Privacy Policy
Last updated: 3 October 2026
This policy explains what personal data YogSpace collects, why, who we share it with, how long we keep it, and the rights you have. It applies to students, Instructors and visitors to the YogSpace website and app (the "Platform").
1. Who we are
1.1 The data controller is YOGSPACE LTD, trading as YogSpace, a company registered in England and Wales under company number 17485142, with its registered office at 128 City Road, London EC1V 2NX, United Kingdom ("we", "us").
1.2 YOGSPACE LTD is also the controller of the health information collected on the booking intake: we decide which questions are asked, collect the answers, store them and decide who can see them and for how long.
1.3 For any privacy question or to exercise your rights, email support@yogspace.com with "Privacy" in the subject line, or write to us at our registered office.
1.4 We have not appointed a Data Protection Officer. Our founders are responsible for data protection at YogSpace and answer the privacy emails above.
2. The data we collect
Account and profile data. Your name, email address, password (stored only in hashed form), phone number if you give it, country, time zone, preferred language and profile picture. If you sign in with Google, we receive your name, email address and profile picture from Google.
Booking intake. When you book, we ask for your yoga experience, the props you have at home, what you would like to focus on and, if your teacher offers specialties, the focus of the class.
Health information (special category data). In a separate health section of the intake, you choose whether to share health information. If you choose to share it, we ask:
- whether you have any current injuries or conditions (optional, free text);
- for back pain, prenatal and yoga therapy classes, a few yes or no safety questions (for example whether a doctor or midwife has told you not to exercise). If you answer "Yes" to any of them, the booking stops, we ask you to speak to your GP or midwife first, and we do not store your answers.
Your answers are only sent to us if you tick the explicit consent box at the end of the form. If you prefer not to share, nothing about your health is sent or stored; for back pain, prenatal and yoga therapy classes we then record only that you chose not to share and confirmed that you checked with your doctor or midwife that the class is safe for you.
Booking data. The Sessions you book, cancel or reschedule, the Instructor, the date and time, and records of attendance, no-shows and disputes.
Payment data. Payments are processed by Stripe. We receive confirmation of each payment (amount, currency and status), but we never see or store your card details. We keep records of Wallet credit, bundles, refunds and receipts.
Messages. Messages you send through the Platform. Messages are automatically scanned to detect off-platform contact details (such as email addresses and phone numbers) and requests to pay outside the Platform; flagged messages may be read by our trust and safety team.
Reviews, support and disputes. Reviews you write, and what you tell us when you contact support, raise a dispute or use the contact form.
Instructor data. If you teach on YogSpace, also your professional details and credentials (for example Yoga Alliance registration and certificates), the documents and videos you upload for verification, your public profile, availability, earnings, commission, cancellation and reschedule rate, and the details needed to pay you (bank or payout account details, held by our payout providers Stripe and Wise).
Video Sessions. Sessions take place through our video providers (Daily or Zoom). They receive your display name and technical details such as when you joined and left. They do not receive your intake or health answers. Sessions are not recorded.
Technical and usage data. Your IP address, browser and device type, pages you visit and the booking steps you reach (never the answers you give), and security logs. If a booking stops at a safety question, we only count that it happened and for which type of class, without linking it to you or your Instructor and without the time of day. We use these to keep the Platform secure, fix problems and understand where bookings fail. See our Cookie Policy.
