Privacy Policy

Last updated: October 2026

At Casa Om, we are committed to respecting your privacy and protecting your personal data. This Privacy Policy explains how we collect, use, store, and safeguard your personal information when you visit our studio, use our website or app, book classes, sauna sessions or treatments, buy from Café Om, or interact with us.

1. Who We Are (Data Controller)

For the purposes of the UK General Data Protection Regulation (UK GDPR), Casa Om is the data controller responsible for your personal data.

• Studio Name: Casa Om
• Location: Casa Om, 19 South Street, Chesterfield, S40 1QX
• Data Contact Email: hello@casaom.co.uk

2. What Personal Data We Collect

We only collect information that is necessary to provide you with a safe, seamless, and personalised experience, whether that's a class, a sauna session, a treatment, a coffee:

• Identity & Contact Data: Your full name, email address, phone number, date of birth and home address, which you give us when you sign up and can update in the app (Me > Details and security). Your birthday shows on your teacher's register on the day, and may be used for birthday treats.
• Sign in with Google or Apple: If you sign up or log in with Google or Apple, they share your name and email address (and sometimes a profile photo) with us. We never see your Google or Apple password.
• Parent or Guardian (16 and 17 year olds): If you're 16 or 17, your parent or guardian's name, relationship to you, email address and phone number, and a record of their consent (their typed name and the date). We email them a link to read our health waiver and give consent.
• Emergency Contact Data: The name and phone number of a person we can contact in case of a medical emergency during class.
• Health Waiver: Your typed full name, a hand-drawn signature and the date you signed our Health Waiver & Liability Release.
• Health Information You Choose to Share: Any medical notes you add to your health waiver (for example an injury, a health condition, recent surgery or pregnancy), which you can change any time in Me > Documents & statements, and any note you leave your teacher when you book a class. Only Casa Om teachers and admins can see them, so they can keep you safe. We use this information with your explicit consent, which you give by adding it.
• Photo Consent: Whether you're happy to be photographed in the studio. Your teacher sees your answer on the class register, and you can change it any time in Me > Documents & statements.
• Skin and Bodhi Treatments: Skin and Bodhi is an entirely separate business that shares our building and our app; it isn't part of Casa Om. If you book a treatment, your booking and anything you share on its consultation, intake or consent forms, plus the treatment notes, skin plans and aftercare documents it keeps, are held in the app for Skin and Bodhi, which is responsible for them. Questions about that information should go to Skin and Bodhi.
• Profile Photo: If you choose to add one, a profile photo you upload.
• Bookings & Activity: The classes, events, sauna sessions and treatments you book, attend or cancel; waitlist places; class ratings and feedback; your weekly goal, streaks and loyalty milestones; referrals, guest passes and gift cards; and any late fees.
• Café Om: If you show your member code at the café, what you bought, when, and any stamps or member discount, linked to your account. Café card payments are taken by SumUp's card reader; we never see your full card number.
• Financial & Payment Data: Payment details are handled entirely by Stripe's secure checkout (and SumUp in the café). Casa Om never sees or stores your full card number. Studio payments (classes, memberships, gift cards, event tickets, private sauna bookings, late fees) go through Casa Om's own Stripe account; Skin and Bodhi treatment payments go through the therapist's own, entirely separate Stripe account, since Skin and Bodhi is an entirely separate business.
• Messages: Anything you send us through the app, such as a private class request or a problem report.
• Account Security Data: If you set an in-app PIN or turn on Face ID/fingerprint unlock, that lives entirely on your own device (as a locally-hashed PIN and your phone's own biometric system); we never receive, see, or store your fingerprint, face scan, or PIN ourselves.
• Notification Data: If you allow notifications, our push notification provider (OneSignal) links your device to your account so we can send you booking reminders and updates. See "How We Share Your Data" below.
• Calendar Sync Link: If you choose to "Sync with your calendar," we generate a personal link you can add to Google, Apple, or Outlook calendar as a "subscribe by URL" feed. Anyone with that exact link could see the class or appointment names and times it lists, so treat it like a password and don't share it. It never includes health, payment, or contact information, just what's booked and when.
• Apple Health Data (iOS only): If you grant permission, attending a class logs it as a completed workout in your iPhone's own Health app. This is one-way and stays on your device: we write a workout entry (activity type, start and end time) into Apple's HealthKit, we never read anything back out of your Health app, and this data is never sent to or stored on Casa Om's servers. You can turn this off at any time in your iPhone's Settings.
• Apple Watch Companion (iOS only): If you use a paired Apple Watch, a short summary of your upcoming bookings and loyalty status is sent to it directly from your iPhone. This stays between your own paired devices.
• Pre-launch Waitlist: If you joined our queue before the studio opened, we hold the name and email address you gave us, and who referred you if anyone did. The queue is now closed.
• Technical Data: Standard web request data (like IP address and browser type) that any website server sees. If the app hits an error, a report of the error and where in the app it happened may be sent to our error-reporting service, without your name, email or other personal details. We don't run advertising trackers anywhere. On our website and the web version of the app (app.casaom.co.uk), if you say yes to analytics cookies, Google Analytics measures how they're used (see Cookies below). The phone apps have no analytics.

