Privacy notice

House 137 runs small, science-informed wellness retreats. For UK GDPR purposes we are the data controller. You can reach our data protection contact at privacy@house137.com.

We deliberately separate ordinary contact data from sensitive health information. They live in different places, with different access rules.

• Contact and booking data — name, email, phone, country, retreat choice, dietary requirements, emergency contact, payment records. Used to run your booking and, only if you opt in, to send you occasional updates. Visible to the House 137 team.
• Health information — the health questionnaire you complete when you apply (conditions, medications, mental health history, current support, GP details, allergies, mobility needs). This is special category data under UK GDPR Article 9. It is stored in a separate, access-restricted record and is visible only to you and to clinically responsible staff. It is never included in team exports, marketing lists or newsletters.

• Contract — to process your application, booking and payment.
• Legitimate interests — to run and secure the site and respond to enquiries.
• Consent — for marketing emails and for non-essential cookies. You can withdraw at any time.
• Explicit consent (Article 9) — for health information, which we use solely for screening, safety planning and duty of care on retreat. We ask for this separately and you can withdraw it, though we may then be unable to offer you a place for safety reasons.

Contact and booking records are kept for up to six years for financial and legal purposes. Health questionnaires are kept only as long as needed for the retreat and follow-up care planning, and are deleted no later than 12 months after your retreat unless a safeguarding or legal obligation requires otherwise. Marketing consent records are kept as evidence of consent while you remain subscribed and for 24 months afterwards.

We use a small number of processors: our cloud database and authentication provider, our payment provider (Stripe — card details never touch our systems), our email provider, and our scheduling provider for discovery calls. We do not sell your data or share health information with third parties without your consent, except where we have a legal or safeguarding duty.

Access to the participant portal requires authentication. Data is encrypted in transit and at rest, access is governed by row-level rules so you can only see your own records, and health data is limited to clinical roles. Staff access is role-based and reviewed.

You have the right to access, correct, delete, restrict, object to, or receive a portable copy of your data, and to withdraw consent. Signed-in participants can download their full record and raise a request directly in the portal, or email privacy@house137.com. We respond within one month. You can also complain to the Information Commissioner's Office (ico.org.uk).

We use only essential cookies unless you consent to more. See our cookie notice.