Privacy Policy

1. Who I am and how to reach me

This website is run by Healthier Sapiens Ltd, a company registered in England and Wales under company number 15054823, with its registered office at 86-90 Paul Street, London, England, EC2A 4NE ("I", "me", "my").

I am the controller of the personal data described in this policy. That means I decide what is collected and what happens to it, and I am responsible for looking after it.

I am not required to appoint a Data Protection Officer, so any question about your data comes to me directly.

• Email: hello@healthiersapiens.com
• Post: Healthier Sapiens Ltd, 86-90 Paul Street, London, England, EC2A 4NE

This policy covers the website at www.healthiersapiens.com, the client portal at portal.healthiersapiens.com, and the coaching services provided through them. It does not cover other websites you might reach through links here.

2. The personal data I collect

Personal data means any information from which you can be identified. I group it as follows.

• Identity and contact data - your name, email address and telephone number.
• Application data - the answers you give on the application form: your goal, how long you have been working on it, whether you currently train, what you have already tried, what has got in the way, when you would like to start, which programme interests you, and anything else you choose to add in the free-text box.
• Portal account data - if we work together, the login I create for you: your name, email address, phone number if you give me one, and the password you set. I never see your password. It is stored scrambled in a way that cannot be reversed.
• Onboarding data - the detailed form you fill in once you have a portal login. It asks for your date of birth, height and weight, your goal, diagnosed medical conditions, any medications you take, family history of conditions such as diabetes or heart disease, allergies, how you sleep, how you move, and what you eat. Much of this is health information, covered in sections 5 and 6.
• Coaching data - if we work together, the information we exchange while coaching. This includes food, training, sleep, weight and measurements, how you are getting on, and anything you send me in messages or on calls. Your plan, your targets, my notes and any documents I prepare for you are held in the client portal. Some of this is health information, which is treated separately in section 5.
• Transaction data - records of payments you have made for coaching. I do not receive or store your card details; those are handled by Stripe and, for payment plans, GoCardless.
• Portal activity data - a record of significant actions in the portal, such as when you signed in, when your plan was shared with you, and when I changed something on your record. This is a security measure and is deleted automatically after 12 months.
• Technical data - the IP address your application was submitted from, which I keep as a security and anti-spam measure.
• Website usage data - anonymous statistics about how visitors use the site: pages viewed, how they arrived, rough country, browser and device type. This is described in section 12.

I do not knowingly collect data about children, and my services are for adults only.

The application form asks you not to include detailed medical information. That is deliberate. If health details are relevant, we cover them properly once we are working together, through the client portal and under the arrangements in sections 5 and 6.

3. How I collect it

• You give it to me - by filling in the application form, by filling in the onboarding form in the client portal, or by emailing me, messaging me or talking to me on a call.
• Automatically - anonymous usage statistics are collected as you browse the site, your IP address is recorded when you submit an application, and the portal logs sign-ins and changes as described in section 2.
• From third parties - if you book a call, my booking provider passes me the time you chose and the contact details you entered.

4. How I use it, and my lawful basis

Under UK data protection law I need a lawful basis for everything I do with your data. Here is each purpose and the basis I rely on.

What I do	Data used	Lawful basis
Read your application and decide whether I can help	Identity, contact, application	Consent, which you give by ticking the box on the form. You can withdraw it at any time.
Reply to you, and arrange and hold a call	Identity, contact, application	Consent, and where you go on to become a client, steps taken at your request before entering a contract.
Deliver coaching if we work together	Identity, contact, coaching, transaction	Performance of our contract.
Run your client portal and build your plan in it	Portal account, onboarding, coaching	Performance of our contract, and for the health information in it, your explicit consent. See section 6.
Keep your portal account secure	Portal activity	Legitimate interests - keeping the information I hold about you safe, and being able to spot anything suspicious.
Take payment and keep accounting records	Identity, contact, transaction	Performance of our contract, and legal obligation for tax and accounting records.
Keep the website working, secure and free of spam	Technical, usage	Legitimate interests - running a secure website and understanding whether it is useful.
Keep records in case of a complaint or claim	Identity, contact, coaching, transaction	Legitimate interests - being able to defend or resolve a claim, and legal obligation where a professional body or insurer requires records to be kept.