3. How We Use Your Personal Data

We use your information under the following legal bases under UK GDPR:

• To Perform Our Contract With You: To run your account, take payments, process bookings and cancellations, manage memberships, credits, waitlists, loyalty rewards and café stamps, and send the emails and notifications that go with them: booking confirmations, class reminders, waitlist updates, receipts, reminders before credits or a membership run out, and a monthly summary of your practice.
• To Ensure Your Safety (Legitimate Interest/Vital Interest): To let teachers adapt a class safely, using what you choose to tell them, and to contact emergency services or your emergency contact if needed. A teacher's class register shows your name, any note you've left for them, your photo preference, whether it's your birthday and how many classes you've been to.
• Skin and Bodhi Treatments: When you book a treatment, your name, contact details and booking are shared with Skin and Bodhi, a separate business, so they can provide it.
• For Marketing Communications: When you sign up, we'll send you occasional newsletters, details about upcoming workshops, retreats, and special offers, unless you tick the box at signup to say you don't want them. Booking confirmations, class reminders, and other emails about your account aren't affected either way. You can opt out at any time in the app (Me > Notifications) or via the unsubscribe link at the bottom of any marketing email.
• For Legal & Accounting Obligations: To maintain accurate financial records for UK tax (HMRC) reporting.

4. How We Share Your Data

We will never sell, rent, or trade your personal information to third parties. We only share data with Skin and Bodhi (for treatments you book with them) and with trusted service providers who help us run the studio and app:

• Supabase: Hosts our database, sign-in system, and files you upload or sign (like a profile photo or waiver signature). This is where your account and booking data actually lives.
• Vercel: Hosts our website and the web version of the app.
• Stripe: Processes online payments. Studio payments go through Casa Om's own Stripe account; Skin and Bodhi treatment payments go through the therapist's own, separate Stripe account.
• SumUp: Takes card payments in Café Om.
• Resend: Sends our emails (booking confirmations, receipts, reminders, newsletters).
• OneSignal: Delivers push notifications to the app if you've allowed them, linked to your account by an internal ID only, not your name or email.
• Google and Apple: Only if you choose to sign in with them.
• Error Reporting: If the app hits an error, our error-reporting service (Sentry) receives details of the error, without your name, email or other personal details.
• Behold.so: Powers the live Instagram feed shown on some pages. Loading that feed makes your browser request images directly from Behold's servers, which sees your IP address the same way any website you visit does.
• Google Analytics (website and web app only, with your consent): If you accept analytics cookies on our website or app.casaom.co.uk, Google Analytics sets cookies and receives details of your visit (pages viewed, how you found us, device and browser type, approximate location), without your name or contact details. It is off unless you choose it.
• Google Fonts: Our website's typefaces load from Google's font servers, which likewise sees your IP address when a page loads.

