Legal
Privacy notice
Last updated 26 October 2026
Two quite different things happen under the Bee-booked name, and the law treats them differently. This notice covers both. Start with whichever one is you.
I'm booking an appointment
Your details belong to the practice you book with. We only hold them on their behalf. Part 1 →
I'm looking at Bee-booked
Waitlist, guides, contact form. Here we are responsible for your details ourselves. Part 2 →
Part 1 — Booking an appointment with a practice
Who is responsible for your information
The practitioner or practice you book with. They decide what is collected and why, so in data-protection terms they are the controller. Bee-booked provides the booking software and holds the information on their instructions — we are their processor. We do not decide what happens to your details, we do not use them for our own purposes, and we never sell them.
So for anything about your own data — a copy of it, a correction, deletion — ask your practice. Their contact details are on their profile page and on your booking confirmation. If you cannot reach them, email hello@bee-booked.com and we will pass it on.
What is collected
- Your name and contact details — email address, and a phone number if you give one.
- Your bookings — the services and add-ons you choose, dates and times, and your history with that practice.
- Payment details — card details go straight to Stripe and are stored by Stripe. Neither your practice nor Bee-booked ever sees or stores your full card number.
- Consent records — whether you agreed to marketing emails, and whether you consented to give health information on a consultation form. We record when it was given and how, so that you and your practice can both check it later.
- Consultation answers — this depends on which kind of form your practice uses:
- A Bee-booked consultation form — your answers are held here, on your practice's behalf. Because they can include health information they are encrypted, stored under a reference rather than your name, kept only as long as your practice's retention setting allows, and every time they are opened it is logged.
- An outside form (Google Forms, for example) — your answers go to that provider and their privacy policy applies. Bee-booked records only that a form was submitted.
- Treatment notes — if your practitioner keeps clinical notes about your appointments, those are held here on their behalf. They are health information, so they are encrypted, access to them is logged, and they are deleted in line with your practice's retention setting.
- Reviews: if your practice asks how your visit went and you reply, your star rating, anything you write, and whether you would rather appear as “A client”. Nothing is published unless your practice approves it. On their website a review shows your first name and the initial of your surname, or “A client”. Your practice can always see who wrote it.
Why, and the lawful basis
| What for | Lawful basis |
|---|---|
| Managing your booking — confirming, reminding, rescheduling, cancelling | Contract |
| Taking payment, holding a card on file, and charging a late-cancellation or no-show fee under the practice's stated policy | Contract / legitimate interests |
| Marketing emails from your practice | Consent — only if you opted in, and you can withdraw at any time |
| Asking how your visit went, showing your review on the practice's website if they approve it, and, if they choose, emailing you their Google review link | Legitimate interests. Every request has a link to stop them, and you can ask your practice to take a review down at any time |
| Health information on a consultation form, for your treatment | Explicit consent (UK GDPR Article 9) |
Who it is shared with
- Your practitioner: who provides your treatment.
- Stripe: payment processing and card storage.
- Amazon Web Services: hosting and database, London region (eu-west-2).
- Resend: sending your confirmation and reminder emails, and review requests.
That is the whole list. Your details are not sold, and not shared for anyone else's marketing.
How long it is kept
Booking and client records are kept for as long as your practice needs them to provide the service and to meet legal, accounting and tax obligations, then deleted or anonymised. Consultation forms and treatment notes are kept for 7 years from the appointment, unless your practice chooses a different period, and are then deleted automatically. A review request you don't answer, and a review your practice hides, is deleted after 6 months. A published review stays until your practice removes it or you ask them to. Marketing consent is kept until you withdraw it, and the record of the withdrawal is kept too, so that honouring it can be proved.
Your rights
You can ask for a copy of what is held about you, to have it corrected or deleted, to restrict or object to how it is used, to have it transferred, and to withdraw consent at any time. You can do some of this yourself in your account, including downloading your data. Otherwise ask your practice — they are the controller.
If you are unhappy with how it has been handled, you can complain to the Information Commissioner's Office at ico.org.uk.
Cookies on the booking pages
The booking site uses only what it needs to work — chiefly keeping you signed in to your account. There are no advertising or tracking cookies. A practice's own website may offer analytics; if it does, that loads only after you accept it on their cookie banner.
