Legal

Privacy Policy

Last updated: September 2026

1. Who we are

R1SE Urban Studios is operated by two related UK companies. They act as joint data controllers for personal information collected through our studios, urban spa, app, R1SE TV streaming service, this website, and our marketing channels:

• R1SE Urban Spa Ltd, operating the Kelham Urban Spa at 8 Shepherd Street, Sheffield, S3 7BA.
• R1SE Brook Place Ltd, operating the Brook Place studio at 112 Napier Street, Sheffield, S11 8DL.

For the purposes of UK GDPR, both companies are joint controllers of personal data collected from members and visitors. Either company can be contacted at hello@r1se.co.uk to exercise any of the rights described below.

2. The information we collect

We may collect and process the following categories of data:

• Account & profile: name, date of birth, email address, phone number, address, emergency contact, profile photo (if you choose to add one), and any preferences you set in your account.
• Booking & attendance: sessions booked, attended, cancelled, late-cancelled or no-showed; instructor ratings; reviews you submit; gift card and credit purchases.
• Health-relevant information: only what you voluntarily share for safety reasons (e.g. injuries, pregnancy status, medical conditions you have disclosed to an instructor or recovery-therapy practitioner) and any waivers you sign for specialist services such as Aerial, HBOT, or Fire & Ice.
• Optional Body Intelligence: body-scan measurements and reports from Visbody, activity, sleep, heart rate and recovery readings you choose to import from Apple Health, Android Health Connect or your R1SE Recovery Ring, and the goals and context you choose to record. R1SE OS holds the member record used by our app and website.
• Food, drink and cycle tracking: food or menu photos, food descriptions, meal and hydration logs, dietary preferences, declared allergies, fasting plans and optional check-ins. Cycle entries, symptoms and reproductive-health imports are optional and use separate consent and sharing controls.
• Optional device services: phone notification tokens and preferences, Bluetooth ring identifiers and connection status, and location used for studio-arrival features when you enable them.
• Payment information: handled exclusively by our payment processors (Square, WellnessLiving, Stripe, PayPal as applicable). We do not see or store full card numbers; we may receive limited card-token references and the last four digits of the card for receipts and refunds.
• Communications: emails, SMS, in-app messages, chat-widget conversations, and feedback you submit through our website or via the chat widget.
• Website & app usage: IP address, device and browser type, the pages you view, when you visit, how you got here, how long you spend on pages, scroll depth, clicks, form-submit attempts, checkout progress or abandonment, browser errors, performance timings, and any cookies or similar technologies you have agreed to. When you are logged in, this may be connected to your R1SE account so our team can support you and improve your experience.
• R1SE TV viewing data: what you watch, how long for, how far through a video you get, and any ratings you leave, used to recommend content and improve the catalogue.

3. How we use your information

Optional Body and Food Intelligence data supports your private daily summaries, food estimates, chosen goals and reminders. These features provide wellbeing guidance, not diagnoses. Health and reproductive data are not used for advertising or sold to data brokers. Social sharing is separate from connecting a health source: raw health readings and body scans are not made public by joining Community.

Community posts and replies are visible to the relevant group. Directory visibility is optional. Reports, blocks and moderation records help protect members; authorised R1SE staff review reported and held content.

We use your data to:

• Run our services, create your account, take bookings, process payments, deliver R1SE TV, and provide customer support.
• Keep you and others safe, act on health information you have shared, manage waivers and prerequisites (e.g. Aerial Beginners Course completion), and respond to incidents.
• Send you transactional messages such as booking confirmations, schedule changes, payment receipts and account notifications.
• Send you marketing messages where you have agreed to them or where we are otherwise lawfully entitled to do so. You can opt out at any time using the unsubscribe link in our emails or by emailing hello@r1se.co.uk.
• Improve our studios, urban spa, classes and the R1SE TV catalogue, including analytics on page performance, customer journeys, video engagement, and abandoned booking or checkout flows.
• Meet our legal, regulatory, accounting and audit obligations.

4. Lawful bases

Under UK GDPR, we process personal data on one or more of the following lawful bases:

• Contract: to provide the services you have signed up for (memberships, classes, recovery sessions, R1SE TV).
• Legitimate interests: running and improving R1SE in a balanced way, fraud prevention, and basic transactional communication.
• Consent: for marketing emails to new contacts, non-essential cookies, and for any health information you voluntarily share with us beyond what is necessary for safety.
• Legal obligation: where we are required to process data for tax, accounting, safeguarding or law enforcement reasons.

