Aligné Privacy Notice
Last updated: 12 October 2026
1.Introduction
Aligné is committed to respecting your privacy and protecting your personal information. This Privacy Notice explains how we collect, use, store, disclose and protect personal information when you visit our website, book or attend a class, participate in an assessment or programme, purchase a product, attend an event or otherwise interact with our business.
We handle personal information in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR), the Irish Data Protection Act 2018, as amended, and other applicable data protection legislation.
Please read this notice carefully so that you understand how your information is handled and what rights you have.
2.Who Is Responsible for Your Information?
Aligné is operated by a sole trader based in Ireland. For the purposes of data protection legislation, the operator of Aligné is the data controller. This means that we determine the purposes for which your personal information is collected and processed and the means by which that processing takes place.
Business name: Aligné
Privacy contact: alignewellness@gmail.com
Website: www.aligné.org
You can contact us using these details if you have questions about this Privacy Notice, wish to exercise your data protection rights or have concerns about how your information is handled.
3.What Personal Information Do We Collect?
The information we collect depends on the services you use and your interactions with Aligné.
3.1 Identification and contact information
This may include your name, email address, telephone number and other contact details that you provide when booking a class, registering for a programme, purchasing a product or contacting us.
3.2 Booking, account and payment information
We may collect information relating to your bookings, attendance, cancellations, purchases, packages, memberships, payment status and relevant transaction records.
Payments may be processed by third-party payment providers. We do not intentionally collect or store full payment card details where these are handled directly by the payment provider.
3.3 Health and wellbeing information
Where relevant to your chosen service, we may collect information you provide about your health, injuries, pain, physical limitations, exercise history, pregnancy or postpartum circumstances, relevant medical conditions and other factors that may affect your participation.
This information may be collected through intake forms, consultations, assessments, questionnaires or direct communications.
Health information is particularly sensitive personal data under GDPR and receives additional protection.
3.4 Posture, movement and assessment records
Where you participate in a posture assessment, movement assessment or personalised programme, we may record relevant observations, movement patterns, stated goals, exercise modifications, progress notes and recommendations.
We may also collect photographs or videos for assessment purposes where appropriate and separately agreed.
These records are used to support the delivery of the relevant service. They are not automatically used for marketing, social media or other public purposes.
3.5 Communications and preferences
We may retain relevant communications you send to us, including emails, messages, enquiries, feedback and information you provide when discussing your services or programme participation.
We may also record your preferences concerning marketing communications and event updates.
3.6 Website and technical information
When you visit our website, certain information may be collected through cookies, website functionality and similar technologies. Depending on the services and settings in use, this may include technical information, device or browser details, usage information and online identifiers.
Further information about cookies and similar technologies will be provided through our cookie information or website privacy settings, where applicable.
We aim to collect only information that is reasonably necessary for the relevant purpose.
4.Why Do We Collect and Use Your Information?
We use personal information for the following purposes:
To manage bookings, accounts, payments, packages and attendance.
To provide Pilates classes, private sessions, consultations, assessments and personalised movement programmes.
To consider relevant health information and physical limitations when planning or adapting sessions within our professional qualifications and scope of practice.
To administer Aligné Reset and other programmes, workshops, events, memberships and digital services.
To provide customer support and respond to enquiries or feedback.
To maintain appropriate business, accounting and transaction records.
To manage our website and improve the operation of our services where appropriate.
To protect our business, systems and clients against misuse, fraud or security incidents.
To comply with legal obligations and establish, exercise or defend legal claims where necessary.
To send marketing communications where permitted by law and in accordance with your preferences.
We will not use your health information for unrelated marketing purposes or sell your personal information.
If we intend to use your information for a new purpose that is not compatible with the original purpose, we will provide any additional information and obtain consent or establish another lawful basis where required.
5.Our Legal Bases for Processing
GDPR requires us to identify a lawful basis for processing personal information. The appropriate basis depends on the purpose and circumstances of the processing.
Aligné may rely on the following legal bases where applicable.
Performance of a contract - Article 6(1)(b)
We may process information that is necessary to enter into or perform an agreement with you, such as managing bookings, administering purchases and providing the services you request.
Legal obligation - Article 6(1)(c)
We may process and retain information where necessary to comply with legal obligations, including applicable tax and accounting requirements.
Legitimate interests - Article 6(1)(f)
We may process information where necessary for legitimate business interests, such as protecting our services, maintaining appropriate operational records and addressing certain business or legal concerns, provided those interests are not overridden by your rights and freedoms. Where we rely on this basis, our legitimate interest will be explained where required.
Consent - Article 6(1)(a)
We may rely on your consent for particular processing activities where consent is the appropriate legal basis, such as certain optional communications or uses of personal information.
Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
Not every activity relies on consent. For example, withdrawing marketing consent does not require us to stop processing information that we are lawfully required to retain for accounting purposes.
