Privacy Policy

How OldPain2Go Limited handles personal data collected through our website, when you contact us, when you buy or take training with us, when you are certified and listed in our practitioner directory, and when you take part in the Release & Research Programme.

1. Who we are

1.1 The controller. OldPain2Go® is the trading name of OldPain2Go Limited (company number 11216162), which is the data controller for the information described here. Our registered office is 8 Hall Drive, Lincoln, Lincolnshire, LN6 7SG, and you can reach us at support@oldpain2go.com.

1.2 Registered with the ICO. We are registered with the Information Commissioner’s Office as a data controller, and we pay the annual data protection fee. Our registration reference is ZB171734.

1.3 Practitioners are separate controllers. Certified practitioners are independent professionals and are the data controllers for their own clients' information. This policy covers our processing, not theirs; their duties are set by the Practitioner Agreement (clause 8) and the law where they practise.

2. What we collect

2.1 Information you give us. When you fill in a form, make an enquiry or buy from us, for example your name, email address, phone number, postal address, and anything you choose to write to us. If you are a practitioner or training with us, we may also hold links to the website and professional social media profiles you have published publicly (see 2.3a).

2.2 Information collected automatically. When you visit the site we collect a truncated version of your IP address (shortened so it no longer identifies you directly; treated as personal data unless and until true anonymisation is confirmed), your browser and device type, and how you use the site (pages viewed, time spent, how you arrived), through analytics.

2.3 Training and certification records. When you train or certify with us, we hold your enrolment details, your progress and assessment records, your certification record, and your directory listing details.

2.3a Practitioner profile links, found rather than given. For practitioners and people training with us, we may look up the public website and professional social media profiles you have published (for example your practice site, or a professional Facebook, Instagram or LinkedIn page), and keep a link to them on your record. We only ever use what you have made public: we never log in to any account, we store the link itself rather than photos, posts or biography, and we draw no inferences from it. We never use these links to market to you or to contact you, and we never sell them. A person checks that a found profile genuinely belongs to you before any link is saved, and you can ask us to correct a wrongly matched link, or to stop altogether, at any time (section 9), which we honour permanently. Links are removed when your record closes. This does not apply to clients or to anyone whose contact with us concerns their own pain.

2.4 Course notes and questions. When you train with us, the notes and questions you write in the lesson interface are saved to your account so you can return to them in any lesson. They are stored on our systems (Google Workspace) and can be seen by our team, who look only when something needs fixing or you have submitted a question. You can print or delete your notes at any time, and deleting a note removes our stored copy too.

3. Why we use it, and our lawful basis

3.1 To answer you and provide what you ask for. Our lawful basis is performance of a contract with you, or our legitimate interest in responding to your enquiry.

3.1a Practitioner profile links (2.3a). Our lawful basis is legitimate interest: recognising who a practitioner is when we look at their record, and checking published brand use against the terms every practitioner agrees to. We hold a written balancing assessment for each purpose (verifying and maintaining your practitioner record; and, once practitioner brand terms apply to you, checking public brand use against them), and the boundary that keeps this fair is built into the tool itself: public information only, practitioners only, never for marketing, a human check before any link is saved, and the tool does not run until those assessments and its impact assessment are complete.

3.2 To send you updates or marketing. Only with your consent, given by opting in, or where you are an existing customer and we are telling you about our own similar services (with an easy way to opt out in every message), which you can withdraw at any time.

3.2a Showing you relevant ads (custom audiences). Where we advertise to people already connected with us, we may share a protected (hashed) version of your email address with the ad platform so our updates reach you there. Our lawful basis is legitimate interest; we hold a written balancing assessment, we never do this for anyone whose contact with us concerns their own pain, we exclude anyone who has opted out of marketing, and you can object at any time (section 9).

3.3 To run and improve the website, including analytics cookies. With your consent, given through our cookie banner.

3.4 To meet legal and accounting obligations. Our lawful basis is compliance with a legal obligation.

3.5 To train, assess, certify and list you. Where you train or certify with us, our lawful basis for your enrolment, progress, assessment and certification records, and for your course notes and questions (2.4), is performance of our contract with you. For your directory listing it is the performance of your Practitioner Agreement (its clause 12.2), and you can ask us to remove or restrict your listing at any time.

