Privacy policy

Who is responsible

This site is run under the trading names Body Recovery & Contouring Studio and Gabi Med Pro, at 5 Friary Ln, Tralee, Co. Kerry, V92 CH9W. The business behind those names decides how and why your personal data is used here, and answers at [email protected].

What we collect, why, and on what basis

When you book: your name, email address, phone number, the session, the time, the amount, a payment reference and the note you chose to write. We use this to give you the appointment you asked for, to send the confirmation and the reminder the day before, and to let you move or cancel it. Legal basis: the contract between us (GDPR Article 6(1)(b)).

Records of appointments and payments are kept because tax law requires a business to keep them. Legal basis: a legal obligation (Article 6(1)(c)).

When you use the enquiry form: your name, contact details and your message. We use them to answer you and for nothing else. Legal basis: the steps you asked us to take before any contract (Article 6(1)(b)).

When you sign in to your account, and when the studio signs in to its panel or opens a client record, the time, the IP address and the browser are written down so that the action can be traced later. Legal basis: our legitimate interest in keeping the site and your bookings secure and in preventing fraud (Article 6(1)(f)).

When you agree to something on this site, such as the booking terms or the studio letter, we record which version of the words you saw, when, your IP address and your browser. That is the evidence that you agreed, and it is kept with the consent for as long as the consent matters. Legal basis: the obligation to be able to show that you agreed (Article 7(1)).

We do not ask for health information anywhere on this site, and there is no field on any form that is meant to hold it. Please keep anything about your health for the studio itself, where it is discussed rather than stored.

The studio letter

If you tick the box for the studio letter, we keep your email address, your first name, your language, and the time and IP address at which you ticked it. We use them to send you the letter, about once a month, and for nothing else. Legal basis: your consent (Article 6(1)(a)), which is also what Irish law requires for marketing email (S.I. 336/2011, regulation 13). Every letter carries a link that stops it in one click, and stopping it changes nothing about your bookings. The box is never ticked for you and is never part of the booking terms.

Who else sees it

Stripe takes the deposit. Your card details go to Stripe and never reach this site. The payment description is "appointment deposit" with your reference, never the session.

Resend sends every email this site sends: confirmations, reminders, notices when something changes, sign-in codes and the studio letter. The address list for the letter is held there too. Resend keeps the content of a sent email for thirty days and then deletes it. No email says what your appointment is for.

Cloudflare sits in front of the site. Every request passes through it, which is what protects the site from attacks and bots, and its Turnstile check is what stands between a form and a script. Cloudflare sees your IP address and your browser as part of that.

Hetzner hosts the site and the database, in Germany.

Stripe, Resend and Cloudflare are companies based in the United States. Where your data leaves the European Economic Area through them, it does so under the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework, which each of them has in place. Nothing else leaves the EEA.

The Google map on the contact page loads only after you press it, so nothing reaches Google until you ask for it.

Cookies

Visiting this site sets no cookies. After you sign in, one cookie keeps you signed in; it is what makes the account page yours. Cloudflare may set a security cookie of its own while it checks that a request is not an attack. While a booking is in progress, your reference and the time your slot is held until sit in your own browser's storage so you can come back to the payment; the server never reads it. Nothing else is set unless you say so: the banner at the bottom of the page asks once whether Google Analytics may count visits (with your address shortened) and whether a campaign pixel may run, and both stay off until you tick them. Your answer is kept in your browser for six months, you can change it any time under "Cookie settings" at the bottom of this page, and refusing costs you nothing on this site.

How long we keep it

Appointments and payments: six years, because tax law says so. Enquiry messages: twelve months. Your sign-in session: thirty days, or until you sign out. Sign-in codes and the counters that slow down repeated attempts: a day at most. The studio letter list: until you leave it, and then only the fact that you left. The record of who opened which client record and when is kept as long as the records it protects, because it is what shows they were handled properly. A job runs every day and deletes what has passed its time. Anything you ask us to delete before then, we delete, except what the law requires us to keep.

Your rights

You can ask for a copy of what we hold, ask us to correct it, ask us to delete it, ask us to stop using it, and object to how we use it. Where we rely on your consent, you can withdraw it at any time, as easily as you gave it, and that does not undo anything done before. The data you gave us for your bookings or the letter, you can have in a plain machine-readable file to take elsewhere. Write to [email protected] and you will hear back within a month. If you are not happy with the answer, you can complain to the Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963, dataprotection.ie.

Changes

If this page changes, the version and date at the bottom change with it. Anything you already agreed to stays as it was written on the day you agreed.

Last updated 12 September 2026