1. Who We Are
[Your Name], trading as [Business Name], [Your Town], is the data controller for the personal data you share with us in the course of your coaching engagement.
Contact for data protection matters: [Your Email Address]
[Business Name] is [registered with the Information Commissioner's Office (ICO) under registration number ZXXXXXXXX / not required to register with the ICO as a sole trader processing data for personal use only].
2. What Data We Collect
In providing coaching services, we may collect and hold the following categories of personal data:
- Identity data: Full name, preferred name.
- Contact data: Email address, phone number, general location (town/city).
- Session notes: Notes taken by the Coach during or immediately after sessions, including goals, progress, key themes, and agreed actions.
- Personal disclosures: Information you choose to share about your personal circumstances, background, work situation, relationships, or aspirations in the context of the coaching work.
- Financial data: Records of invoices and payments (but not bank details, which are not retained).
3. Special Category Data
Coaching conversations may naturally touch on information that falls into special categories under UK GDPR — particularly health or mental health information. We only process such information where you have provided explicit consent and where it is directly relevant to the coaching work. You may withdraw this consent at any time (see Section 9).
We will never probe for, or record, medical diagnoses or clinical information beyond what you voluntarily share in the context of setting coaching goals or understanding your circumstances. If you share health-related information, it is held with the same strict confidentiality as all session content.
4. How We Use Your Data
We process your personal data for the following purposes and on the following legal bases:
- Delivering coaching services (Contract): Session notes, contact details, and goal tracking are necessary to perform our contract with you.
- Maintaining financial records (Legal obligation): Invoice and payment records are required by HMRC under tax law.
- Special category data (Explicit consent): Health or mental health disclosures are processed only with your explicit, informed consent.
- Supervision (Legitimate interest): The Coach engages in regular professional supervision. Session content discussed in supervision is fully anonymised — no identifying information is shared. The Coach's legitimate interest in professional development does not override your privacy rights because identifying information is not disclosed.
5. Confidentiality and Sharing
Your data is held in strict confidence. It is not shared with third parties except in the following limited circumstances:
- Legal obligation: Where required by law (e.g. court order, statutory duty to safeguard a child or vulnerable adult).
- Risk of harm: Where there is a serious and credible risk of harm to you or another person, limited disclosure to the appropriate authority may be necessary.
- Your consent: Any other sharing requires your explicit prior written consent.
No personal data is sold, rented, or shared for marketing purposes.
6. How We Store Your Data
Session notes and client records are stored as follows:
- Digital notes: [Encrypted device / Password-protected cloud service (e.g. Google Drive, OneDrive)]
- Paper notes (if any): Stored in a locked cabinet at [Your Town]
- Email correspondence: Held in a password-protected email account
We take reasonable technical and organisational measures to protect your data against unauthorised access, loss, or destruction.
7. Data Retention
We retain personal data for the following periods:
- Session notes and coaching records: 3 years from the date of the last coaching session, after which they are securely deleted or destroyed.
- Financial records (invoices): 6 years from the end of the relevant tax year, as required by HMRC.
- Contact details: Deleted within 12 months of the end of the coaching relationship unless you have agreed to remain on a mailing list.
Right to erasure — coaching caveat: If you exercise your right to erasure (see Section 9), we will delete identifying information from your records. We may, however, retain fully anonymised notes for the purposes of professional supervision and continuing professional development. These anonymised records cannot be linked back to you.
8. Transfers Outside the UK
Your data is held and processed within the United Kingdom. Where any software or cloud service used stores data outside the UK, we ensure that appropriate safeguards are in place (e.g. UK adequacy decisions or standard contractual clauses).
9. Your Rights
Under UK GDPR, you have the following rights regarding your personal data:
Right of access
You may request a copy of the personal data we hold about you (subject access request).
Right to rectification
You may ask us to correct inaccurate data or complete incomplete data.
Right to erasure
You may ask us to delete your personal data, subject to legal retention obligations.
Right to restrict processing
You may ask us to limit how we use your data while a dispute is resolved.
Right to data portability
Where processing is based on consent or contract, you may request data in a portable format.
Right to withdraw consent
Where processing is based on consent, you may withdraw it at any time without affecting prior processing.
To exercise any of these rights, please contact: [Your Email Address]. We will respond within one calendar month.
10. Complaints
If you are concerned about how we handle your personal data, please raise this with us in the first instance. If you remain dissatisfied, you have the right to complain to the Information Commissioner's Office (ICO):
- Website: ico.org.uk
- Telephone: 0303 123 1113
11. Changes to This Notice
We may update this Privacy Notice from time to time. The current version will always be available on request and will be provided at the start of any new coaching engagement. This notice was last reviewed on [Date].