Privacy Policy for Out of Sync Coaching
Effective Date:
This Privacy Policy explains how Out of Sync Coaching collects, uses, stores, and protects the personal data of individuals who engage with our ADHD coaching, health and wellbeing coaching, pain management, and sensory needs practitioner services, particularly for children and young people aged 7- 25. We are committed to protecting your privacy and handling your personal data responsibly and in compliance with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018.
1. Who We Are (Data Controller)
Rose Hyndman/ Out of Sync Coaching
Based in Gloucestershire, UK
outofsynccoaching@gmail.com
07785622198
We are the Data Controller for the personal data we process. This means we determine the purposes and means of processing your personal data.
2. What Personal Data We Collect
We may collect and process the following categories of personal data:
A. Identity & Contact Data:
- Full name (child and parent/guardian)
- Date of birth (child)
- Age (child)
- Gender (optional)
- Address
- Email address
- Phone number
B. Sensitive (Special Category) Data:
- Health Information: Details about diagnosed conditions (e.g., ADHD, Fibromyalgia, chronic pain), sensory processing challenges, medication, relevant medical history, allergies, and general health status.
- Mental Health Information: Information relating to emotional wellbeing, anxieties, or specific mental health needs relevant to the coaching.
C. Session & Progress Data:
- Coaching session notes and summaries
- Goals set and progress tracking
- Observations during sessions
- Homework/activity records
- Feedback provided
D. Communication Data:
- Records of emails, phone calls, and other communications between you/your child and us.
E. Financial & Transaction Data:
- Payment details (e.g., bank transfer records, but we do not store full credit/debit card details if using a payment processor).
- Records of services purchased and payments made.
F. Technical Data (for online services/website):
- IP address, browser type, operating system (collected via website analytics or video conferencing platforms).
- Information collected via cookies (see Section 11).
3. How We Collect Your Data
We collect personal data primarily through:
- Direct Interactions: When you fill out our contact form, enquiry forms, consent forms, client intake forms, during initial consultations, and throughout coaching sessions.
- Communications: When you contact us via email, phone, or messaging.
- Third Parties (with explicit consent): From medical professionals, schools, or other therapists, if you explicitly provide consent for us to obtain or share information for your child's benefit (e.g., to understand a diagnosis).
4. Why We Collect Your Data and Our Lawful Basis for Processing
We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:
A. For General Personal Data (Identity, Contact, Communication, Financial, Technical Data):
- Performance of a Contract: To provide the coaching and practitioner services you have purchased, manage your booking, and process payments.
- Legitimate Interests: To operate and manage our business effectively, respond to enquiries, maintain records, manage our accounts, and improve our services.
- Legal Obligation: To comply with legal or regulatory obligations (e.g., tax, accounting, safeguarding duties).
B. For Sensitive (Special Category) Personal Data (Health, Mental Health, Session & Progress Data):
Processing this type of data requires additional legal grounds under GDPR. We rely on the following:
- Explicit Consent: We will obtain your explicit written consent (via our Parental Consent Form for minors) to process health and other sensitive information necessary for providing our specific coaching services. You have the right to withdraw this consent at any time, though this may affect our ability to provide services.
- Substantial Public Interest (Safeguarding): In circumstances where we have a safeguarding concern or believe there is a risk of harm to a child or others, we may process and share sensitive data where it is necessary for reasons of substantial public interest, in line with our legal and professional obligations and our Safeguarding Policy.
- Legal Claims: To establish, exercise, or defend legal claims.
5. How We Use Your Data
We use your personal data for the following purposes:
- To deliver our coaching and practitioner services effectively.
- To assess your child's needs and tailor our approach.
- To manage our client relationships, including communicating with parents/guardians.
- To process payments and manage accounts.
- To comply with our legal and professional obligations (e.g., safeguarding, record-keeping).
- To improve our services and internal operations.
- To respond to your enquiries and provide customer support.
6. How We Store and Protect Your Data
We are committed to ensuring the security of your personal data. We implement appropriate technical and organisational measures to protect your data from unauthorised access, alteration, disclosure, or destruction. These measures include:
- Data Encryption: Use of encrypted communication channels (e.g., secure video platforms) where possible.
- Password Protection: Strong, unique passwords for all systems and devices.
- Secure Storage: Digital files are stored on secure, encrypted cloud servers or password-protected devices. Paper records (if any) are stored in locked cabinets.
- Access Control: Access to personal data is restricted to Rose Hyndman only, who has a need to know.
- Regular Software Updates: Keeping all software and systems up-to-date to protect against vulnerabilities.
7. Who We Share Your Data With
We do not sell your personal data to third parties. We may share your data with:
- Payment Processors: To process payments securely (e.g., Stripe, PayPal – they will have their own privacy policies).
- Online Service Providers: For video conferencing (e.g., Zoom), scheduling (e.g., Calendly), or client management software. These providers are typically GDPR compliant.
- Professional Supervisors: Anonymised case details may be discussed for professional supervision purposes, ensuring your child's identity is protected.
- Legal and Regulatory Authorities: If legally required, or in cases of safeguarding concerns, we will share relevant information with local authority Children's Social Care, the Police, or other relevant bodies, in accordance with our Safeguarding Policy.
- Other Professionals (with consent): With your explicit written consent, we may share relevant information with your child's GP, other therapists, or educational professionals to ensure a holistic and coordinated approach to support.
8. How Long We Keep Your Data
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including for satisfying any legal, accounting, or reporting requirements.
- Client Coaching Records (including sensitive data): Typically retained for 7 years after the last contact, in line with professional indemnity insurance requirements and safeguarding best practices.
- Financial Records: Retained for 6 years plus the current financial year for tax purposes.
- Enquiry Data: Retained for 6 months if no client relationship is established, unless consent is given for longer retention.
After the retention period, your data will be securely deleted or anonymised.
9. Your Data Protection Rights
Under GDPR, you have the following rights regarding your personal data:
- Right to Be Informed: To know how your data is being used.
- Right of Access: To request a copy of the personal data we hold about you.
- Right to Rectification: To request correction of inaccurate or incomplete data.
- Right to Erasure (Right to Be Forgotten): To request deletion of your data in certain circumstances.
- Right to Restrict Processing: To request limits on how we use your data in certain situations.
- Right to Data Portability: To request your data be transferred to another organisation.
- Right to Object: To object to certain types of processing (e.g., direct marketing).
- Rights in relation to automated decision-making and profiling: We do not use automated decision-making or profiling.
To exercise any of these rights, please contact us using the details in Section 13. We may require proof of identity to process your request.
10. Children's Privacy
We are committed to protecting the privacy of children.
- We require explicit parental/guardian consent for all data processing related to children under 18, as outlined in our Parental Consent Form.
- We will only collect information from children that is relevant and necessary for providing our services.
- We will explain privacy in age-appropriate ways to children where possible.
11. Cookies
Our website may use cookies to improve your Browse experience. For detailed information on how we use cookies, please refer to our separate Cookie Policy.
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. Any changes will be posted on our website, and where appropriate, notified to you directly. We encourage you to review this policy periodically.
13. How to Complain
If you have any concerns about our use of your personal data, you can make a complaint to us directly using the contact details below. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection issues.
14. Contact Us
If you have any questions about this Privacy Policy or our data protection practices, please contact us at:
outofsynccoaching@gmail.com
07785622198