Marketing

I only send marketing emails to people who have asked to receive them. Applying for coaching does not sign you up to anything - if you apply and we do not work together, you will not be added to a list.

Where I do send them, I rely on your consent, given by opting in. Every message includes a one-click unsubscribe link, and you can also stop them at any time by emailing hello@healthiersapiens.com. Withdrawing consent for marketing does not affect anything else in this policy.

I never share your details so that another organisation can market to you.

If you don't provide the data

The application form needs your name, email and phone number. Without those I cannot reply to you, so I would not be able to consider your application.

5. Health information

Health data is what the law calls a "special category" of personal data, and it gets extra protection. Coaching you properly may involve it - what you eat, how you sleep, your weight, your energy, diagnosed conditions, medications, and sometimes blood test results you choose to share with me.

I only process health information where you have given me your explicit consent to do so. That consent is asked for at the end of the onboarding form in the client portal, separately from anything else, and you can withdraw it at any time. Section 6 explains exactly how that works.

Two things worth being clear about:

• I am a nutritional therapist and personal trainer, registered with the Association of Naturopathic Practitioners (ANP) and CIMSPA. I am not a doctor. I do not diagnose or treat medical conditions, and I work alongside your GP or consultant rather than instead of them.
• My professional bodies and my insurer require client records to be kept for a set period, which is why coaching records are held for seven years even after we stop working together.
• I ask you not to put detailed medical information into the website application form. If it is relevant, we handle it properly in the client portal once we are working together.

6. The client portal

If we work together, I give you a login to my client portal at portal.healthiersapiens.com. It replaces the documents and shared pages I used before. Your plan, your targets, your resources and any documents I prepare for you all live there.

How it starts

I create your account and email you a private link to the onboarding form. Nobody else can use that link. Once you have finished the form, your portal opens and you can set your password and sign in.

Your consent

The last step of the onboarding form asks you to tick two boxes. One is your explicit consent for me to hold and use your health information to build and adjust your plan. The other confirms you have read this policy.

The portal records the moment you tick them, so both of us have a record that you agreed. The legal basis for holding your health information is your explicit consent, under Article 9(2)(a) of the UK GDPR.

Withdrawing your consent

You can withdraw it at any time. Email me and say so. I will delete your health information and tell you when it is done. You do not have to give a reason.

Be aware of what follows. Without that information I cannot build or adjust a nutrition plan for you, so withdrawing consent normally means the coaching ends. Withdrawing does not undo anything done before you withdrew, and it does not remove the payment records I am required to keep by law.

Who can see it

I am the only person with an administrator account. Clients cannot see each other, and cannot reach anything outside their own pages. No other company has access to what is in the portal. It runs on my own hosting, and it is not connected to any other system.

How it is protected

The measures specific to the portal are listed in section 9.

Your meal plan

Not everybody gets one. Where I do build you a meal plan or a similar document, it is a file I prepare and link from your portal page. It contains the same kind of information as the rest of your plan and is treated the same way.

7. Who I share it with

I do not sell your personal data, and I never share it so that another organisation can market to you.

I do use software to run the business, and those providers process data on my behalf under contracts that require them to keep it secure and use it only on my instructions. They are:

• Hostinger - hosts this website, my email, and the client portal and its database. All of it sits on servers in the UK.
• Umami - website analytics. Cookieless and anonymised; see section 12. It does not run in the client portal.
• KIS CRM (built on GoHighLevel) - the booking system used to schedule calls.
• WhatsApp (Meta) - used for messaging between coaching calls, if you choose to use it.
• Zoom - used to hold coaching calls.
• Stripe and GoCardless - take payment. They receive your name, email and payment details directly; I never see your card number.

Nothing in the client portal is shared with any of them, other than Hostinger, who host it.

I may also disclose personal data if I am required to by law, by a court, or by a regulator.

8. Transfers outside the UK

Some of the providers above store or process data outside the UK, including in the United States. That applies in particular to GoHighLevel, Zoom, Stripe and Meta.