3.6 Safeguarding, complaints and fitness to practise. Where we handle a complaint, a safeguarding record, or information a practitioner is required to tell us under their Agreement (clause 12.4), including information about relevant criminal convictions or investigations, we rely on our legitimate interest in protecting clients and the public, and where a claim is in prospect on establishing, exercising or defending legal claims. Health information inside such a record is handled under the substantial-public-interest condition, with the short written policy document that condition requires. 

4. Health information

4.1 Treated with extra care. If your enquiry includes health information, we treat it as special-category data, use it only to respond to you, and keep it no longer than that response needs. Where we ask you for health information, we rely on your explicit consent (Article 9(2)(a) of the UK GDPR), given through a specific, affirmative agreement at the point we ask, which you can withdraw at any time; simply mentioning health information in a message is not treated as consent to anything beyond our reply. Where we ever need to handle health information to establish, exercise or defend a legal claim, we rely on Article 9(2)(f). 

4.2 Release & Research sessions. If you take part in the Release & Research Programme, your session recordings and session information are health information, handled under your separate signed consent and with the extra care this section describes.

5. Cookies

5.1 Your choice on non-essential cookies. We use cookies. Essential ones make the site work. Non-essential ones, such as analytics, are set only if you agree through our cookie banner, and you can change your choice at any time. A separate cookie policy lists them.

6. Who we share it with

6.1 Our providers. We use trusted providers to run our service: our website host, our course, checkout and email platform (systeme.io), our transactional email service (Postmark), our video call platform (Zoom), our support desk (FreeScout), our signing platform (OpenSign), our forms tool (Microsoft Forms), our document and storage tools (Google Workspace), analytics, the ad platforms we use for custom-audience advertising (see 3.2a), and AI-assisted tools, used with the protections described in our documents and, where the law requires it, with your separate consent. Each provider acts only on our instructions and is bound under written data-processing terms to keep your data secure.

6.2 We do not sell your data. We never sell or rent your personal data. Apart from the providers in 6.1 (and, where we use custom-audience advertising, the ad platform, see 3.2a), we disclose it only where the law requires.

7. Sending data outside the UK

7.1 Safeguards apply. Some providers are based outside the UK. Where your data is transferred abroad, we rely on the UK's approved safeguards: the UK adequacy arrangements for providers in the European Union (such as systeme.io), and, for providers elsewhere (such as Zoom), the UK extension to the EU-US Data Privacy Framework or the standard data-protection clauses built into our providers' terms. Any new provider we adopt is brought under one of these approved safeguards before your data reaches it. 

8. How long we keep it

8.1 Only as long as needed. We keep personal data only for as long as we need it for the purpose we collected it, or as the law requires, and then we delete it. Client-related and safeguarding records follow the seven-year minimum our standard of care sets (longer where the law or the record requires it). As a guide to the rest: enquiries for up to two years after our last contact; accounts and tax records for six years plus the current year, as the law requires; contract and purchase records for six years; and certification records for as long as your certification stands.

9. Your rights

9.1 What you can ask for. You have the right to access your data, to have it corrected, to have it erased, to restrict or object to how we use it, to receive a copy (portability), and, where we rely on your consent, to withdraw that consent at any time.

9.2 How to use them. Email support@oldpain2go.com. If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

9.3 Complaining to us directly. You can also complain directly to us about how we handle your data, by emailing support@oldpain2go.com. We will acknowledge your complaint within 30 days, look into it properly, keep you informed, and tell you the outcome without undue delay.

10. Changes

10.1 Dated versions. We may update this policy. Each version is dated, and the version in force when you deal with us is the one that applies. Material changes are posted here.

11. Contact

11.1 OldPain2Go Limited, support@oldpain2go.com.

OldPain2Go® Privacy Policy · Version 1.0 · 23 July 2026