1. Who I am
I am Annette Thom, trading as Imagine Flourishing, a sole-practitioner wellbeing and life coach based in England, UK.
For the purposes of UK data-protection legislation, I am the data controller responsible for the personal information I collect and use in connection with my coaching services.
This Privacy Policy explains how I collect, use, store and protect your personal information.

2. What information I collect
I may collect and process the following information:
• Client names and contact details
• Information provided when you make an enquiry or arrange a coaching session.
• Appointment and booking information.
• Information you voluntarily share during coaching sessions.
• Session notes and coaching records
• Payment and invoicing information
• Personal information shared during sessions
• Correspondence between you and me.
• Calendar bookings and scheduling data
• Information provided through my website, including information submitted through contact forms.
• Technical information such as IP address and browser information where this is collected through my website.
I will aim to collect only information that is reasonably necessary for providing and managing my services.

3. Why I use your information
I may use your personal information to:
• Respond to your enquiries.
• Arrange and manage coaching sessions.
• Provide coaching services.
• Communicate with you about appointments.
• Maintain appropriate client and business records.
• Process payments and issue invoices or receipts.
• Manage my business and professional relationships.
• Meet legal, accounting, insurance and regulatory obligations.
• Maintain the security of my systems and services.
• Deal with complaints or disputes.
• Protect my legal rights where necessary.

4. Information you share during coaching
Coaching conversations can sometimes involve personal or sensitive matters.
In the UK, data protection law has a special category for the following types of data: racial or ethnic origin, political opinions, religious or philosophical beliefs; trade union membership, genetic data, biometric data (where used for identification purposes),m data concerning health, data concerning a person’s sex life, and data concerning a person’s sexual orientation. So it is quite possible that sharing of special category data will be necessary to provide the coaching service. Therefore I have included the consent to process special category data in the coaching agreement (contract).

5. Confidentiality
I understand that coaching conversations may be highly personal. I will treat information you provide during coaching as confidential and will not normally disclose the contents of our sessions to other people without your permission.
There are, however, circumstances where confidentiality may be limited. These may include situations where:
• I am required to disclose information by law.
• Disclosure is necessary to comply with a legal or regulatory obligation.
• Disclosure is necessary to protect someone from serious and imminent harm.
• Disclosure is otherwise permitted or required by law.
• You have given permission for the information to be disclosed.
These limitations will also be explained in my coaching agreement.

6. Who I may share your information with
I do not sell your personal information.
Limited personal information may be shared with service providers who help me operate my business, such as:
• Website and hosting providers.
• Accounting software and payment providers.
• IT and technical-support providers.
• Accountants, insurers or professional advisers.
Personal information may be shared with legal or regulatory authorities where I am legally required or permitted to disclose information.
I will take reasonable steps to ensure that third-party providers process personal information appropriately and securely.
I may discuss coaching sessions in my own supervision sessions however this discussion would be anonymised. Your personal identifiable information would not be shared.
If I died my executor would have access to business information such as my accounting information and a client list.
I use Proton for video meetings, emails and cloud storage. Proton uses end to end encryption, so that not even Proton can access it. Client notes are in a proton cloud vault and backed up on an encrypted external drive which are both only ever accessible by me.

7. International transfers
Some of the technology and service providers I use may store or process information outside the UK. Where personal information is transferred internationally, I will take appropriate steps to ensure that the transfer complies with applicable UK data-protection requirements.

8. How I keep your information secure
I take reasonable measures to protect your personal information from unauthorised access, accidental loss, destruction, misuse, unauthorised disclosure or alteration. These measures may include appropriate passwords, device security, secure encrypted storage, and access controls.
However, no electronic system or method of transmitting information over the internet can be guaranteed to be completely secure.
I use Proton email, video meetings, and cloud storage. Clients notes are on Proton cloud storage and backed up on an encrypted external drive.

9. How long I keep your information
I will retain your personal information only for as long as reasonably necessary for the purposes for which it was collected and to comply with legal, accounting, insurance or other professional requirements.
When information is no longer required, I securely delete it or anonymise it where appropriate.
My insurer requires client records to be retained for five years after your last session. HMRC requires business records to be retained for at least 5 years after the 31 January Self Assessment deadline for each tax year.
My client notes will be deleted or destroyed by my executor when I die.

10. Your rights
Under UK data-protection law, your rights include:
• The right to request access to the personal information I hold about you.
• The right to request correction of inaccurate information.
• The right to request deletion of information in certain circumstances.
• The right to request restriction of processing in certain circumstances.
• The right to object to certain processing.
• The right to data portability in certain circumstances.
• The right to withdraw consent where processing is based on consent.
These rights are subject to certain legal exceptions and conditions.
If you would like to exercise any of your rights, please contact me using the details below.

11. Lawful bases for using your information
Under UK data-protection law, I will only process your personal information where I have a lawful basis to do so.
Depending on the circumstances, this may include:
• Contract: where processing is necessary to provide the coaching services you have requested.
• Legitimate interests: where processing is necessary for the reasonable operation and administration of my coaching business and does not unfairly override your rights.
• Legal obligation: where I need to process information to comply with a legal requirement.

12. Cookies and my website
My website uses cookies or similar technologies. Some cookies are necessary for the website to operate.
I will provide appropriate information about cookies used on my website.

13. Marketing
I will only send you marketing communications where I have a lawful basis to do so.
You can ask me to stop receiving marketing communications at any time by contacting me or using an unsubscribe facility where one is provided.

14. Children’s information
My life-coaching services are for adults aged 18 and over. I do not knowingly collect children’s personal information through my website or services.

15. Changes to this Privacy Policy
I may update this Privacy Policy from time to time to reflect changes to my services, technology or applicable data-protection requirements.
The latest version will be published on my website and will include the date on which it was last updated.

16. Contact details
If you have any questions about this Privacy Policy or how I process your personal information, please contact me:
Name: Annette Thom
Business name: Trading as Imagine Flourishing
Email: flourishing101@proton.me
Telephone: 07500 651709

17. Making a complaint
If you have concerns about how I have handled your personal information, I would encourage you to contact me first so that I can try to resolve the matter.
You also have the right to complain to the UK’s data-protection regulator, the Information Commissioner’s Office (ICO).
https://ico.org.uk/make-a-complaint/
0303 123 1113

 

This Privacy Policy complements my Coaching Agreement.

Effective date: 19/8/26
Last updated: 19/8/26