top of page

Privacy Policy 

We are part of a group of companies owned by Tremorfa Group Limited (company number 06209568) whose registered office is at

St Mellons Hotel, The Terrace Suite, Castleton, Cardiff CF3 2XR.  

This privacy policy is issued on behalf of the Tremorfa Group so when we mention “Tremorfa”, “the club”, “we”, “us” or “our” in this privacy policy, we are referring to the relevant company in the Tremorfa Group responsible for processing your data.



Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We may collect, use, store and transfer different kinds of personal data about you which we have grouped together follows:

  •  Identity & contact data includes first name, last name, username or similar identifier, marital status, title, date of birth, gender, photograph, emergency contact details, address, email address and telephone numbers.

  • Payment data includes whether or not you are up to date with your payments.

  • Usage Data includes information about how often you attend the club, what services you book, whether you bring guests with you and images on CCTV.

  •  Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences.


We also collect Special Categories of Personal Data about you by collecting information about your health.  We may also collect details about your child so that we can keep records of their attendance, emergency contact details and health information.  We do not collect any other Special Categories of Personal Data, nor do we collect any information about criminal convictions and offences.

If you fail to provide personal data


Where we need to collect personal data by law, or under the terms of a contract we have with you and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you.  In this case, we may have to cancel our contract with you but we will notify you if this is the case at the time.



We use different methods to collect data from and about you including through:

Direct interactions.

 You may give us your Identity & Contact and Payment Data by subscribing to the mobile app, on your application form to become a member or by corresponding with us by post, phone, email or otherwise.   


Automated technologies or interactions.

As you interact with our mobile app and book any club session or swipe your card/mobile app to enter the club, we may automatically collect data


Information from third parties.

If your membership at the club is through your employer, then your employer may provide us with information about you.



We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

  • Where we need to perform the contract we are about to enter into or have entered into with you.

  • Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.

  • Where we need to comply with a legal or regulatory obligation.

Purposes for which we will use your personal data:  We have set out below a description of the ways we plan to use your personal data, and which of the legal bases we rely on to do so.  

 Identity & contact data

We keep this information in order to contact you in the event of issues arising at the club, to verify you as a member of the club, and to contact people on your behalf in the event of an emergency.  Our lawful basis for processing this information is to perform our contract with you and to protect our legitimate business interests. 


Payment data

 We keep this information in order to ensure that you are up to date with your payments.  Our lawful basis for processing this information is to perform our contract with you and to protect our legitimate business interests. 


Usage Data

 We keep usage information to keep a record of what services you use at the club, to manage bookings, what services are popular amongst members generally, how many guests you sign in, what services you have booked.  We also retain CCTV footage for the prevention and detection of crime and health and safety issues for our members, guest and staff.  Our lawful basis for processing this information is to perform our contract with you and to protect our legitimate business interests. 


Special Categories of Personal Data

We keep information about your health (and that of your child or children where appropriate) to ensure that we are aware of any health issues.  We will not share this information with any other party.  Our lawful basis for processing this information is to perform our contract with you and to protect our legitimate business interests.   As this is Special Category Data we also rely processing this to carry out our legitimate activities; to establish, exercise or defend legal claims and for the purposes of health & safety management.


Marketing / Third-party marketing 

We strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising.   We will only send you marketing material where you have confirmed you wish to receive the same on your application form or on the mobile app preferences.  We will get your express opt-in consent before we share your personal data with any company outside our group of companies for marketing purposes.


Opting out

You can ask us or third parties to stop sending you marketing messages at any time by updating your preferences on the mobile app or contacting by contacting us at   Where you opt out of receiving these marketing messages, this will not apply to personal data provided to us as a result of a service purchase, service experience or other transactions.


Change of purpose:

 We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contacting us using the details set out in Section 1 above.  

If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.   Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.



We may have to share your personal data with the parties set out below


Internal Third Parties

Other companies in the Tremorfa Group acting as joint controllers or processors and who are based in the United Kingdom and provide administration services and support and undertake leadership reporting.  


External Third Parties

  • ClubRight who collect information on our behalf via the mobile app. Users can choose to opt out and limit data provided when signing up to the app.


  • The Harlands Group who deal with financial transactions of all members for us. Harlands will take the Direct Debit of all members on the closest working day to the start of each month. All membership issues will need to contact Harlands should members wish to suspend or cancel their membership or amend their bank information.


Third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy notice.


We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.



We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know.  They will only process your personal data on our instructions and they are subject to a duty of confidentiality.




We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.


To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.


By law we have to keep basic information about our customers (including Contact, identity, payment data) for seven years after they cease being customers for tax and regulatory purposes.




Under certain circumstances, you have rights under data protection laws in relation to your personal data.  Please refer to Section 10 below for Your Legal Rights and to find out more about these rights to:

  • Request access to your personal data

  • Request correction of your personal data

  • Request erasure of your personal data

  • Object to processing of your personal data

  • Request restriction of processing your personal data

  • Request transfer of your personal data

  • Right to withdraw consent

If you wish to exercise any of the rights set out above, please contacting us on 

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.


We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights).  This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it.  We may also contact you to ask you for further information in relation to your request to speed up our response.


We try to respond to all legitimate requests within one month.  Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests.  In this case, we will notify you and keep you updated.



Our site use “cookies” to help you personalise your online experience. Cookies are uniquely assigned to you, and can only be read by a web server in the domain that issued the cookie to you.

You have the ability to accept or decline cookies. If you choose to decline cookies, you may not be able to fully experience the interactive features of The Panacea's  website 

Our site uses the following cookies

Cookie Name           Purpose                                                                                                 Duration      Type 

XSRF-TOKEN.       Used for security reasons.                                                                                                      Session.           Essential

hs.                               Used for security reasons.                                                                                                      Session.          Essential

sv.Session                  Used in connection with user login.                                                                                      2 years.           Essential

SSR-caching.           Used to indicate the system from which the site was rendered                                       1 minute          Essential

_wixCIDX                  Used for system monitoring/debugging                                                                              3 months         Essential

_wix_browser_sess   Used for system monitoring/debugging                                                                               Session            Essential

consent-policy         Used for cookie banner parameters                                                                                      12 months       Essential

smSession                 Used to identify logged in site members                                                                              Session            Essential

TS*                             Used for security and anti-fraud reasons                                                                             Session            Essential

bSession                   Used for system effectiveness measurement                                                                      30 minutes     Essential

fedops.logger.X       Used for stability/effectiveness measurement                                                                     12 months       Essential

wixLanguage            Used on multilingual websites to save user language preference                                      12 months       Functional

If you would like to access, correct, amend or delete your data please contact us at

We reserve the right to modify this privacy policy at any time, so please review it frequently. Changes and clarifications will take effect immediately upon their posting on the website. If we make material changes to this policy, we will notify you here that it has been updated, so that you are aware of what information we collect, how we use it, and under what circumstances, if any, we use and/or disclose it. 

bottom of page