Privacy Policy
Privacy Policy
01. Introduction
At Orenna Wellness, privacy is an important part of the personal experience we provide. Choosing a private wellness experience may involve sharing personal information, including details about health, preferences and individual requirements. We treat this information with care and respect your choices. This Privacy Policy explains what information we collect, how and why we use it, who may receive it, how long we keep it and your rights. It applies to website visitors, people who contact us, prospective and existing guests, and newsletter subscribers. We process personal information under applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, and, where relevant, the Privacy and Electronic Communications Regulations (PECR). See our Cookie Policy at https://orennawellness.com/legal-policies/cookie-policy/
02. Who We Are
Orenna Wellness is the trading name of the individual operating the business. Carina Campos Rio, trading as Orenna Wellness, is the data controller responsible for personal information processed in connection with the business. Orenna Wellness | 57 Harbour Road | Inverness IV1 1UF | Scotland, United Kingdom Email: hello@orennawellness.com | Website: https://orennawellness.com
03. Personal Information We Collect
Contact and booking information When you contact us or book, we may collect your name, email address, telephone number, correspondence, selected experience, appointment date and time, booking status, and relevant practical preferences or accessibility arrangements. Consultation and health information Before an experience, we may ask about your previous yoga experience, aims, movement and positioning considerations, sensory preferences, support needs, accessibility, relevant medical conditions, injuries, pregnancy-related considerations, allergies, sensitivities and relevant medication considerations. We request information relevant to preparing or assessing the suitability of your experience; you are not expected to disclose unrelated information. Some information may be needed to decide whether an adaptation, postponement or referral is appropriate. Health information is special category personal data. Payment and transaction information We may receive payment amounts, dates, status, transaction references and refund information. Card payments are processed through Square. We do not ask for full payment card numbers or security codes in consultation forms. WooCommerce checkout and accounts Our website currently has a WooCommerce cart and checkout, with Square enabled, and customer registration enabled as at the configuration review on 21 September 2026. If you use WooCommerce, we may collect your name, contact details, billing information, selected products or services, order and transaction details, and, if you choose to register, account details and account-related information. We do not request a shipping address unless an offering requires delivery. This description must be updated if customer registration or checkout is disabled. Website and technical information Depending on the website functions used, technical information may include IP address, device and browser information, pages visited, referral details, website interactions and cookie identifiers. See our Cookie Policy for further information.
04. How We Collect Personal Information
We collect information directly when you contact us, submit a form, request or manage an appointment, complete a consultation, attend an experience, pay, use checkout or register for an account, subscribe to communications, or use our website. We may receive limited booking or payment status information from relevant service providers. We do not intentionally acquire personal information from unrelated third parties for marketing.
Why We Use Information and Our Lawful Bases
Our principal purposes and UK GDPR Article 6 lawful bases are described below. Where legitimate interests apply, they include responding to unsolicited enquiries, administering and protecting our website and services, and managing complaints and claims, balanced against individuals’ rights
Our Purposes and Lawful Bases We process personal information for the following purposes, relying on the applicable lawful bases under Article 6 of the UK GDPR. Responding to enquiries and pre-booking requests We rely on taking steps at your request before entering into a contract. Where this does not apply, we may rely on our legitimate interests in responding to enquiries, where appropriate. Managing bookings and providing experiences We rely on the performance of a contract where processing is necessary to arrange and provide your chosen experience. Processing consultation information We rely on the performance of a contract where processing is necessary to prepare and provide an agreed experience. Where consultation information includes health information, we also require a separate condition under Article 9 of the UK GDPR. Processing payments and refunds We rely on the performance of a contract to process payments and refunds. We rely on legal obligations where we must retain financial information for accounting or tax purposes. WooCommerce checkout and orders Where WooCommerce checkout is used, we rely on the performance of a contract or taking steps at your request before entering into a contract. Customer accounts Where customer registration is available and you choose to create an account, we rely on the performance of a contract where processing is necessary to provide and administer the account. Accounting and tax records We rely on legal obligations to maintain records required by applicable accounting and tax legislation. Complaints, incidents and legal claims We rely on our legitimate interests or legal obligations, as appropriate. Where health information is involved, we also require an applicable Article 9 condition. Newsletter and marketing communications We rely on consent where required, including under the Privacy and Electronic Communications Regulations (PECR). Website security and essential operation We rely on our legitimate interests where justified, or a legal obligation where applicable, to maintain website security, prevent fraud and support essential website functions. Non-essential cookies Where consent is legally required, we obtain it before using non-essential cookies or similar technologies. We also identify an appropriate lawful basis for any associated processing of personal information. Further information about cookies is provided in our Cookie Policy.
Where we process health information, we require both an Article 6 lawful basis and a separate Article 9 condition. We rely on explicit consent under Article 9(2)(a) for consultation health information where that condition is appropriate. We do not treat agreement to our Terms & Conditions or acknowledgement of this policy as health-data consent. We determine and document applicable bases before processing.