All third-party service providers are required to safeguard your data and handle it in accordance with UK GDPR. Some of them may process data outside the UK; where they do, they use the safeguards UK law requires.

5. How Long We Keep Your Data

We retain your personal data only for as long as necessary to fulfil the purposes we collected it for:

• Your Account: Kept while your account is open. When you delete it, your profile, profile photo, booking and attendance history, treatment forms, records and skin plans, notes, ratings, photo preference, loyalty progress and café stamps are permanently erased straight away.
• Health Waivers: If you delete your account, a copy of your signed health waiver (your name, email, date of birth, signature, the date you signed and any medical notes) is kept for 7 years after your last class, in line with UK legal and insurance claims guidelines, and can only be seen by Casa Om's admins. It is then erased automatically.
• Financial & Transaction Records: A record of each payment (what was bought, the amount and the date) is kept for 6 years after the end of the relevant UK tax year, as HMRC requires. Once your account is deleted these records no longer include your name or any link to you. Stripe and SumUp also keep their own payment records, as their own legal obligations require.
• Pre-launch Waitlist: Kept until you join as a full member, or ask us to remove you sooner.

6. Your Legal Rights (Under UK GDPR)

As an individual in the UK, you have clear rights regarding your personal data:

• Right of Access: You can download a copy of everything we hold about you any time in Me > Documents & statements (Download my data), or ask us for it. Your payment history and signed documents are there too.
• Right to Rectification: You can correct most of your details yourself in Me > Details and security, or ask us to.
• Right to Erasure ("Right to be Forgotten"): You can delete your account yourself at any time in the app (Me > Delete account), or ask us to do it for you. Your signed health waiver is kept for 7 years as described above. If you have an active membership, it needs to end first: tapping Delete account gives the 30 days' notice to cancel it, and you can delete your account once it has ended.
• Right to Withdraw Consent: You can stop marketing emails, change when (or whether) we send class reminders, change your photo preference, or turn off notifications, Apple Health or calendar sync at any time.

To exercise any of these rights, please contact us at hello@casaom.co.uk.

7. Cookies & Similar Technologies

We don't run any advertising trackers on our website or in our app, and the phone apps have no analytics. What we do store, locally in your own browser or device (not on our servers), is limited to what's needed for the site and app to work:

• Keeping you signed in between visits.
• Remembering small preferences, like which part of the app you used last.
• Security preferences you've set yourself in the app, like whether App Lock is on (the PIN itself is stored only as a hash, never in plain text, and never leaves your device).

Analytics cookies (website and web app only): The first time you visit our website or app.casaom.co.uk we ask whether you're happy for us to use Google Analytics, so we can see which pages are useful, which visits lead to bookings and purchases, and improve them. One answer covers both. Nothing is set unless you say yes. You can change your choice any time with Cookie settings at the bottom of the website. The phone apps don't use analytics.

Some pages also embed third-party content (our Instagram feed, our web fonts) that causes your browser to make requests directly to those services, as described above. You can block cookies and local storage in your browser settings, though signing in and booking won't work properly without them.

8. Children

Our classes and app are for people aged 16 and over, and you can't create an account if you're under 16. If you're 16 or 17, your parent or guardian is emailed a link to read our health waiver and give consent, and you can book once they have.

9. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements or studio practices. Any updates will be posted here with a revised "Last Updated" date.

10. How to Contact Us or Lodge a Complaint

If you have any questions about this Privacy Policy or wish to make a complaint regarding how your data has been handled, please contact us first so we can resolve it:

• Email: hello@casaom.co.uk
• Address: Casa Om, 19 South Street, Chesterfield, S40 1QX

If you are not satisfied with our response, you have the right to lodge a complaint with the UK's data protection regulator: the Information Commissioner's Office (ICO), ico.org.uk, Helpline: 0303 123 1113.