3. Why we use your data and our legal basis
| What we do | Legal basis |
|---|---|
| Create and run your account, book Sessions, take payment, give refunds, send booking and account emails | Performance of our contract with you (UK/EU GDPR art. 6(1)(b)) |
| Share your name, booking details and general intake answers with your Instructor so they can prepare your Session | Performance of our contract with you (art. 6(1)(b)) |
| Collect health information on the intake, store it and share it with the Instructor you book so they can adapt your Session safely | Contract (art. 6(1)(b)) and your explicit consent for health data (art. 9(2)(a)) |
| Keep health answers for past Sessions after you withdraw consent or close your account, until the retention period ends | Establishing, exercising or defending legal claims (art. 9(2)(f)) |
| Record that you chose not to share health information for a therapeutic or prenatal class, and your confirmation, and tell your Instructor | Legitimate interests in class safety and in establishing or defending legal claims (no health data is recorded) |
| Verify Instructors' identity and credentials, pay Instructors, apply commission | Contract with the Instructor; legitimate interests in keeping students safe |
| Automatically scan messages to detect off-platform contact details and payment requests, and review flagged messages | Legitimate interests in keeping users safe and payments on the Platform |
| Handle disputes, complaints, no-show reports and reports of misconduct | Contract; legitimate interests in resolving disputes; legal claims |
| Calculate Instructors' cancellation and reschedule rate and temporarily hide an Instructor from browse and search when it is too high | Contract with the Instructor; legitimate interests in reliable bookings for students |
| Keep the Platform secure, prevent fraud and abuse, fix problems and improve the booking process | Legitimate interests |
| Keep financial and tax records, respond to lawful requests from authorities | Legal obligation |
Where we rely on legitimate interests, we have balanced them against your rights. You can ask us for details and object at any time (see section 8).
We do not sell your personal data and we do not use it for advertising.
4. Health information
4.1 Your choice and your consent. You never have to share health information. If you choose to share it, the form ends with an unticked box: "I explicitly consent to YogSpace collecting my health information (e.g. pain, pregnancy status) and sharing it with the instructor I book, so they can adapt my session safely." Your answers stay in your browser and are only sent to us when you tick it and book. We keep a separate record of your consent: who gave it, when, and the exact wording and its version.
4.2 If you prefer not to share, you can still book any class. For therapeutic and prenatal classes (Back Pain Relief, Prenatal Yoga, Yoga Therapy) you must confirm that you have checked with your doctor or midwife that the class is safe for you and that you take responsibility for not sharing. We record that confirmation with the booking (no health data), and your Instructor is told that you chose not to share.
4.3 Who can see it. Your answers are stored apart from your other booking details, with stricter access rules. Only:
- the Instructor you booked, for that class only, from the booking until 24 hours after the class ends;
- you; and
- a small number of authorised YogSpace staff, only where needed to handle a safety concern, a dispute or a legal claim.
Your health answers are never sent by email and are not shared with our video providers.
4.4 Instructors receive your health answers only to prepare and teach the class you booked, on our behalf and under our instructions. Our Instructor Agreement forbids them to copy, screenshot or export your answers or use them for anything else, requires them to delete any notes they made from them after the class, and requires them to tell us within 24 hours of any loss or leak.
4.5 Withdrawing consent. You can withdraw your consent at any time in your account settings ("Health information consent"), in one click, or by emailing us. We then delete the health answers for your upcoming classes straight away. Withdrawal does not affect what was done before it. Answers for classes that have already taken place are kept until the end of the retention period (section 7), only so that we can deal with a legal claim, and then deleted.
5. Who we share your data with
Your Instructor or your students. Instructors see their students' names, booking details and general intake answers, and health answers as described in section 4. Students see Instructors' public profiles. Many Instructors are self-employed yoga teachers based outside the UK and the EU, including in India.
Visitors to the Platform. Instructor profiles are public. If you leave a review, it is shown on the Instructor's public profile with your first name and the initial of your last name (for example "Sarah K.").
YogSpace staff. A small number of authorised staff can see account, booking and message data when they need it to give support, handle a dispute, a safety report or a legal claim, or pay Instructors. Health answers have stricter limits (section 4.3).
Service providers who process data for us, under contracts that require them to protect it:
| Provider | What they do |
|---|---|
| Supabase | Database (including intake and health answers), sign-in and file storage |
| Vercel | Website and app hosting |
| Stripe | Card payments, refunds and Instructor payouts |
| Wise | Instructor payouts |
| Daily and Zoom | Live video Sessions |
| Resend | Sending emails (never with health answers) |
| Sign in with Google, if you choose it |
Others, where the law requires or allows it, for example tax authorities, the police or a court, or professional advisers such as lawyers and accountants. If YogSpace is sold or merged, your data may transfer to the new owner, who must respect this policy.
6. Where your data is stored and international transfers
6.1 Hosting. Our database, including intake and health answers, is hosted by Supabase on Amazon Web Services in the eu-west region (Europe). Our website is served by Vercel, and some of our other providers (listed in section 5 and on our Data Processing page) process data in other countries, including the United States.
