This privacy notice explains how Health Coaching with Sophie collects, uses, stores and protects your personal information.
I am committed to respecting your privacy and handling your personal information securely and in accordance with applicable UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Contact details
Health Coaching with Sophie
Email: healthcoachingwithsophie@outlook.com
I am the data controller for the personal information I collect and use in providing my health coaching services. ICO Registration reference: ZC237742
What information I collect and why
I collect and use personal information that is relevant and necessary to provide and administer my health coaching services.
Personal information
This may include: Your name, Email address, telephone number, emergency contact details, information contained in communications between us, records of coaching sessions, discussions and agreed actions, payment and service history
I use this information to: Communicate with you, arrange and manage appointments, provide and administer health coaching, maintain appropriate client records, keep a record of coaching sessions and agreed actions, process and record payments, respond to questions or requests, deal with complaints or potential legal claims where necessary.
Health and wellbeing information
As part of the coaching service, I may collect information from your health questionnaire and coaching discussions, including but not limited to: Medical conditions and relevant health history, medication, weight, blood pressure, cholesterol, diet and nutrition, physical activity and exercise, smoking and alcohol use, sleep, stress and wellbeing, other lifestyle or health information that is relevant to your coaching.
Health information is special category data under UK data protection law and is therefore subject to additional protection. I only collect health and wellbeing information that is relevant and necessary for the coaching service.
Emergency contact information
If you provide an emergency contact, I will use their details only where reasonably necessary for an emergency or where there is a serious concern about your immediate safety.
Where necessary in an emergency, I may also provide relevant information to emergency services.
How I use your information and my lawful bases
I must have a lawful basis for processing personal information. I use different lawful bases depending on the purpose for which the information is being processed.
Providing and administering health coaching services
For information necessary to provide and administer the coaching service, I rely on:
Contract – where processing is necessary to provide the services you have requested or to take steps at your request before entering into a coaching agreement.
Legitimate interests – where processing is necessary for the effective administration and management of my coaching service, including communicating with potential and existing clients, arranging appointments, maintaining appropriate records and managing the business.
I will only rely on legitimate interests where the processing is necessary and proportionate and does not unfairly override your rights and interests.
Health information
Health information is special category data under UK data protection law. This means that, in addition to an Article 6 lawful basis, I must have an appropriate condition under Article 9 of the UK GDPR to process it.
For health information that I need to provide personalised health coaching, my Article 6 lawful basis is contract where the processing is necessary to provide the coaching service.
My Article 9 condition for processing this health information is explicit consent under Article 9(2)(a) UK GDPR.
I will only collect and use health and wellbeing information that is relevant and necessary for the coaching service.
Where I rely on your explicit consent to process health information, you have the right to withdraw that consent at any time.
However, because the processing of relevant health information is necessary for me to provide personalised health coaching, if you withdraw your explicit consent to the processing of the health information required for your coaching, I may no longer be able to continue providing the coaching service.
If you withdraw your consent, I will stop processing your health information on the basis of that consent as soon as reasonably practicable. This does not affect the lawfulness of processing carried out before your consent was withdrawn.
Withdrawal of consent does not necessarily mean that all information already held about you will be immediately deleted. I may need to retain certain information where this is necessary to comply with a legal obligation, establish or defend legal claims, or for another lawful purpose explained in this privacy notice.
Legal and regulatory requirements
I may process personal information where necessary to comply with a legal obligation. This may include information required for accounting, taxation, legal or regulatory purposes.
Complaints and legal claims
I may process relevant personal information where necessary to: Respond to questions or complaints, investigate and resolve complaints, maintain appropriate records, obtain professional or legal advice, establish, exercise or defend legal claims.
For this purpose, I rely primarily on legitimate interests where appropriate.
Where health information is involved in a legal claim, I will only process it where an appropriate legal basis and special category condition apply.
Where I obtain your information from
I normally collect personal information directly from you, including through:
Questionnaires, Emails and other communications, Coaching sessions, Information you provide during appointments, Information you provide for payment or booking purposes.
I will not routinely obtain information about you from third parties.
If you specifically ask me to contact or communicate with another healthcare professional, such as your GP, I may obtain or share relevant information for that purpose.
How I store and protect your information
Your client records are stored locally on a password-protected laptop.
