Privacy Policy

Instinct Moves – Massage & Bodywork

_Last updated: 16-06-2026

Your privacy matters to me. This policy explains what personal data I collect when you visit my website or book a session, why I collect it, how it is protected, and the rights you have under the General Data Protection Regulation (GDPR) and the Dutch implementation act (UAVG).

1. Who is responsible for your data

The "controller" of your personal data is:

  • [Legal/trading name, e.g. Eelke Bosma, trading as Instinct Moves]
  • Address: Hoog Buurlostraat 104, 2573 JB, Den Haag
  • Chamber of Commerce (KvK) number: 71822291
  • Email: info@instinctmoves.com
  • Website: instinctmoves.com

If you have any questions about this policy or your data, you can contact me at the email above.

2. What data I collect

Depending on how you interact with Instinct Moves, I may collect:

  • Identity and contact details: name, address, phone number, email address.
  • Booking and payment details: appointment dates, services booked, package history, and payment confirmation. (Card details are handled by my payment/booking provider, not stored by me directly.)
  • Health and wellbeing information: the information you provide on the intake form and during sessions — for example relevant medical history, injuries, pregnancy, medication, areas of concern, and your comfort levels regarding touch. Brief session notes may be kept to provide safe, continuous care.
  • Website data: if my website uses cookies or analytics, limited technical data such as IP address and browsing behaviour may be collected.

Special category data. Health information is "special category" personal data under the GDPR and receives extra protection. I only collect it with your explicit consent and only what is necessary to deliver a safe session.

3. Why I use your data, and the legal basis

Purpose Legal basis (GDPR)
Scheduling, confirming, and managing your appointments Performance of a contract
Assessing suitability and tailoring sessions safely (intake, session notes) Your explicit consent (special category / health data)
Sending you appointment confirmations, reminders, or changes Performance of a contract / legitimate interest
Invoicing and meeting tax and accounting obligations Legal obligation
Responding to your enquiries Legitimate interest / consent
Website functionality and analytics (if applicable) Consent (cookies) / legitimate interest

You can withdraw consent at any time (see Section 7). Withdrawing consent does not affect processing already carried out, and some records may still need to be kept to meet legal obligations.

4. Who I share your data with

I do not sell your data or share it for marketing. I only share data where necessary to run the practice, including with:

  • Booking and scheduling software — [e.g. Acuity Scheduling / Squarespace].
  • ClassPass — if you book through ClassPass, your booking data is processed by them under their own privacy policy.
  • Payment provider — Stripe to process payments.
  • Accountant / tax authorities — where legally required.

These providers act as "processors" on my behalf and are bound to protect your data. Some of them are based outside the European Economic Area (for example in the United States); where that is the case, appropriate safeguards such as the EU Standard Contractual Clauses are in place. [Confirm which of your providers are non-EEA and that safeguards exist.]

I may also disclose data where I am legally obliged to, or where there is a serious risk to someone's safety.

5. How long I keep your data

  • Health and session records: kept only as long as needed to provide safe, continuous care, and then securely deleted.
  • Invoices and financial records: kept for 7 years, as required by Dutch tax law.
  • Booking/contact data: removed when no longer needed, unless you ask me to keep it for future appointments.

6. How your data is protected

I take reasonable technical and organisational measures to keep your data secure, including limited access, secure storage of records, and using reputable software providers. No system is completely secure, but I work to minimise risk and will inform you and the relevant authority of any serious data breach as required by law.

7. Your rights

Under the GDPR you have the right to:

  • Access the personal data I hold about you.
  • Rectify inaccurate or incomplete data.
  • Erase your data ("right to be forgotten"), subject to legal retention limits.
  • Restrict or object to certain processing.
  • Data portability — receive your data in a usable format.
  • Withdraw consent at any time.

To exercise any of these, email me at info@instinctmoves.com. I will respond within one month.

8. Complaints

If you are unhappy with how I handle your data, you have the right to lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). I would appreciate the chance to resolve any concern with you first.

9. Changes to this policy

I may update this policy from time to time. The latest version will always be available on instinctmoves.com, with the "last updated" date shown at the top.

Instinct Moves – Massage & Bodywork