Onboarding Privacy Notice
Test preview · privacy-test-v2-2026-10-27
Testing Notice
This is a fictional-data test of the onboarding privacy and consent process. Do not enter real health information. The production notice is not final; supplier, transfer, backup and legal-basis verification remain outstanding.
Who Is Responsible
Ben Stewart, trading as Ben Stewart Coaching, Felixstowe, Suffolk, UK, is the controller. Contact hello@benstewartcoaching.co.uk. This onboarding is for adults aged 18 or over.
Information And Purpose
The service collects your name, date of birth for adult eligibility and age-appropriate coaching, invited email, agreement evidence, emergency contact name/number, PAR-Q and lifestyle answers, and relevant coach review notes. Health details help Ben assess appropriate coaching and plan and review it safely. Technical and verification metadata help protect the service. Provide relevant details only.
Lawful Grounds
The approved proposed approach is contract/pre-contract necessity (Article 6(1)(b)) for essential coaching information, with separate explicit consent (Article 9(2)(a)) for necessary health information. Proportionate security and necessary contractual evidence use legitimate interests (Article 6(1)(f)). Health evidence for legal claims additionally requires Article 9(2)(f) necessity. Purpose-specific assessments remain a launch requirement.
Your Choice And Withdrawal
You can contact Ben before providing health information to discuss what is needed and whether another arrangement is suitable. Ben may need to pause, adapt or decline coaching if safety cannot be assessed. Withdraw health consent at any time by emailing hello@benstewartcoaching.co.uk. Uses depending on consent must stop; lawful uses before withdrawal remain valid. Ben will explain any specifically justified retention on another lawful ground. Agreement acceptance and marketing permission are separate.
Recipients And International Processing
Cloudflare hosts the service and encrypted records. Brevo sends confirmations and access codes, without submitted health answers. ImprovMX/Gmail process business emails. Relevant advisers, insurers, emergency responders or authorities may receive information only where necessary and lawful. GitHub stores code, not client answers or keys. Suppliers can process outside the UK; applicable agreements and transfer safeguards still need verification before launch. Do not email detailed health records.
Retention
For adults who start coaching, necessary records are retained during coaching and six years after coaching ends, reviewed annually with unnecessary details removed sooner. If coaching never starts, records are deleted 90 days after a decision not to proceed unless specific evidence requires a justified hold. Document access normally expires in seven days; this is different from record retention. Application audit events are cleared after 90 days. Provider logs, email history and backup schedules remain to be confirmed.
Security And Your Documents
The service uses HTTPS, encrypted stored submissions and a coach dashboard protected by MFA. Client PDFs require a separate email code and an expiring session. A link alone cannot download them. Keep your mailbox/device and downloaded copies secure.
Rights And Complaints
Contact Ben to request access, correction, erasure, restriction or transfer where applicable, to object to legitimate-interests processing, or to withdraw consent. Rights have exceptions and proportionate identity verification may be needed. You can complain to the ICO at https://ico.org.uk/make-a-complaint/. Ben reviews suitability personally; forms do not automatically approve exercise.
Emergency Contacts
Please tell your emergency contact you have nominated them and share this notice. Their details come from you and are used for safety arrangements under legitimate interests; a genuine emergency may justify a different basis. Direct transparency obligations still require a prelaunch process.
Contact Ben