Website, Customer and Therapist Privacy Notice
Last updated: August 2026
1. Who we are
MASAJ Limited (“MASAJ”, “we”, “us” or “our”) provides massage treatments, memberships, vouchers and related services. MASAJ Limited is the controller responsible for the personal information described in this notice.
Registered office: 86-90 Paul Street, London, EC2A 4NE
Company number: 11352446
General privacy contact: scarlet@masaj.me
Telephone: 0204 511 3384
Data protection queries: contact us at the general privacy contact above and mark your message “Data protection”.
This notice explains how we collect and use personal information relating to customers, website visitors, prospective customers, gift recipients, people who contact us, prospective or current therapists and other service providers where relevant.
2. Personal information we collect
Depending on how you interact with us, we may collect:
identity and contact information, including your name, date of birth, email address, telephone number, postal address and company details where relevant.
booking, membership, voucher and account information, including appointment history, preferences, cancellations and communications about your bookings.
payment and transaction information. Payment card details are generally handled by our payment providers rather than stored directly by MASAJ.
health and treatment information supplied through consultation forms or during a treatment, including medical history, allergies, pregnancy information, injuries, symptoms and relevant lifestyle information.
feedback, reviews, complaints and records of communications with us by email, telephone, live chat, text, social media or in person.
website and device information, including IP address, browser information, cookie identifiers and information about how you use our website, subject to your cookie choices.
photographs, incident details or CCTV information where relevant to safety, security or the investigation of an incident.
therapist and service provider application and engagement information, including qualifications, availability, payment and compliance information.
If you do not provide information we reasonably need, we may be unable to complete a booking, provide a treatment, administer your membership or voucher, assess or manage a therapist application or relationship, respond to you or meet our legal and safety obligations.
3. How we collect personal information
We collect personal information directly from you when you book, purchase, create an account, complete a consultation form, visit a studio, contact us, provide feedback, sign up to receive our newsletter or other marketing communications or apply to work with us. We also collect it from someone who buys a voucher, membership or treatment for you or is authorised to act for you, through our booking, payment, website, communications and security systems, from our therapists and staff where necessary to record treatments or incidents and from service providers or publicly available sources where lawful.
4. How and why we use personal information
We only use personal information where we have a lawful basis. The lawful basis depends on the purpose and may include performance of a contract, compliance with a legal obligation, our legitimate interests or consent.
Providing and administering services
To take bookings, provide treatments, manage memberships and vouchers, process payments, communicate about appointments, handle cancellations and provide customer support.
Lawful basis: Contract, legitimate interests in operating and improving our services.
Health, consultation and treatment information
To assess relevant treatment considerations, communicate necessary information to the therapist providing your treatment, record treatment notes and help provide services safely.
Lawful basis: Contract, where this information is necessary to provide your treatment. Because this may include health information, we ask for your explicit consent through the consultation form. Where information is needed to establish, exercise or defend legal claims, we rely on our legitimate interests and the relevant legal-claims provisions of data protection law.
Payments, accounting and business records
To process transactions, issue refunds, maintain accounting records, prevent fraud and meet tax, audit and other legal obligations.
Lawful basis: Contract, legal obligation, legitimate interests in protecting our business and maintaining accurate records.
Communications, feedback and complaints
To respond to enquiries, manage complaints, investigate concerns, improve service quality and establish or defend legal claims.
Lawful basis: Contract, legal obligation, legitimate interests in customer service, quality control and protecting legal rights.
Safety, security and incident management
To protect customers, staff, therapists, premises and systems, manage accidents or incidents and prevent or investigate misuse, fraud or crime.
Lawful basis: Legal obligation, legitimate interests in safety, security and fraud prevention and protecting someone’s vital interests in an emergency.
Business analysis and improvement
To analyse performance, demand, customer experience and operational efficiency, prepare management information, train staff and improve services and internal processes.
Lawful basis: Legitimate interests in operating, measuring and improving our business. Where analytics relies on non-essential cookies, we also rely on your consent.
Therapist and service provider administration
To assess applications, engage and pay therapists and other service providers and manage availability, quality, insurance, compliance and performance.
Lawful basis: Contract or steps before entering into a contract, legal obligation and legitimate interests in operating and safeguarding our services.
Marketing
To send information about MASAJ treatments, memberships, studios, offers and events and to measure marketing effectiveness.
Lawful basis: Consent where required, where the law allows us to email existing customers about similar services and legitimate interests for appropriate forms of marketing and measurement.
Legal, regulatory and corporate matters
To respond to regulators, law enforcement, auditors and legal advisers, comply with legal duties and manage a sale, investment, reorganisation or other corporate transaction.
Lawful basis: Legal obligation, legitimate interests in governance, compliance and managing corporate transactions.
5. Use of artificial intelligence tools
MASAJ may use approved artificial intelligence (“AI”) tools to support authorised staff with administrative and operational tasks. This may include drafting and reviewing documents, summarising or extracting information from business records, analysing business data, preparing reports and improving internal processes and service quality.
Approved AI tools may be connected to selected MASAJ business systems for defined use cases. Access is limited to named authorised users and to information they are already permitted to access. Where an AI tool processes personal information, staff must minimise the information used, use approved tools only, respect access restrictions and follow our AI, data protection, confidentiality and information security requirements.
AI outputs are subject to human review before they are relied on for material business decisions. We do not use AI to make decisions about customers based solely on automated processing where those decisions would produce legal or similarly significant effects. We do not use AI to diagnose medical conditions or determine clinical suitability for treatment.
We do not permit routine use of health information from client consultation forms in general purpose AI tools. Any proposed use involving health information or other special category information would require specific approval, a documented assessment and appropriate safeguards before it began.