The client portal is not one of them. It and everything in it stay in the UK.

Where data does leave the UK, the transfer is covered by one of the safeguards UK law allows - either an adequacy decision by the UK government, or the UK International Data Transfer Agreement or Addendum to the EU standard contractual clauses, together with any additional measures needed.

If you would like details of the safeguards used by a particular provider, email me and I will tell you.

9. Security

The measures in place include:

• The website and the client portal are both served over HTTPS, so anything you type is encrypted in transit.
• Applications are stored outside the public area of the web server, so they cannot be reached from the internet.
• The portal application, including its database settings, also sits outside the public area of the server. Only a single entry file is reachable from the web.
• Your onboarding answers and my private notes are encrypted where they are stored. Somebody who got hold of the raw database file would not be able to read them.
• My administrator account is protected by two-factor authentication, so a password on its own is not enough to get in.
• Passwords are stored scrambled in a way that cannot be reversed. I never see yours.
• Sign-ins and changes to your record are logged.
• Access is limited to me. Accounts are protected by strong, unique passwords.
• Forms have anti-spam and rate-limiting measures to reduce abuse.

No system is perfectly secure, but if a breach happens that is likely to put your rights or freedoms at risk, I will tell you and the Information Commissioner's Office as the law requires.

10. How long I keep it

I keep personal data only as long as I need it for the purpose it was collected for.

What	How long
Applications where we don't go on to work together	12 months, then deleted
Client records, including coaching and health data	7 years after our last contact, in line with the requirements of my professional bodies and insurer
Client portal account and onboarding answers	The same 7 years, as part of your client record
Client portal activity log	12 months, then deleted automatically
Accounting and tax records	6 years after the end of the relevant tax year, as HMRC requires
Website analytics	Anonymous, and retained for 6 months by the analytics provider
Marketing consent records	For as long as you are subscribed, plus 2 years, so I can show consent was given

You can ask me to delete your data sooner - see section 11. If you withdraw your consent for health information, I delete that straight away rather than waiting out the periods above. The payment records stay, because I am not allowed to delete those.

11. Your legal rights

Under UK data protection law you have the right to:

• Get a copy of the personal data I hold about you.
• Have it corrected if it is wrong or incomplete.
• Have it deleted where there is no good reason for me to keep it.
• Object to my using it where I am relying on legitimate interests.
• Restrict what I do with it while a question about it is resolved.
• Receive it in a portable format, or have it sent to another provider, where the processing is based on consent or a contract and is carried out automatically.
• Withdraw consent at any time, where consent is the basis I am relying on. That does not affect anything done before you withdrew it, but it may mean I can no longer provide the service.

To exercise any of these, email hello@healthiersapiens.com.

There is no fee. I may ask you for information to confirm who you are, so that data is not given to the wrong person. I will respond within one month. If a request is unusually complex I may need longer, and I will tell you if so.

12. Cookies and analytics

This website does not use cookies for tracking, advertising or analytics. There is no cookie banner because there is nothing to consent to.

I use Umami, a privacy-focused analytics tool, to see how many people visit and which pages they read. It does not use cookies, does not follow you across other websites, and does not collect anything that identifies you. It records the page visited, the site you arrived from, and a rough country, browser and device type.

The client portal sets one cookie, and it exists only to keep you signed in and to protect the forms you submit. There is no tracking, no analytics and no advertising anywhere in the portal.

Some pages embed videos hosted on YouTube. Those videos do not load until you tap play. If you do play one, YouTube may set its own cookies and collect data under Google's privacy policy, which is outside my control.

13. Other websites

This site links to other websites, including my booking system and social media profiles. I am not responsible for their privacy practices, and I would encourage you to read their own policies.

14. Complaints

If you are unhappy with how I have handled your data, please tell me first at hello@healthiersapiens.com and I will try to put it right.

You also have the right to complain to the Information Commissioner's Office, the UK regulator for data protection:

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

I would be grateful for the chance to sort it out before you go to the ICO, but you are entitled to go to them directly.

15. Changes to this policy

If this policy changes, the new version will be posted here with an updated date at the top. Please keep me informed if your contact details change, so my records stay accurate.