06. Health Information and Explicit Consent
We request relevant health information to assess suitability and prepare guidance, positioning, adaptations and environmental arrangements. Where we rely on explicit consent, we ask for a separate, clear and informed affirmative statement. You may withdraw consent by emailing hello@orennawellness.com. Withdrawal does not affect processing carried out lawfully beforehand. We will stop processing for purposes dependent on that consent unless another applicable Article 6 basis and Article 9 condition permits or requires continued processing. Withdrawal may mean we cannot safely provide the requested experience; we will explain available options. We do not use health information for marketing without a separate appropriate basis and special category condition. Our services are yoga and wellness experiences, not medical diagnosis, treatment or psychological therapy.
07. How We Use Consultation Information
Consultation details help us consider practice selection, positioning, props and support, accessibility, sensory preferences, precautions and suitability. We may contact you to clarify information and recommend advice from a qualified healthcare professional where a concern falls outside our professional scope. We do not use consultation information to make solely automated decisions about eligibility for an Orenna experience.
08. Booking, Checkout and Payment Services
Amelia We use Amelia within our WordPress website to manage private appointments and workshops. It processes the contact, experience, scheduling, status and communication information needed to administer bookings. Information may be held within our website and accessed by authorised hosting or technical providers where needed. WooCommerce Our website has WooCommerce cart, checkout and account-registration functionality enabled at the date of the configuration review. If you use it, WooCommerce processes checkout, order, billing and, where relevant, account information within the website. We have not identified completed WooCommerce orders in the audit. We do not represent WooCommerce as the booking route for all sessions or workshops. Square Square is connected to Amelia and enabled in WooCommerce. Square processes payment-related information for the checkout route used. We receive the information needed to confirm and administer payments, refunds and transactions. Square may process information under its own privacy terms and applicable contractual arrangements. We do not intentionally collect full card numbers or card security codes in consultation records.
09. Website Forms and Email
Our website uses WordPress and Contact Form 7 for contact functions and FluentSMTP to support delivery of website emails. Information submitted through forms may be transmitted to our business email account and processed by relevant website and email service providers. General enquiry forms should not be used to submit unnecessary sensitive health information; please use our designated consultation process or contact us about a suitable method.
10. Newsletter and Marketing
Our optional newsletter may include occasional notes, experience information and studio news. Where consent is required, we obtain it through a separate affirmative choice; booking or accepting terms does not constitute newsletter consent. We may use your name, email address and preferences to send requested communications. You may unsubscribe using the method in the message or by emailing hello@orennawellness.com. We retain appropriate preference and suppression records and do not sell subscriber information.
11. Cookies, Fonts and Embedded Media
Our website uses cookies and similar technologies for website operation and, depending on active features, bookings, checkout, payment, security and preferences. Some may require consent. Where consent is legally required, the relevant technology must not be activated before valid consent is obtained. Our Cookie Policy explains the technologies and choices available. A separate technical check is required to confirm actual cookies, consent controls, analytics and attribution behaviour before publication. If external fonts or embedded media are enabled, a visitor’s browser may contact the provider and transmit technical information such as IP address and page information. We will identify active providers and apply any required consent controls before using them. Vimeo is not listed as a current provider solely because it may be used in the future.
12. Where We Store Information
Personal information may be stored or processed through our WordPress website and its booking and checkout systems, business email, and authorised business devices. Any use of external storage, encryption and backups must reflect the controls actually implemented. Access is limited to authorised purposes and health information is handled with additional care. No electronic transmission or storage can be guaranteed completely secure.
13. Who Receives Information
We do not sell personal information. Depending on the service used, information may be accessible to our website host and authorised technical providers; Amelia for booking-related functions; WooCommerce functionality within our website; Square for payment processing; business email providers; professional advisers where necessary; and authorities where disclosure is legally required. WordPress and WooCommerce software being installed does not, by itself, mean their developers receive all customer records. The information involved depends on whether a guest uses Amelia or WooCommerce. Providers may act as processors or independent controllers depending on their role. Where they act as processors, we put appropriate contractual arrangements in place. We limit disclosures to what is necessary and do not routinely disclose health information to unrelated third parties; any disclosure requires an appropriate lawful basis and special category condition.
14. International Transfers
Some providers may operate or process information outside the United Kingdom. Where a restricted international transfer occurs, we identify the recipient, destination and applicable transfer mechanism and apply any required safeguards, which may include UK adequacy regulations or appropriate contractual arrangements. You may request information about applicable transfer safeguards using our contact details.
