Privacy Policy

Green Oxygen Hyperbarics Limited ("we", "us", "our") is committed to protecting your personal data. This policy explains what we collect, how we use it, where we store it, and what rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Who we are

Green Oxygen Hyperbarics Limited operates a wellness studio offering mild hyperbaric oxygen therapy (HBOT) at:

Jubilee House, Third Avenue, Globe Park, Marlow, SL7 1EY
Phone: 07378 271411
Email: tommy@greenoxygenhbot.com

For the purposes of UK GDPR, we are the data controller for the personal data we hold about you.

What data we collect

When you create an account

• First name and last name
• Email address
• Phone number
• Password (stored as a one-way cryptographic hash, never in plain text)
• If you book a free first session: a short note about why you're interested in HBOT (up to 200 characters)

When you book sessions

• The date and time of each booking
• The type of session and how it was paid for
• Cancellation timestamps and whether they fell within our 24-hour window
• Your remaining session balance and a log of every change to it

When you visit the site

So we can see roughly how many people visit the site each day, your browser stores a random ID — a string of characters with no link to your name, account, or device. On our own server we log only that ID and the calendar date, and we dedupe so you're counted once per day. We do not log your IP address, location, browser, device, referrer, or which pages you view, and we do not use third-party analytics like Google Analytics or Meta Pixel. If you clear your browser storage your next visit looks like a brand-new anonymous visitor — there is no way for us to recognise you again.

What we do NOT collect

• Card or banking details — payment is handled by Stripe; we never see or store your card number
• Medical history, GP details, or health records are not stored online. We will ask you about relevant medical conditions and their history in person or over the phone before your first session, but this information is never captured through the website or held in our database
• Your location, device fingerprint, or browsing history
• Marketing tracking cookies, pixels, or third-party analytics that profile you

Lawful basis for processing

We rely on the following lawful bases under UK GDPR Article 6:

• Performance of a contract — to deliver the sessions you've booked, manage your account, and process payments
• Legitimate interests — to communicate with you about your bookings, prevent fraud, and improve the studio
• Legal obligation — to keep accounting records as required by HMRC

Where your data is stored

All personal data is stored on servers located in the United Kingdom, operated by Supabase Inc. on Amazon Web Services (AWS) infrastructure in the London region. No personal data is transferred outside the UK in the normal course of operating this service.

Payment processing is handled by Stripe, Inc., a payment processor regulated in the UK by the Financial Conduct Authority. Stripe receives only what is needed to process the transaction and is itself a data controller for that information. See Stripe's privacy policy for details.

How long we keep your data

• Account information: for as long as your account is active, plus 30 days after you request deletion
• Booking records: for 7 years from the date of the booking, as required for HMRC tax records
• Cancelled / inactive accounts: automatically reviewed for deletion after 36 months of inactivity

Your rights under UK GDPR

You have the right to:

• Access a copy of all personal data we hold about you
• Rectify any inaccurate or incomplete information
• Erase your personal data ("right to be forgotten") subject to our legal obligations
• Restrict how we process your data
• Object to processing based on legitimate interests
• Portability — receive your data in a machine-readable format
• Withdraw consent at any time where we relied on consent

To exercise any of these rights, email us at tommy@greenoxygenhbot.com. We will respond within 30 days.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk if you believe we have mishandled your data.

Cookies

We use only essential cookies required to keep you signed in and to remember whether you've accepted this notice. We do not use marketing, advertising, or third-party tracking cookies of any kind. There are no third-party trackers on this site. The only usage data we keep is the simple, first-party anonymous visitor count described under "When you visit the site" above (a random ID stored locally in your browser, not a cookie).

How we contact you

We only contact you for two purposes:

• Transactional emails about your account — booking confirmations, cancellations, payment receipts, refund confirmations, and a 24-hour session reminder. These are sent automatically when the relevant event happens. You cannot "unsubscribe" from these because they relate to bookings you have made.
• The weekly info pack — a short newsletter with research, tips and studio news. You are never added to this automatically. You only receive the weekly info pack if you have personally entered your email into the sign-up form at the bottom of our FAQ and clicked the submit button. You can unsubscribe any time by replying to any issue, or by emailing us directly.

We do not send marketing, promotional, or sales emails except for the opt-in weekly info pack described above.

Admin notifications (internal, not customer-facing)

For operational visibility, we use a private Telegram channel as an admin notification system so the studio owner is alerted when a booking is made, cancelled, paid for, refunded, or when a new account is created. This is an internal tool. The Telegram alert only contains the minimum needed for the owner to respond (your name, date of booking, phone number, booking type). You do not interact with Telegram and it is not part of our customer interface in any way. You cannot contact the studio through Telegram.

Sharing your data

We do not sell, rent, or trade your personal data to anyone. We only share it with the following third parties, and only to the extent strictly necessary:

• Supabase Inc. — our database and authentication provider (UK servers)
• Stripe, Inc. — when you make a payment
• Resend Inc. — the email delivery service that sends your transactional emails and, if you opted in, the weekly info pack
• Telegram FZ-LLC — only used for the internal admin alert described above; no customer data beyond the minimum listed is shared
• HMRC and other UK authorities — only if legally required by court order or statutory obligation

Children

Our services are not directed at children under 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us and we will delete it.

Changes to this policy

If we make material changes to this policy, we will, where appropriate, notify registered users by email. Continued use of the service after changes are posted constitutes acceptance of the updated policy.