applicable under UK law. |
7. Special-category and consumer health data
Where an identified or identifiable person’s use of the platform reveals health, sexual life, sexual orientation, racial or ethnic origin, religion or another protected category, we apply an Article 6 lawful basis and an Article 9 condition. For optional high-level therapy preferences, the usual Article 9 condition is explicit consent. Consent can be withdrawn prospectively, although we may retain information where another lawful ground applies, including legal claims, fraud prevention, safeguarding or legal duties.
We do not use therapy search, matching or booking information for targeted advertising. We prohibit the routine disclosure of those fields to advertising providers. The separate United States Consumer Health Data Privacy Notice applies where relevant.
8. Sharing personal information
We may share the minimum necessary information with:
• Therapists and clinics you contact or book, and clients who need Provider profile, availability, fee and booking information;
• payment processors, banks, fraud-prevention, identity-verification, accounting and tax providers;
• website hosting, marketplace, booking, calendar, video, messaging, email, SMS, customer-support, security, analytics and other technology suppliers;
• room partners, landlords and venue operators for access, safety, incidents and bookings;
• professional advisers, auditors, insurers, finance providers, investors, purchasers or successor businesses under confidentiality and due-diligence safeguards; and
• professional bodies, regulators, safeguarding authorities, tax authorities, courts, law enforcement and public bodies where disclosure is required or lawful.
We do not sell personal information for money. Some non-health cookie or advertising disclosures may be treated as “sale”, “sharing” or targeted advertising under certain US laws; where applicable, we provide required controls. We do not sell Consumer Health Data.
9. International transfers
We are based in the United Kingdom and may use suppliers or interact with users in other countries. Where a restricted transfer occurs, we use a lawful mechanism such as UK adequacy regulations, an EU adequacy decision, the UK International Data Transfer Agreement, the UK Addendum to EU Standard Contractual Clauses, EU Standard Contractual Clauses, the UK Extension or EU-US Data Privacy Framework where applicable, or another permitted safeguard. We assess supplementary measures where required.
10. Retention
| Record | Typical period |
| Account and contract records | While active and generally up to 6 years after closure or the end of the relationship. |
| Booking, payment, payout and tax records | Generally 6 years after the relevant financial period, or longer where legally required. |
| Provider verification and insurance | While listed and generally up to 6 years after delisting, subject to complaints or legal claims. |
| High-level matching preferences | Only as long as needed for matching or booking and ordinarily no longer than 12 months after last relevant use, unless retained by the user or needed for a claim or legal duty. |
| Routine platform messages and support | Normally up to 3 years after last activity; complaint, dispute, safeguarding and legal records may be kept up to 6 years or longer if necessary. |
| Security and technical logs | Usually 12 to 24 months, or longer where required to investigate security, fraud or abuse. |
| Marketing preferences | Until opt-out and afterwards as a suppression record so the opt-out can be honoured. |
| Backups | Until overwritten or securely retired under the applicable backup cycle, subject to isolation and restricted use. |
These are maximum or typical periods, not promises to retain every record for the full period. We may delete or anonymise earlier and may retain longer for legal claims, fraud, safeguarding, regulatory investigation, litigation hold or another legal requirement.
11. Security
We use measures proportionate to risk, including access controls, least-privilege permissions, confidentiality duties, secure hosting, encryption in transit, encryption at rest where supported, multi-factor authentication for appropriate administrative access, logging, monitoring, backups, supplier diligence, testing and incident response. No internet service can guarantee absolute security. Keep credentials confidential and report suspected compromise promptly.
12. Your rights
Depending on applicable law, you may have rights to access, correction, erasure, restriction, objection, portability, withdrawal of consent, objection to direct marketing and complaint. We may verify identity and may limit a request where law permits, including for another person’s rights, legal claims, tax records, fraud prevention, safety or security.
For a Therapist’s clinical records, contact the Therapist directly. We will forward a request where appropriate but may not control those records.
13. Data-protection complaints procedure
• Submit the complaint electronically at https://wellbeingrooms.com/contact-page/ or by post marked “Privacy”.
• Explain the concern, the information involved, relevant dates and the remedy sought. Do not include unnecessary clinical detail.
• We will acknowledge the complaint within 30 days, investigate appropriately, keep you informed where needed and communicate the outcome without undue delay.
• You may complain to the ICO at any time. Contacting us first may allow faster resolution.
14. Cookies and similar technologies
• Necessary technologies support login, security, fraud prevention, preferences, bookings and core functions and may operate without consent where law permits.
• We request consent for non-essential analytics, advertising or tracking where required. The cookie banner or settings centre identifies available choices and applicable providers.
• Do not configure advertising tags to receive therapy search terms, issue categories, booking details or other Consumer Health Data. Withdrawing cookie consent does not affect earlier lawful processing.
15. Marketing
We send marketing only where lawful. You can opt out through an unsubscribe facility, account setting or the Contact page. Service messages about accounts, bookings, payments, safety, security and legal updates are not marketing and may still be sent.
16. Automated decisions and ranking
We may use automated tools to rank search results, detect fraud, prioritise support or identify security risk. We do not intend to make a solely automated decision producing a legal or similarly significant effect using special-category data. Where applicable law gives a right to human review, you may request it through the Contact page.
17. Children
The platform is intended for adults. We do not knowingly offer ordinary account or booking services directly to children. If a specifically approved service for a minor is introduced, we will implement age-appropriate design, consent, safeguarding and privacy measures before collection.
18. Non-UK users and representatives
The platform is operated from the United Kingdom. Access from another country does not mean that every service is lawfully available there. Where the EU GDPR or another law requires a local representative, additional notice or registration because we actively offer services in that jurisdiction, the relevant details will be displayed before or when that offering begins.
19. Changes
We may update this policy to reflect law, technology or service changes. We will provide reasonable notice of a material change where required. The current version is displayed on the website.