Privacy Policy

BSR Booking is an independent online booking and payment platform for Body Stress Release practitioners in the United Kingdom. We are not the official Body Stress Release Association and are not affiliated with or endorsed by it.

BSR Booking is the data controller for the personal data we process to run the platform. Our full operator and registration details will be published here before we begin processing personal data for live clients. For any privacy question, contact us at hello@bsrbooking.com.

For the personal data of a practitioner's own clients, the practitioner is the controller and we act as their processor; we are the controller for the data we process to operate the platform itself (accounts, billing, site operation).

Practitioners: name, email, phone, practice location, profile details and photo, booking-page settings, and subscription records. Card details are handled by Stripe, not stored by us.

Clients: name, email, phone (if given), booking details, and any notes you add. Card details are handled by Stripe, not stored by us.

Everyone: technical and usage data such as IP address and browser type, plus the essential cookies described below.

To provide the service (accounts, availability, bookings, confirmations, the £19/month subscription): performance of a contract.

To run and secure the platform (support, fraud prevention, basic analytics): our legitimate interests.

To contact practitioners about the service, including a relevant invitation to a publicly-listed practitioner: legitimate interests, with an easy opt out in every message.

Marketing beyond that: only with consent, which you can withdraw at any time.

To meet legal obligations (tax, accounting, lawful requests): legal obligation.

We use a small number of trusted processors and share only what each needs: Stripe (payments), Supabase (database/hosting), Resend (email), and Vercel (hosting). We do not sell your personal data.

Where a provider processes data outside the UK, we rely on UK/EU adequacy or standard contractual clauses to keep your data protected to UK standards.

We keep account and booking data while your account is active and for a reasonable period afterwards to meet legal, tax and accounting requirements (generally up to 6 years for financial records). You can ask us to delete your data sooner, subject to any legal retention we must observe.

You have the right to access, correct, erase, restrict or object to processing, to data portability, and to withdraw consent where we rely on it. To exercise any of these, contact hello@bsrbooking.com. You can also complain to the Information Commissioner's Office (ico.org.uk), though we would appreciate the chance to put things right first.

We use only the cookies needed to run the site and keep you signed in. If we ever add non-essential cookies, we will ask for your consent first.

We take reasonable technical and organisational measures to protect your data, including encryption in transit, access controls, and reputable providers. Payment card data is handled entirely by Stripe under PCI-DSS standards.

The platform is intended for adults. We do not knowingly collect data from children through the site. Where a session is booked for a minor, the adult making the booking and the practitioner are responsible for that relationship.

We may update this policy and will post the new version here with an updated date; significant changes will be notified to account holders.

hello@bsrbooking.com