5. Sharing your information

We share personal data only with:

• Trusted technology providers: WellnessLiving (booking, CRM, payments), Square and Stripe (payments), Vimeo (video hosting for R1SE TV), Google Workspace and Resend (email), Twilio (SMS where used), Cloudflare and Vercel (hosting and security), and our internal R1SE Operating System running on Railway.
• Marketing platforms we have engaged (e.g. our email-marketing tool) only for messages you have consented to.
• Professional advisers, accountants, lawyers, insurers, under appropriate confidentiality obligations.
• Authorities where we are required to do so by law, regulation, court order, or for the prevention of fraud or crime.
• A successor entity if R1SE Urban Spa Ltd or R1SE Brook Place Ltd is sold or merged. You will be notified.

We do not sell your data and never share it with third parties for their own marketing.

Apple Health and Health Connect access is controlled by your phone and your choice to connect it to your signed-in R1SE account. Exporting supported R1SE measurements to Apple Health requires write permission. You can revoke permissions in your phone settings; revoking access stops future transfers but does not itself delete records already imported into R1SE or written to Health.

Mobile Ask R1SE and AI-assisted nutrition targets use R1SE-managed local AI processing, without automatically falling back to a cloud AI provider. Food and menu analysis also uses our R1SE-managed AI service. Open Food Facts supplies packaged-food information using barcodes and product search terms, not your account or personal Body Intelligence records. Product-image requests may also reach Open Food Facts. Expo and Apple or Google deliver enabled push notifications and process the device tokens and notification content needed to do so. Reminder previews can appear on your lock screen; you can change this in your phone settings.

6. Data location and transfers

Your data is primarily stored within the UK and the European Economic Area (EEA). Some of our service providers (for example Vercel and Vimeo) operate globally and may transfer data to other jurisdictions including the United States. Where transfers occur outside the UK/EEA, we rely on UK adequacy regulations or International Data Transfer Agreements / Standard Contractual Clauses to ensure your data remains protected.

7. Cookies & analytics

We use a small set of cookies and browser storage for essential site functionality, account access, security, and analytics. We do not use third-party advertising trackers on our website. If you are logged in, we may also record first-party account activity such as pages visited, time on page, video progress, and checkout progress to provide support, understand demand, and improve the service.

Analytics cookies are optional. When you first visit our website, our cookie banner lets you either accept analytics cookies or reject non-essential cookies. You can change your choice at any time using the Cookie preferences link in the footer. If you reject non-essential cookies, Google Analytics remains in consent-denied mode and we do not set GA analytics cookies.

8. How long we keep your data

We keep account and booking data while you are an active member and for up to seven years after your last activity, in line with UK accounting and tax record-keeping requirements. Marketing consent records are kept for as long as you remain on the list, plus a short audit period after you unsubscribe. Health-relevant disclosures are kept only for as long as needed to deliver the service safely.

9. Your rights

In the R1SE App, Profile > Privacy includes saved social-privacy settings, this policy and an account-deletion request. We verify deletion requests using an email code. R1SE processes them manually, aims to complete verified requests within 28 days, and confirms completion and any records that must be retained for legal or financial obligations. Signing out is not account deletion. Financial record retention does not automatically extend to optional health readings, cycle entries or food photos.

Under UK data protection law you have the right to access, rectify, erase (in certain circumstances), restrict, port and object to the processing of your personal data, and to withdraw any consent you have given. To exercise any of these rights, email hello@r1se.co.uk. We will respond within one calendar month.

If you are unhappy with how we have handled your data, you can also complain to the UK Information Commissioner's Office (ICO) at ico.org.uk, but we would always prefer the chance to put things right first.

10. Security

We use industry-standard technical and organisational measures to protect your data, including encryption in transit, access controls, audit logging on our internal R1SE Operating System, and supplier due diligence. No method of transmission or storage is 100% secure; if you believe your account has been compromised, email us immediately at hello@r1se.co.uk.

11. Changes to this policy

We may update this policy from time to time. We will post any changes here and, where the changes are material, notify you by email.

12. Contact us

For any questions or requests about this privacy policy, contact:

R1SE Urban Studios
R1SE Urban Spa Ltd · 8 Shepherd Street, Sheffield, S3 7BA
R1SE Brook Place Ltd · 112 Napier Street, Sheffield, S11 8DL
hello@r1se.co.uk