6.Special Protection for Health Information
Health information is a special category of personal data under Article 9 GDPR. Its processing is subject to additional restrictions.
Where Aligné processes health information, we must have both an appropriate legal basis under Article 6 and a valid condition under Article 9.
Where we rely on explicit consent under Article 9(2)(a), we will request that consent separately, clearly and before the relevant processing takes place. The consent will explain what information is involved, why it is needed and how it will be used.
We will not assume that booking a class, accepting our Terms and Conditions or attending an assessment automatically constitutes explicit consent to all health-data processing.
We will:
Request only health information reasonably relevant to the service.
Use it only for the purposes explained to you or another compatible, lawful purpose.
Restrict access to authorised individuals who need the information.
Apply appropriate safeguards to the storage and handling of assessment records.
Avoid unnecessary duplication or disclosure of sensitive information.
Retain information only for the period justified by its purpose and applicable obligations.
If you do not provide health information that is necessary for us to assess whether a service can be delivered safely, we may be unable to provide that service or may need to modify your participation.
You may withdraw consent where consent is the basis for processing. This will not affect processing already carried out lawfully or prevent us from retaining information where another valid legal basis requires or permits it. If the information is essential to a service, withdrawal may affect our ability to continue providing that service.
7.Photographs, Videos and Assessment Images
Photographs and videos can contain personal information and may reveal sensitive information about an individual's physical characteristics or health.
Where photographs or videos are collected for a posture or movement assessment, they will be used for the assessment purposes explained to you.
We will not automatically use assessment photographs, videos or identifiable client information for:
Social media posts.
Advertising or promotional campaigns.
Testimonials or public case studies.
Educational content made available to the public.
Other unrelated purposes.
Where we wish to use identifiable photographs, videos or other information for optional promotional purposes, we will seek separate, appropriate permission in advance. Where consent is the applicable legal basis, that consent will be freely given and can be withdrawn for future processing.
Agreeing to participate in a recorded content class or an assessment does not automatically authorise every possible use of the resulting footage. The intended use will be explained separately.
8.Where and How Your Information Is Stored
Aligné uses digital tools to manage bookings, deliver services and maintain business records. Depending on the activity, these may include:
Squarespace: Website hosting, website forms and related website functionality.
Acuity Scheduling: Appointment scheduling and related booking administration.
Google Workspace and Google Drive: Business email, document management and storage of relevant client records, including assessment documents where applicable.
Stripe: Payment processing and transaction administration.
The precise information handled by each provider depends on the services and configurations in use.
Information submitted through a website or booking form may be processed by the relevant provider and, where applicable, exported to a separate business storage location. We remain responsible for ensuring that our use of these systems is appropriately managed.
These providers may process personal information on our behalf or act as independent data controllers for particular activities. Where required, appropriate contractual arrangements will be put in place.
We will review the systems we use and the information stored in them as our business develops.
9.Data Security
We take reasonable technical and organisational measures to protect personal information against unauthorised access, disclosure, alteration, loss or destruction.
These measures are appropriate to the nature of the information we process and the risks involved, and may include access restrictions, password protection, multi-factor authentication, device security and secure digital storage, where implemented and appropriate.
We aim to limit access to identifiable client health information to authorised purposes and to avoid unnecessary copies of sensitive records.
No electronic system can be guaranteed to be completely secure. Nevertheless, we take reasonable steps to protect your information and respond appropriately to security incidents.
10.Who May Receive Your Information?
We do not sell your personal information.
We may disclose relevant information to the following categories of recipients where necessary and lawful:
Service providers: Providers supporting our website, bookings, communications, payment processing, storage and business administration.
Professional advisers: Accountants, legal advisers or other professional advisers where necessary.
Public authorities: Courts, regulators, law enforcement agencies or other public bodies where disclosure is required by law or otherwise lawfully justified.
Other authorised recipients: Other parties where you have requested or authorised disclosure, or where another valid legal basis applies.
We aim to disclose only the information necessary for the relevant purpose. We do not provide service providers with unrestricted access to client records simply because they provide services to Aligné.
Health information will not be shared with another instructor, healthcare professional, employer, family member or unrelated third party merely because they may find it useful. Any disclosure must have an appropriate legal basis and, where required, a valid Article 9 condition.
11.International Data Transfers
Some service providers may store or process information outside Ireland or the European Economic Area (EEA), or may involve access from other countries.
Where personal information is transferred internationally, we will comply with applicable GDPR requirements. Depending on the circumstances, this may involve an adequacy decision, approved contractual safeguards or another lawful transfer mechanism.
Information about relevant international transfers and the safeguards used will be provided where required.
12.How Long Do We Retain Your Information?