Lawful basis: Our legitimate interests in improving efficiency, consistency, service quality, business continuity and internal controls, provided those interests are not overridden by your rights and interests. Other lawful bases may apply to the underlying activity.
6. Marketing communications
We may send you marketing about MASAJ services, studios, memberships, vouchers, events and offers where you have consented or where the law otherwise permits us to do so, including where the law allows us to email existing customers about similar services.
You can opt out at any time by using the unsubscribe option in a marketing message or by contacting us. Opting out of marketing will not stop service messages that are necessary for your bookings, purchases, memberships or account. We do not sell your personal information or share it with other organisations for their own marketing.
7. Who we share personal information with
We share personal information only where necessary and appropriate, including with:
self-employed therapists who provide your treatment and need relevant booking and consultation information.
booking, payment, banking and accounting providers.
IT, cloud hosting, communications, email, data storage, cyber security and AI service providers.
website, analytics, advertising and marketing service providers, subject to applicable consent and marketing rules.
our telephone answering and live-chat service provider, which acts on our instructions and may use approved technology providers to deliver those services.
professional advisers, insurers, auditors, health and safety advisers and claims handlers.
delivery providers where goods or vouchers are sent by post.
law enforcement, courts, regulators and public authorities where required or permitted by law.
prospective buyers, investors, lenders or advisers in connection with a proposed sale, investment, financing or reorganisation, subject to appropriate confidentiality protections.
Our service providers are required to protect personal information and may use it only for the agreed services and in accordance with our instructions, unless they are independently required to use it by law.
8. International transfers
Some of our service providers or their group companies may store, support or access personal information outside the United Kingdom. Where this involves a restricted transfer, we use an approved transfer mechanism in accordance with applicable data protection law. Information about the safeguards applicable to such transfers can be obtained using the contact details in section 1.
9. How long we keep personal information
We keep personal information only for as long as reasonably necessary for the purposes described in this notice, including legal, accounting, insurance, safety and claims requirements. Retention periods vary according to the information and circumstances. In general:
booking, payment and core customer records are normally kept for up to six years after the relevant transaction or the end of the customer relationship.
treatment consultation forms and treatment notes are normally kept for six years after the last treatment, or longer where required for legal, insurance, safeguarding or claims purposes.
marketing information is kept until you opt out or it is no longer needed. We may retain a minimal suppression record so that we respect your opt-out.
complaint, incident and legal records are kept for a period appropriate to the issue and any relevant limitation period.
website and cookie information is kept in accordance with the periods shown in our cookie settings or cookie policy.
personal information processed through approved AI tools is retained only for as long as necessary for the relevant purpose, in accordance with MASAJ’s retention requirements and the applicable supplier and system settings.
therapist, applicant and supplier records are kept according to the relevant relationship and legal, tax, insurance and claims requirements.
When information is no longer needed, we delete it securely or anonymise it so that it can no longer identify an individual.
10. Your rights
Depending on the circumstances and the lawful basis, you may have the right to:
ask for access to your personal information.
ask us to correct inaccurate or incomplete information.
ask us to delete information in certain circumstances.
ask us to restrict how information is used in certain circumstances.
receive certain information in a structured, commonly used and machine-readable format or ask us to transfer it to another organisation.
withdraw consent at any time, without affecting processing that took place before withdrawal.
raise a complaint about our use of personal information.
Your right to object: where we rely on legitimate interests, you have the right to object to our use of your personal information. You can also object to direct marketing at any time and we will stop using your information for that purpose.
To exercise a right, contact us using the details in section 1. Please explain what you are requesting and provide enough information for us to identify the relevant records. We may request information reasonably necessary to verify your identity, particularly where we have reasonable doubts, but we will not ask for more information than is needed.
11. Keeping personal information secure
We use appropriate organisational and technical measures designed to protect personal information against accidental loss, unauthorised access, misuse, alteration or disclosure. Access is limited to people who have a genuine business need and who are subject to confidentiality and security requirements. We maintain processes for responding to suspected personal-data breaches and will notify affected individuals and the regulator where the law requires us to do so.
12. Cookies, analytics and advertising
Our website uses essential cookies that are necessary for it to function. With your consent, we may also use non-essential analytics and advertising technologies, which may include Google Analytics, Google Ads and Meta advertising technologies. These tools may collect device, browsing and interaction information to help us understand website use, measure campaigns and show relevant advertising.
You can accept, reject or change non-essential cookie choices through the cookie settings on our website. The current list of cookies, providers, purposes and durations is available in our cookie settings or cookie policy. Withdrawing cookie consent does not affect processing that occurred before withdrawal.
13. Links to other websites
Our website may contain links to websites operated by other organisations. We are not responsible for their privacy practices. Please review their privacy and cookie information before providing personal information to them.
14. Data protection complaints
We take concerns about personal information seriously. If you believe we have collected or used your information unfairly, inaccurately, insecurely or otherwise contrary to data protection law, please contact us using the details in section 1 and make clear that you are raising a data protection complaint. Where possible, please use “Data Protection Complaint” in the email subject line.
We will acknowledge receipt of a data protection complaint within 30 days. We will take appropriate steps to investigate it without undue delay, keep you informed as appropriate and tell you the outcome without undue delay.
You can also complain to the Information Commissioner’s Office (“ICO”) at any time, although the ICO recommends giving us an opportunity to complete our complaints process first.
ICO website: https://ico.org.uk/make-a-complaint/
Helpline: 0303 123 1113
Postal address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
15. Changes to this notice
This privacy notice was updated in August 2026 and will next be reviewed by August 2027. We may update it from time to time and the latest version will always be published on our website. Where required by law, or where a change materially affects how we use your personal information, we will also bring it to your attention by an appropriate method.