6.2 Instructors outside the UK and EU. When you book an Instructor in another country, for example India, your booking details and intake answers (including health answers, if you consented) are made available to them so they can teach you. India does not have a UK or EU adequacy decision. We protect these transfers with the European Commission's Standard Contractual Clauses (controller to processor) and the UK International Data Transfer Addendum, which every Instructor accepts as part of our Instructor Agreement, together with the access limits in section 4 (booked class only, until 24 hours after it).
6.3 Other transfers. When personal data leaves the UK or the European Economic Area for one of our providers, we rely on an adequacy decision, the UK-US data bridge where the provider is certified, or the same standard contractual clauses. You can ask us for a copy of the relevant safeguard.
7. How long we keep your data
| Data | How long | Why |
|---|---|---|
| Account and profile | While your account is open. When you delete your account we anonymise your profile straight away and delete the remaining archive of it after 30 days | To run your account |
| Health answers from the intake | 3 years after the class, then deleted automatically. Upcoming classes: deleted straight away if you withdraw consent or close your account. Classes that never took place: deleted 30 days after their date | 3 years is the time limit in England and Wales for most personal injury claims (Limitation Act 1980), so we keep the answers only as long as we may need them to establish or defend a claim about the class |
| Health consent records | While they cover any stored health answers, and 3 years after you withdraw consent | To prove that we had your consent |
| "Prefer not to share" confirmations | 3 years after the class | Legal claims about the class |
| General intake answers and Session records | 3 years after the Session | Disputes and legal claims |
| Messages | 3 years after the last message in the conversation | Safety reports and disputes |
| Payment, refund, Wallet and payout records | 6 years after the end of the financial year they relate to | Tax and accounting law |
| Instructor credentials and verification documents | While the Instructor teaches on YogSpace and 3 years afterwards | Safety and legal claims |
| Security logs and booking analytics | Up to 12 months | Security |
We may keep data longer if we need it to deal with an ongoing dispute, a legal claim or a request from an authority.
8. Your rights
You have the right to:
- access a copy of your personal data;
- correct data that is wrong or incomplete;
- delete your data, which you can do yourself by deleting your account in your settings;
- restrict how we use your data in some situations;
- object to how we use your data where we rely on legitimate interests;
- data portability: you can download your data, including your health answers and consent records, from your account settings;
- withdraw consent at any time, where we rely on it, including your health information consent in your account settings.
To use these rights, use the tools in your account settings or email support@yogspace.com with "Privacy" in the subject line. We will reply within one month. If a request is complex, or we receive many requests, we may need up to two more months; if so, we will tell you within the first month and explain why. We may need to confirm your identity first. Using your rights is free.
9. Automated decisions
We use automated checks to block messages that contain contact details or off-platform payment requests, to stop a therapeutic or prenatal booking when a safety question is answered "Yes" (including if you then switch to not sharing in the same booking), and to hide an Instructor from browse and search results for a time if their cancellation and reschedule rate over the last 90 days is too high (they stay bookable through their profile link and by their existing students). We do not use ranking algorithms or profiling to decide which Instructors you see: lists are ordered by simple criteria such as rating, or price if you sort by it. These checks do not have legal effects on you. If you think one got it wrong, contact us and a person will review it.
10. Security
We use encryption in transit, access rules at database level that limit each person to the data they need (tested automatically before every release), and providers with recognised security certifications. If a personal data breach puts your rights at risk, we will tell the Information Commissioner's Office within 72 hours of becoming aware of it and, where the risk is high, tell you without undue delay.
11. Children
YogSpace is only for adults aged 18 and over. We do not knowingly collect data about children. If you think a child has used YogSpace, please contact us and we will delete their data.
12. Complaints
If you are unhappy with how we have used your data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office, the UK data protection regulator: online at ico.org.uk/make-a-complaint, by phone on 0303 123 1113, or by post to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. If you live in the European Union, you can also complain to the data protection authority in your country.
13. Changes to this policy
We will update this policy when the way we use personal data changes. The date at the top shows when it last changed. We will tell you about important changes by email or in the Platform before they take effect.