Last updated: September 2026

Chill Lab (“we”, “us”, “our”) is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains what information we collect, why we collect it, how we use it and what rights you have under the General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018.

If you have any questions, contact us at: [EMAIL]

1. Who We Are

Data Controller: Chill Lab
Address: Nenagh, Co. Tipperary, Ireland
Email: [EMAIL]
Website: https://chilllab.ie

As the data controller, we determine the purposes and means of processing your personal data. Where we process data on behalf of a corporate client (for example, employee data provided for a workplace wellness programme), we act as a data processor and are bound by a separate data processing agreement with that client.

2. What Personal Data We Collect

Depending on how you interact with us, we may collect the following categories of personal data:

a) Identity and Contact Data

  • Full name
  • Email address
  • Phone number
  • Company name and job title (corporate clients)

b) Booking and Appointment Data

  • Appointment date, time and service selected
  • Booking history and session notes
  • Intake and health questionnaire responses

c) Health Data (Special Category)

For certain services — including massage therapy and specialist treatments — we collect health information necessary to deliver your session safely. This is special category data under GDPR and is processed only with your explicit consent. This may include:

  • Medical conditions, injuries or contraindications
  • Medications relevant to treatment
  • Pregnancy or recent surgery

d) Payment Data

We do not store full card details. Payments are processed via our payment provider (Stripe or equivalent). We retain records of transaction amounts, dates and invoice references for accounting and legal compliance.

e) Communication Data

  • Emails, messages or enquiries you send us
  • Responses to AI-assisted communications (see Section 6)
  • Marketing preferences and consent records

f) Technical Data

  • IP address and browser type
  • Pages visited and time spent on site
  • Device type and operating system
  • Cookie identifiers (see Section 10)

3. How We Collect Your Data

  • Directly from you — when you book an appointment, complete an intake form, contact us by email or phone, or sign up to receive marketing communications.
  • From corporate clients — when a business engages us for a workplace wellness programme and provides employee contact information or session logistics.
  • Automatically — through cookies and analytics tools when you visit our website.
  • Via AI-assisted tools — where we use AI agents to handle booking queries, send confirmations or follow up after appointments (see Section 6).

4. Legal Bases for Processing

We process your personal data on the following legal bases under GDPR Article 6 (and Article 9 for health data):

PurposeLegal Basis
Delivering your booked appointment or servicePerformance of a contract (Art. 6(1)(b))
Processing intake and health questionnairesExplicit consent (Art. 9(2)(a))
Sending booking confirmations and remindersPerformance of a contract (Art. 6(1)(b))
AI-assisted client communicationsLegitimate interests (Art. 6(1)(f))
Marketing emails and promotional messagesConsent (Art. 6(1)(a))
Maintaining financial and business recordsLegal obligation (Art. 6(1)(c))
Improving our website and servicesLegitimate interests (Art. 6(1)(f))
Delivering corporate wellness programmesPerformance of a contract / legitimate interests

5. How We Use Your Data

  • To manage your bookings — confirming appointments, sending reminders and maintaining your session history.
  • To deliver our services safely — reviewing health questionnaire responses before each appointment.
  • To process payments — issuing invoices and maintaining financial records.
  • To communicate with you — responding to enquiries, sending service updates and managing your account.
  • To send marketing communications — only where you have given consent (see Section 7).
  • To operate AI-assisted tools — automating routine communications such as confirmations, reminders and follow-ups (see Section 6).
  • To fulfil corporate contracts — coordinating sessions, managing participant lists and reporting to the contracting organisation (see Section 8).
  • To improve our website and services — using anonymised analytics data.
  • To comply with legal obligations — retaining records required under Irish tax and employment law.

6. AI Agents and Automated Communications

We use AI-powered tools and automated systems to assist with client communications. This includes:

  • Booking confirmations and reminders — automated messages sent after a booking is made or ahead of an appointment.
  • AI chat agents — conversational AI tools that may respond to initial enquiries, answer questions about our services, assist with booking requests or send follow-up messages after your appointment.
  • Automated follow-ups — messages sent after a session to gather feedback or share relevant information.

Important: No AI system we use makes legally significant or similarly impactful automated decisions about you without human oversight. AI tools assist our team — they do not replace professional judgement regarding your health, treatment suitability or any matter that affects your rights or interests in a meaningful way.

Where an AI agent processes your personal data (name, contact details, booking information), this is done under our legitimate interests in providing an efficient and responsive service, and is subject to appropriate safeguards. You may always request to speak with a human member of our team by contacting us directly at [EMAIL].

AI tools we use may be provided by third-party technology companies. Where they process your personal data, we have data processing agreements in place and conduct due diligence on their GDPR compliance.

7. Marketing Communications

We will only send you marketing communications — including newsletters, promotional offers, service updates and event invitations — where you have:

  • Explicitly opted in via a booking form, contact form or sign-up page, or
  • Previously engaged with our services and we reasonably believe our communications are relevant to you (soft opt-in, subject to the ePrivacy Regulations).