Aligné retains personal information only for as long as necessary for the purpose for which it was collected, taking account of applicable legal obligations, legitimate business requirements and the rights of individuals.
Different categories of information may require different retention periods. We do not retain personal information indefinitely simply because it might be useful in the future.
12.1 Accounting, tax and financial records
Accounting and tax records, including relevant invoices, receipts, expense records and supporting transaction information, will generally be retained for six years in accordance with applicable Irish requirements.
Where particular records are subject to a longer legal retention requirement, an ongoing audit, an investigation or a relevant legal claim, they may need to be retained for longer.
We aim to retain only the financial information necessary for these purposes and to avoid unnecessarily duplicating sensitive health information in accounting records.
12.2 Booking, attendance and routine administrative records
Booking, attendance and routine administrative records will be reviewed for deletion or anonymisation when they are no longer needed for service administration, customer support, business records or other justified purposes.
Our intended retention period for routine booking and administrative records is two years after the last relevant booking, unless a longer period is justified by a legal obligation, an unresolved dispute or another documented lawful purpose.
12.3 Health questionnaires and intake forms
Health questionnaires and intake forms will be retained for a defined period appropriate to the service, the purpose for which the information was collected and any relevant legal, professional or insurance requirements.
We will not automatically retain all health information for six years merely because accounting records may need to be kept for that length of time. Equally, we will not automatically delete health information after two years without considering relevant safety, insurance and legal requirements.
Access to health information will be restricted, and information that is no longer necessary will be securely deleted or anonymised unless a valid reason for further retention applies.
12.4 Posture and movement assessment records
Posture and movement assessment notes, observations, recommendations and progress records will be retained according to a defined retention period that takes account of the purpose of the assessment, the nature of the service and any relevant legal or insurance requirements.
Where an assessment record is no longer needed for service delivery or another documented lawful purpose, it will be securely deleted or anonymised.
12.5 Posture assessment photographs and videos
Photographs and videos collected for assessment purposes will be retained only for as long as necessary for the assessment, relevant progress monitoring or another documented lawful purpose.
Where feasible and appropriate, our intended policy is to review these records for deletion around 12 months after the last relevant assessment, unless continued retention is justified and documented.
Photographs and videos will not be retained indefinitely simply because they might be useful for future comparisons. If a longer retention period is necessary, the reasons will be assessed and access will remain restricted.
12.6 Consent records and client agreements
Consent records, signed client agreements and related documentation may be retained for six years after the relevant client relationship ends as a proposed business retention policy, where justified by the need to demonstrate compliance, maintain appropriate records or establish, exercise or defend legal claims.
The period will be reviewed against the nature of the record, any applicable legal obligations and the need to minimise the retention of personal information.
12.7 Emails and routine client communications
Routine client emails and messages will be reviewed for deletion when they are no longer needed, with a general review point of two years after the relevant communication or the end of the relevant service.
Important service records, complaints, disputes or communications relevant to legal obligations or potential claims may be retained for a longer, justified period.
12.8 Complaints, accidents and incidents
Records relating to complaints, accidents, injuries, security incidents or other significant matters will be retained on a case-by-case basis, taking account of applicable legal requirements, insurance conditions and the need to establish, exercise or defend legal claims.
Where an actual or anticipated claim requires information to be preserved, relevant records may be retained for the necessary period, with access restricted to the appropriate purpose.
12.9 Marketing information
Marketing information will be retained in accordance with applicable data protection and electronic marketing requirements.
We will stop sending marketing communications when required by law, including following a valid withdrawal of consent or objection. Where necessary, we may retain a minimal record of your opt-out preference to ensure that we continue to respect it.
12.10 Promotional photographs and videos
Promotional photographs and videos will be retained and used in accordance with the applicable permission, lawful basis and stated purpose.
Where consent is relied upon, withdrawal will be respected for future consent-based use. We will take appropriate steps to stop further use and remove material from channels we control where required, subject to applicable legal obligations and practical limitations concerning copies already distributed.
12.11 Website and technical information
Website logs, cookies and similar technical information will be retained according to their specific purpose, the settings of the relevant systems and applicable legal requirements.
We will establish appropriate expiry or deletion periods and avoid retaining technical information for longer than necessary.
12.12 Client account information
Client account information will be retained while the account is active and for a justified period afterwards where needed for service administration, financial records, legal obligations or other lawful purposes.
When an account is no longer needed, we will take appropriate steps to delete or anonymise information that no longer needs to be retained.
12.13 Deletion and backups
When information is no longer required, we will take appropriate steps to securely delete or anonymise it from active systems and copies under our control.
This includes considering duplicate files, downloaded PDFs, email attachments, cloud storage and relevant recycle bins or trash folders.
Backups will be subject to appropriate access restrictions and a documented retention or expiry process. Where immediate deletion from a backup is not technically feasible, the information will remain protected and will not be returned to active use unnecessarily. We will take appropriate steps to ensure that deleted information is not inadvertently restored to active systems.
