Privacy notice

Who we are

XLR8 Wellness ("we", "us") operates xlr8wellness.co.uk, an introduction service connecting people in Tyne and Wear with independent health and wellness providers. Our address is Newcastle upon Tyne, Tyne and Wear, United Kingdom. We are the data controller for the personal data described in this notice.

We are registered with the Information Commissioner's Office as a data controller. You can contact our data protection contact at privacy@xlr8wellness.co.uk.

What we collect

When you submit an enquiry we collect:

• Your name, email address and telephone number.
• Your town, and your postcode if you give it.
• The service category you selected, your preferred setting, timing and rough budget.
• Anything you type into the free-text notes box.
• Technical data: your IP address, browser user agent, and the marketing source that brought you to the site.

We deliberately do not ask for health information. The enquiry form asks you not to include medical detail, and our providers are asked to take any clinical history directly from you. If you do type health information into the notes box, we treat it as special category data under Article 9 UK GDPR and rely on your explicit consent to pass it on.

Why we use it, and our lawful basis

We use your data to match you with providers and to run the service:

• To pass your enquiry to matched providers. Lawful basis: your consent (Article 6(1)(a)), and explicit consent (Article 9(2)(a)) for any health information you volunteer. This is the tick box on the enquiry form. You can withdraw it at any time, although we cannot recall an enquiry already sent.
• To operate, secure and improve the service. Lawful basis: legitimate interests in running a functioning marketplace, preventing fraudulent or abusive submissions, and keeping records of the consents we relied on.
• To send you marketing. Lawful basis: your consent, only if you ticked the optional marketing box. Every message has an unsubscribe link.

Who we share it with

We share your enquiry with a maximum of 3 providers, selected because they are approved on our panel, cover your service category, and cover your area. We tell you how many were matched on the confirmation page.

Each provider is an independent data controller for the data we pass them. They are contractually required to use it only to respond to your enquiry, to handle it in line with UK GDPR, and to delete it if you do not proceed. What they do with it after that is their responsibility, and their own privacy notice applies.

We also use service providers who process data on our behalf: our hosting provider, our email delivery provider, and our payment processor (which handles provider payments only; customers never pay us). We do not sell your personal data to anyone, and we do not share it with advertisers.

How long we keep it

Enquiry records are kept for 24 months so we can evidence the consent we relied on, handle any dispute about an introduction, and detect fraudulent submissions. Consent and marketing records are kept for 24 months from your last interaction. After that we delete or anonymise the record.

Your rights

Under UK GDPR you have the right to:

• Ask what personal data we hold about you, and get a copy.
• Have inaccurate data corrected.
• Have your data erased.
• Object to, or ask us to restrict, our processing.
• Withdraw consent at any time.
• Ask for your data in a portable format.
• Complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Email privacy@xlr8wellness.co.uk and we will respond within one month. Please quote your enquiry reference if you have one.

If you message us on WhatsApp

You can reach us on WhatsApp, and the first reply usually comes from an automated assistant rather than a person. We say so plainly here because you have a right to know when you are talking to software.

What we collect: your WhatsApp number, your name as WhatsApp reports it, and the content of what you send. That is what any messaging service requires to reply to you.,Our lawful basis is legitimate interests: answering a question you chose to ask us. If your message becomes a booking, the basis becomes performance of a contract.,The assistant can quote prices, explain what happens in a session and take an enquiry. It cannot give medical advice and it will not try. Anything clinical, any safeguarding concern and any complaint is passed to a person.,Conversations are kept for 24 months on the same basis as an enquiry, then deleted or anonymised.,WhatsApp is operated by Meta, so your messages pass through Meta’s systems and are subject to their terms as well as this notice. We do not control that part.,Say STOP at any time and we will not message you again. You can also block the number, which we cannot override.

Cookies

We use cookies that are needed to make the site work: a session cookie for providers signed into the portal, a cookie that remembers your basket, and a short-lived cookie that keeps your form entries if a submission fails. Those are set without asking, because the site cannot function without them. We also use advertising cookies from Meta (Facebook and Instagram) and TikTok, which let us see which of our ads led to a booking. Those are NOT set unless you accept them in the banner. If you decline, none are set, nothing about the site changes for you, and we do not ask again. You can change your mind by clearing this site’s cookies in your browser, which brings the banner back.

Changes

We may update this notice. The date at the top shows when it last changed.