You can withdraw your consent and unsubscribe from marketing communications at any time by:

  • Clicking the unsubscribe link in any marketing email
  • Emailing us at [EMAIL]
  • Texting STOP in reply to any marketing SMS

Withdrawing consent does not affect the lawfulness of any processing carried out before the withdrawal.

8. Corporate Clients and Employee Data

Where a business or organisation engages Chill Lab to deliver a workplace wellness programme, the following applies:

  • The corporate client is responsible for ensuring it has the appropriate legal basis to share employee data with us (typically, legitimate interests in providing an employee benefit, or consent obtained from employees).
  • We process employee data only for the purpose of delivering the contracted service — scheduling sessions, managing participant lists and facilitating individual appointments.
  • We do not use employee data provided by a corporate client for our own marketing purposes without separate consent from the individual.
  • Where required, we will enter into a Data Processing Agreement (DPA) with the corporate client.
  • Following completion of a programme, we retain minimal records (attendance and invoice data) for legal and accounting purposes only.

9. Sharing Your Data with Third Parties

We do not sell your personal data. We share it only where necessary with the following categories of trusted third parties, all of whom are bound by appropriate data protection agreements:

  • Booking platform — our appointment management system (BookFlow) stores booking and session data.
  • Payment processor — Stripe or equivalent, for secure payment processing.
  • Email and SMS service providers — for sending booking confirmations, reminders and marketing communications.
  • AI technology providers — where AI tools process your data as described in Section 6.
  • Analytics providers — anonymised website usage data (Google Analytics or equivalent).
  • Professional advisors — accountants, legal advisors and insurers, where required.
  • Regulatory authorities — where we are legally obliged to disclose information (e.g. Revenue Commissioners, Data Protection Commission).

10. Cookies

Our website uses cookies — small text files stored on your device — to make the site work correctly and to help us understand how it is used. We use the following types of cookies:

  • Strictly necessary cookies — required for core website functionality (booking system, security). Cannot be disabled.
  • Analytics cookies — help us understand which pages are visited and how users navigate the site. We use anonymised data only. You can opt out via your browser settings or our cookie banner.
  • Marketing cookies — used to measure the effectiveness of advertising campaigns (Meta Pixel, Google Analytics). Only placed with your consent.

You can manage your cookie preferences at any time through our cookie consent banner or your browser settings. Note that disabling some cookies may affect how the website functions.

11. Data Retention

We retain your personal data only for as long as necessary for the purposes set out in this policy:

  • Client booking and session records — 7 years from the date of the last appointment (required for Irish tax law compliance).
  • Health questionnaire data — for the duration of the client relationship, plus 2 years, unless you request earlier deletion.
  • Marketing consent records — for as long as you remain subscribed, plus 1 year after unsubscription (to demonstrate compliance).
  • AI communication logs — 12 months, unless required for dispute resolution.
  • Corporate programme records — 7 years from the end of the contract for accounting records; employee personal data deleted within 90 days of programme completion unless otherwise agreed.
  • Website analytics data — 26 months (anonymised).

12. International Data Transfers

Some of our third-party service providers (including AI tool providers and analytics platforms) may be based outside the European Economic Area (EEA). Where your data is transferred outside the EEA, we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission, or that the recipient country has been deemed to provide adequate protection under GDPR.

13. Your Rights Under GDPR

You have the following rights regarding your personal data. To exercise any of them, contact us at [EMAIL]. We will respond within one calendar month.

  • Right of access — you can request a copy of the personal data we hold about you (a Subject Access Request).
  • Right to rectification — you can ask us to correct inaccurate or incomplete data.
  • Right to erasure (“right to be forgotten”) — you can ask us to delete your data where there is no legitimate reason for us to continue holding it.
  • Right to restriction of processing — you can ask us to pause processing your data in certain circumstances.
  • Right to data portability — you can request your data in a structured, machine-readable format.
  • Right to object — you can object to processing based on legitimate interests or for direct marketing.
  • Rights related to automated decision-making — you have the right not to be subject to solely automated decisions that produce significant effects on you.
  • Right to withdraw consent — where processing is based on consent, you can withdraw it at any time without affecting prior processing.

If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Data Protection Commission (DPC):
Website: www.dataprotection.ie
Phone: +353 (0)57 868 4800

14. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction or alteration. These include encrypted data transmission (HTTPS), access controls, regular security reviews and staff awareness of data protection obligations. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the Data Protection Commission within 72 hours and inform you without undue delay where required.

15. Children’s Data

Our services are intended for adults aged 18 and over. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us at [EMAIL] and we will delete it promptly.

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology or legal requirements. When we make significant changes, we will update the “Last updated” date at the top of this page and, where appropriate, notify you by email. We encourage you to review this policy periodically.

17. Contact Us

For any questions, requests or concerns about this Privacy Policy or your personal data, please contact:

Chill Lab
Nenagh, Co. Tipperary, Ireland
Email: [EMAIL]
Website: https://chilllab.ie