12.14 Legal and insurance exceptions
The retention periods described above are intended to guide our normal business practices. A record may need to be retained for longer where required by law or where a documented and lawful need exists to establish, exercise or defend a legal claim.
Any exception will be considered on its own circumstances, and we will avoid retaining unrelated or unnecessary information.
13.Your Data Protection Rights
Under GDPR, you may have the following rights, subject to applicable conditions and exceptions.
Right of access: You can request access to the personal information we hold about you.
Right to rectification: You can ask us to correct inaccurate or incomplete information.
Right to erasure: You can request deletion of your information where the legal requirements for erasure are met.
Right to restriction: You can request that certain processing be restricted in circumstances provided for by law.
Right to data portability: You may request certain information in a structured, commonly used and machine-readable format where the right applies.
Right to object: You may object to processing based on legitimate interests in the circumstances provided by law. You have an absolute right to object to the use of your information for direct marketing.
Right to withdraw consent: Where processing is based on consent, you can withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.
Rights concerning automated decision-making: You have rights in relation to certain decisions made solely by automated means, including profiling, where the relevant GDPR provisions apply.
These rights are not absolute in every circumstance. For example, we may be required to retain accounting records or may be unable to erase information that must lawfully be kept.
To exercise a right, contact us using the privacy contact details in this notice. We may ask you to verify your identity before responding.
We will respond within the period required by law, normally one month. Where permitted, this period may be extended in the case of complex or multiple requests, and we will inform you of any applicable extension.
14.Marketing Communications
We may send service-related communications necessary to administer your bookings, payments, purchases or participation in a programme.
Marketing communications, including newsletters, promotions and invitations to future events, will be handled in accordance with applicable data protection and electronic marketing legislation.
Where consent is required, we will obtain it separately from consent to participate in a service or to process health information.
You may unsubscribe from marketing emails using the unsubscribe mechanism provided or by contacting us directly.
Unsubscribing from marketing will not prevent us from sending essential service-related communications where those communications are otherwise lawful.
15.Cookies and Website Technologies
Our website may use cookies and similar technologies to support essential functionality, understand website usage or provide other features.
Where consent is required for non-essential cookies or similar technologies, we will seek consent through an appropriate mechanism.
You can manage available cookie preferences through the relevant website settings. Blocking certain cookies may affect some website functionality.
Further details will be provided in our cookie information or through the website's cookie preference mechanism, where applicable.
16.Automated Decision-Making
Aligné does not intend to make decisions about clients solely through automated processing or profiling that produce legal effects or similarly significant effects.
If this changes, we will provide the information required by data protection legislation before introducing any such processing, including information about its purpose, legal basis and relevant consequences.
17.Data Breaches
If we become aware of a personal data breach, we will take appropriate steps to contain and investigate the incident, assess the risks to affected individuals and mitigate potential harm.
Where required by GDPR, we will notify the Data Protection Commission within the applicable timeframe and inform affected individuals where the legal threshold for notification is met.
We will document relevant incidents and take reasonable steps to reduce the risk of recurrence.
18.Your Responsibility to Provide Accurate Information
You are responsible for providing accurate information when using our services and for informing us of material changes to information that may affect your participation, particularly where it concerns health, injuries or physical limitations.
You should provide only information about other people that you are authorised to share and that is lawful to provide.
Please avoid sending unnecessary medical records or other sensitive documents through ordinary email or messaging channels. If additional information is genuinely necessary, contact us to discuss an appropriate way to provide it.
19.Third-Party Websites and Services
Our website or communications may contain links to websites, platforms or services operated by third parties.
Those third parties may have their own privacy notices and data-handling practices. We encourage you to review their privacy information before providing personal information directly to them.
This Privacy Notice applies to the processing for which Aligné is responsible and does not automatically govern the independent processing carried out by other organisations.
20.Changes to This Privacy Notice
We may update this Privacy Notice from time to time to reflect changes to our services, systems, data-handling practices or legal obligations.
The current version will be made available through our website or relevant service documentation. Where required, we will notify you of material changes or obtain fresh consent before undertaking processing that requires it.
21.Contact Us and Complaints
If you have questions about this Privacy Notice, wish to exercise your rights or have concerns about how Aligné handles your information, please contact us using the details below.
Business: Aligné
Privacy email: alignewellness@gmail.com
Website: www.aligné.org
You also have the right to lodge a complaint with the Irish Data Protection Commission:
Website: https://www.dataprotection.ie/
We encourage you to contact us first if you wish to raise a concern, although you are entitled to contact the Data Protection Commission directly.
This Privacy Notice should be read alongside the Aligné Terms and Conditions and any separate consent forms applicable to the services you choose to use.