Part 2 — Using bee-booked.com
This part covers this website, where you can join the waitlist, read the guides and send us a message, and the details you leave with us at a show or event. It is short because we collect little here, and here we are the controller.
Who we are
Bee-booked is operated by a UK partnership. For anything about this part of the notice, or to exercise any of the rights below, email hello@bee-booked.com — and we will give you our full registered details on request.
What we collect, and why
| What | Why | Our lawful basis |
|---|---|---|
| Waitlist signup — your email, and optionally your practice name and the booking tool you use now | To tell you when we open to new practices, and to understand who is asking | Consent — you asked us to get in touch |
| Contact message — your name, email and what you wrote | To reply to you | Legitimate interests — answering someone who contacted us |
| Visit statistics, only if you accept analytics cookies: the pages you view, how you arrived (a search, a link, or a campaign tag in the link), your device and browser type, and your rough location (country and town) | To see how many people visit and where they come from, so we know what works | Consent: you choose on the cookie banner, and can change your mind at any time with Cookie settings at the bottom of every page |
| Show sign-up details, left on our tablet at a show or event (such as the OM Yoga Show): your name and email, and if you give them, your phone number, practice name and what you offer, and whether you ticked the box for news | To send you the show offer you asked for, and occasional news only if you ticked the box | Consent: you asked us to send the offer, and news only if you ticked the box |
That is the whole list. Apart from Google Analytics, and only if you accept it, this site runs no tracking: no tag manager and no advertising pixels. Google Analytics does not tell us who you are, and we do not use it for advertising. We do not know who you are unless you tell us. We do not buy contact lists, we do not sell or share your details for anyone else's marketing, and there is no automated decision-making here.
Cookies and other sites
We set no cookies on this site unless you accept analytics. If you accept, Google Analytics sets two cookies, _ga and _ga_ followed by a code, which tell one visit from the next and last up to 13 months. The details of your visits then go to Google, which processes them for us. Google uses your IP address to work out your rough location and does not store it. We have turned off Google's advertising features (Google signals and ad personalisation), and Google deletes the detailed records of visits after 14 months. Google may process them in the United States, under the UK-US data bridge.
If you reject, or never choose, nothing is loaded from Google. You can change your mind at any time with Cookie settings at the bottom of every page, and choosing Reject deletes the cookies. Apart from that, nothing on the page is fetched from anyone else: the fonts, images and code all come from us. (Until 17 August 2026 the fonts came from Google, which meant Google saw your IP address; we now serve them ourselves.)
Some pages link to other websites. Once you follow a link you are on their site and their privacy notice applies, not ours.
How long we keep it
- Keep-me-posted list: until you ask us to remove you. We should be straight with you: these entries do not expire on their own, so if you want to be taken off, email us and we will delete it.
- Contact messages: kept while we are dealing with your enquiry and for a reasonable period afterwards, then deleted.
- Visit statistics: Google deletes the detailed records of visits after 14 months; what stays are totals that don't identify anyone. The cookies on your device last up to 13 months, or until you choose Reject.
- Show sign-up details: kept on our tablet at the stand until we copy them into our own email and files, and deleted once the show offer ends (for the OM Yoga Show, 30 November 2026). If you ticked the box for news, we keep your name and email for that until you unsubscribe.
Your rights
You can ask us for a copy of what we hold about you, to correct it, to delete it, or to stop using it — and where we rely on your consent, you can withdraw it at any time. Email hello@bee-booked.com and we will action it within a month. There is no charge. If you are not happy with how we have handled it you can complain to the ICO at ico.org.uk, though we would rather you told us first so we can put it right.
Applies to both
Where your information is held
On Amazon Web Services in London (eu-west-2), encrypted at rest. Email is sent through Resend and payments are handled by Stripe. All are suppliers acting on instructions, and data stays in the UK or the EEA. The one exception is Google Analytics on bee-booked.com, if you accept it: Google may process those visit statistics in the United States, under the UK-US data bridge.
Changes
If we change this notice we will update the date at the top. If the change is significant and we hold your email, we will tell you.
See also our provider terms and data processing agreement — the contract between Bee-booked and a practice.