Your information, in plain English.

The short version

I collect the least I can get away with. Your contact details are kept so I know who is coming. Anything you tell me about your body is encrypted, readable only by me, and deleted on a schedule. I do not sell anything to anyone, and there are no advertising trackers on this site.

What I collect

Contact details

Your name, phone number and — if you give one — an email address. Kept so I can confirm appointments and reach you if something changes. Lawful basis: performing the service you asked for.

What you tell me about your body

Problem areas, areas to avoid, pressure preference, injury history and anything medical you mention in the booking form. This is health information and is treated as such: it is encrypted with AES-256 before it is stored, so it cannot be read out of the database without a key that lives separately. It is stored only if you tick the box, which is unticked by default. You can book without it and we will talk it through in person instead.

Messages you send

Whatever you write in the contact form. That form is not encrypted, which is why it asks you to keep medical detail out of it.

Basic technical data

To stop automated abuse, the booking and contact forms keep a one-way hash of your IP address for up to an hour. The address itself is never stored, and the hash cannot be turned back into one.

What I do not do

• No advertising or analytics trackers. No Facebook pixel, no Google Analytics, no third-party cookies.
• No selling, renting or sharing your information with anyone for marketing.
• No mailing list unless you actively ask to be on one.
• Fonts are served from this site, not from Google, so visiting does not tell a third party you were here.

How long it is kept

Appointment records are kept as business records. Encrypted health intake is deleted automatically 400 days after your appointment. Contact-form messages are deleted once they have been dealt with.

Your rights

You can ask me for a copy of everything I hold about you, ask me to correct it, or ask me to delete it. No explanation required, and there is no charge. Call (859) 202-5287 or email whismanlmt@gmail.com and I will action it within thirty days — usually the same week.

If you are in the UK or EU, the GDPR rights to access, rectification, erasure, restriction, portability and objection all apply, and you may complain to your national data protection authority.

A note on HIPAA

Kelly Whisman, LMT is a private-pay massage practice and does not submit claims to health insurers electronically, which means it is generally not a HIPAA “covered entity”. That is a technicality, and I have built this site as though it were anyway: health information is encrypted at rest, collected only with consent, and deleted on a schedule. If that ever changes — if I begin billing insurers — this page will change with it.

Who to contact

Kelly Whisman, LMT · (859) 202-5287 · whismanlmt@gmail.com