Privacy Policy

Last updated: 9 April 2026 · Version 1.0

Green Oxygen Hyperbarics Limited ("we", "us", "our") is committed to protecting your personal data. This policy explains what we collect, how we use it, where we store it, and what rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Who we are

Green Oxygen Hyperbarics Limited operates a wellness studio offering mild hyperbaric oxygen therapy (HBOT) at:

Jubilee House, Third Avenue, Globe Park, Marlow, SL7 1EY
Phone: 07378 271411
Email: tommy@greenoxygenhbot.com

For the purposes of UK GDPR, we are the data controller for the personal data we hold about you.

What data we collect

When you create an account

• First name and last name
• Email address
• Phone number
• Password (stored as a one-way cryptographic hash, never in plain text)
• If you book a free first session: a short note about why you're interested in HBOT (up to 200 characters)

When you book sessions

• The date and time of each booking
• The type of session and how it was paid for
• Cancellation timestamps and whether they fell within our 24-hour window
• Your remaining session balance and a log of every change to it

What we do NOT collect

• Card or banking details — payment is handled by Stripe; we never see or store your card number
• Medical history, GP details, or health records are not stored online. We will ask you about relevant medical conditions and their history in person or over the phone before your first session, but this information is never captured through the website or held in our database
• Your location, device fingerprint, or browsing history
• Marketing tracking cookies, pixels, or third-party analytics that profile you

Lawful basis for processing

We rely on the following lawful bases under UK GDPR Article 6:

• Performance of a contract — to deliver the sessions you've booked, manage your account, and process payments
• Legitimate interests — to communicate with you about your bookings, prevent fraud, and improve the studio
• Legal obligation — to keep accounting records as required by HMRC

Where your data is stored

All personal data is stored on servers located in the United Kingdom, operated by Supabase Inc. on Amazon Web Services (AWS) infrastructure in the London region. No personal data is transferred outside the UK in the normal course of operating this service.

Payment processing is handled by Stripe, Inc., a payment processor regulated in the UK by the Financial Conduct Authority. Stripe receives only what is needed to process the transaction and is itself a data controller for that information. See Stripe's privacy policy for details.

How long we keep your data

• Account information: for as long as your account is active, plus 30 days after you request deletion
• Booking records: for 7 years from the date of the booking, as required for HMRC tax records
• Cancelled / inactive accounts: automatically reviewed for deletion after 36 months of inactivity

Your rights under UK GDPR

You have the right to:

• Access a copy of all personal data we hold about you
• Rectify any inaccurate or incomplete information
• Erase your personal data ("right to be forgotten") subject to our legal obligations
• Restrict how we process your data
• Object to processing based on legitimate interests
• Portability — receive your data in a machine-readable format
• Withdraw consent at any time where we relied on consent

To exercise any of these rights, email us at tommy@greenoxygenhbot.com. We will respond within 30 days.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk if you believe we have mishandled your data.

Cookies

We use only essential cookies required to keep you signed in and to remember whether you've accepted this notice. We do not use marketing, advertising, analytics, or tracking cookies of any kind. There are no third-party trackers on this site.

Sharing your data

We do not sell, rent, or trade your personal data to anyone. We only share it with the following third parties, and only to the extent strictly necessary:

• Supabase Inc. — our database and authentication provider (UK servers)
• Stripe, Inc. — when you make a payment
• HMRC and other UK authorities — only if legally required by court order or statutory obligation

Children

Our services are not directed at children under 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us and we will delete it.

Changes to this policy

If we make material changes to this policy, we will update the "Last updated" date at the top and, where appropriate, notify registered users by email. Continued use of the service after changes are posted constitutes acceptance of the updated policy.