Access to the laptop and electronic client records is restricted to me.
I also retain paper client notes. These are stored securely in locked storage when not in use.
I use appropriate technical and organisational measures to protect your information against unauthorised access, accidental loss, destruction or damage.
Microsoft Outlook is used for email communication and Microsoft Teams is used for coaching sessions. Teams sessions are not recorded and I do not use Teams recordings as part of your client record.
Payment information
Clients pay by bank transfer. I do not collect or store your bank card details as part of the coaching service. I may retain information necessary to record that a payment has been received and to maintain appropriate financial and service records.
Who I share your information with
I do not routinely sell, rent or otherwise provide your personal information to third parties for their own marketing purposes. Where necessary, I may share relevant personal information with the following categories of recipients:
Microsoft
Microsoft provides the email and video-conferencing services I use, including Outlook and Microsoft Teams. These services may process personal information on my behalf.
Emergency services
Where necessary in an emergency, I may share relevant information with emergency services, such as 999 services.
Your emergency contact
Where I consider this necessary in an emergency or because of a serious concern about your immediate safety, I may contact the emergency contact you have provided and share relevant information.
Healthcare professionals
I will only share information with your GP, another healthcare professional or other health service provider where you specifically ask me to do so, subject to any applicable legal requirements.
Professional advisers
Where necessary, I may share relevant information with professional advisers, such as solicitors or other legal advisers, for the purposes of obtaining advice or dealing with complaints or legal claims.
Insurers and insurance intermediaries
Where necessary in relation to an actual or potential insurance claim, I may share relevant information with my insurer, insurance broker or another relevant insurance intermediary.
Organisations I am legally required to share information with
I may disclose personal information where I am legally required to do so, for example where required by law, a court order or an appropriate regulatory authority.
Safeguarding
Where necessary to protect someone from serious harm or abuse, I may share relevant information with an appropriate safeguarding organisation or other relevant authority. I will only share information that is relevant and necessary for the particular purpose.
How long I keep your information
I retain client records, including relevant health information, coaching notes, communications and payment records, for 7 years after the end of the coaching relationship.
This retention period reflects my current insurance requirements and allows me to deal with potential complaints, legal claims and other liabilities that may arise during the relevant period.
Paper records are securely destroyed and electronic records are securely deleted at the end of the applicable retention period, unless there is a legitimate reason or legal requirement to retain them for longer. I periodically review the information I hold and will not retain information indefinitely.
Sharing information outside the UK
Some of the technology services I use may involve the processing of personal information outside the UK.
Microsoft's privacy statement describes Microsoft's international data-transfer safeguards, including Standard Contractual Clauses. Microsoft’s privacy statement states that Microsoft Corporation has certified its compliance with the UK Extension to the EU-U.S. Data Privacy Framework for personal data received from the United Kingdom in reliance on that framework.
Your data protection rights
Depending on the circumstances, you have rights under UK data protection law, including the right to:
Ask for access to the personal information I hold about you
Ask for inaccurate or incomplete information to be corrected
Ask for your information to be erased in certain circumstances
Ask for processing of your information to be restricted in certain circumstances
Object to certain processing
Ask for your information to be transferred to another organisation in certain circumstances
Withdraw consent where processing is based on consent
These rights are subject to certain legal conditions and exemptions.
If you want to exercise one of your rights, please contact me using the details above.
Confidentiality
I treat information you provide during coaching as confidential and will only use or disclose it for the purposes explained in this privacy notice or where there is another lawful basis for doing so.
There may be circumstances where information needs to be disclosed without your request or agreement, for example where this is required by law or where I reasonably consider it necessary to protect someone from serious harm.
Where information is shared, I will seek to ensure that only information that is relevant and necessary is disclosed.
Complaints
If you have a concern about how I have handled your personal information, please contact me first at:
healthcoachingwithsophie@outlook.com
I will consider your complaint and try to resolve the issue.
You also have the right to complain to the Information Commissioner's Office (ICO) if you are concerned about how your personal information has been handled.
The ICO can be contacted through its website at ico.org.uk and at
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
Changes to this privacy notice
I may update this privacy notice from time to time to reflect changes to my services, the information I collect, the technology I use or applicable data protection requirements. The latest version will be made available to clients.