15. How Long We Keep Your Information
We retain personal information only for as long as needed for its purpose and applicable accounting, tax, contractual, legal or professional requirements. We apply the following criteria; specific periods must be documented in our internal retention schedule and reflected here where available. Enquiries Until the enquiry and reasonable follow-up are concluded, unless a dispute or legal requirement justifies longer retention. Bookings, payments and WooCommerce orders For appointment and transaction administration, and for the applicable financial record-keeping period where records must be retained. Pending, failed and cancelled WooCommerce orders Only for the period needed to administer or troubleshoot the transaction, prevent fraud, resolve disputes and meet any relevant obligations; these categories need separate WooCommerce retention settings. Customer accounts, if any While the account is needed for the requested service, followed by review and deletion or anonymisation when no longer necessary, subject to legally retained transaction records. Consultation and health information For the period necessary to prepare and deliver the experience and deal with relevant incidents, claims or legal and professional requirements, followed by review and secure deletion. Marketing While subscribed, with limited suppression records retained after unsubscribe to respect that choice. Website and cookie information According to the purpose and actual configuration of each technology, as detailed in the Cookie Policy. When records are no longer needed, we take reasonable steps to delete them securely or anonymise them. We do not promise automatic deletion where the relevant retention settings have not yet been established.
16. How We Protect Information
We apply appropriate organisational and technical measures, which may include access restrictions, password-protected accounts and devices, software maintenance, secure storage, data minimisation, retention reviews and secure disposal. We assess any personal data breach and notify the Information Commissioner’s Office or affected individuals where legally required. Security descriptions must match the measures actually in use
17. Your Data Protection Rights
Under the UK GDPR, you may have the following rights, depending on the circumstances: The right to be informed You have the right to receive clear information about how your personal data is used. The right of access You may request access to the personal information we hold about you. The right to rectification You may ask us to correct inaccurate information or complete information that is incomplete. The right to erasure You may request deletion of your personal information in certain circumstances. The right to restrict processing You may ask us to restrict the use of your information in certain circumstances. The right to data portability You may have the right to receive certain information in a structured, commonly used and machine-readable format. Rights relating to automated decision-making You have rights concerning certain decisions made solely by automated means that produce legal or similarly significant effects. We do not use solely automated decision-making of this kind to determine whether you may attend an Orenna Wellness experience. Not all rights apply in every situation. We may need to verify your identity before responding to a request. We will respond to requests concerning your personal information within the period required by applicable data protection legislation, normally without undue delay and within one month. Where the law permits an extension, we will explain the reason and inform you within the required period. To exercise your rights, please contact: hello@orennawellness.com Your right to object You have the right to object at any time to the processing of your personal information for direct marketing purposes. You may also object to certain other processing, including processing based on legitimate interests, subject to the applicable legal conditions.
18. Withdrawing Consent
Where we rely on your consent to process personal information, you may withdraw that consent at any time. This includes explicit consent provided for relevant health information and consent for optional marketing communications. To withdraw consent, please contact hello@orennawellness.com. Withdrawal of consent does not affect processing that was lawful before withdrawal. We will explain any consequences for the provision of an experience where relevant information is necessary for its safe and appropriate delivery.
19. Children and Young People
Orenna Wellness currently provides private experiences for adults aged 18 and over. Our services are not intended for children. We do not knowingly collect personal information from children for the purpose of providing private experiences. This does not prevent us from processing necessary information about a child where an adult contacts us about an enquiry or accessibility arrangement; any such processing must have an appropriate lawful basis. If we become aware that personal information has been collected inappropriately, we will take appropriate steps to address the matter.
20. External Websites
Our website may contain links to external websites, including service providers and other organisations. We are not responsible for the privacy practices of websites operated independently of Orenna Wellness. We encourage you to review the privacy information provided by those organisations before submitting personal information.
21. Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes in our services, technology, business operations or legal obligations. The date at the beginning of this document indicates when it was last updated. Where changes materially affect how we process personal information, we will provide additional information or obtain consent where required.
22. Questions and Complaints
We take concerns about the handling of personal information seriously. If you believe that Orenna Wellness has not handled your personal information appropriately, you may submit a data protection complaint using the contact details below. Email: hello@orennawellness.com Please provide sufficient information to help us understand your concern. You do not need to use a particular form or provide unnecessary personal information. We will acknowledge a data protection complaint within 30 days of receiving it, and take appropriate steps to investigate and respond without undue delay. We will take appropriate steps to investigate the matter, keep you informed of relevant progress and communicate the outcome without undue delay. Where appropriate, we will explain any action taken to address the concern. We will handle complaints fairly and maintain appropriate records of the complaint, investigation and outcome. Your right to contact the Information Commissioner's Office You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent data protection regulator. You do not have to contact Orenna Wellness before raising a concern with the ICO. Information Commissioner's Office Website: https://ico.org.uk
23. Contact Information
Orenna Wellness | 57 Harbour Road | Inverness IV1 1UF | Scotland, United Kingdom Email: hello@orennawellness.com | Website: https://orennawellness.com
Effective date: 20 September 2026
Considered in Every Detail
We believe that responsible choices need not be complicated. Through thoughtful purchasing, careful use of resources and attention to the smallest details, we seek to create a private wellness experience that respects both the individual and the environment.
