How Lucy looks after your information.

Who is responsible

Lucy Poole, trading as Let Luce, Unit 49, Ketley Business Park, Telford TF1 5JD. Lucy decides what is collected and why. In law she is the “controller”.

Email let_luce@outlook.com, or message @_letluce on Instagram.

Elev8Depictions (Kort Bebbington, a sole trader) built and looks after the Let Luce website and coaching app. He handles your information only on Lucy’s instructions, under a written contract. In law he is the “processor”.

What Lucy collects, and why

• Website forms (contact, retreats, photography, online coaching application). Your name, email, phone if you add it, and what you write. The online application also asks your goal, experience, where you train and how many days a week. Lucy uses it to reply to you and to see whether online coaching suits you. The note box is free text: add health details only if you are happy for Lucy to read them. The online application is saved in the app’s database so Lucy can review it. If that database cannot be reached, the application is emailed to Lucy instead. The other forms are emailed to Lucy and not stored on the website.
• The retreat days email. If you ask for the exact retreat days, Lucy receives your name (if you give it) and email address as an email, and you get a confirmation email. The website does not keep a list. Lucy uses your address to send you the retreat days and retreat news. To stop, reply to any of those emails and tell her.
• Your coaching account in the app. Name, email, phone, goals, start date, the workouts set for you and what you log, check-in answers, weight and measurements, habits, messages with Lucy, notes Lucy writes about your coaching, nutrition notes, and the date you last opened the app. If you move or miss a workout you pick a reason (family, work, ill or other) and can add a short note. Lucy uses this to coach you and run your account.
• Phone alerts, if you switch them on. Your phone’s alert address, so the app can remind you. The alert text never contains health detail.
• Sign-in and security. A short sign-in code sent to your email, a record that you are signed in, and request logs (including your IP address) kept for a few days, so Lucy can keep the app safe and fix problems.
• Progress photos. The app does not collect photos at the moment. If that ever changes, this notice will change first.

Information about your health, fitness and body is called “special category” data. The law asks for extra care with it.

The legal reasons

• To coach you and run your account: a contract between you and Lucy (UK GDPR Article 6(1)(b)).
• For health and fitness information: your explicit consent (Article 9(2)(a)). The app asks you before you use it, and the website application asks you with a tick box.
• To answer enquiries and keep the app and website secure: Lucy’s legitimate interests (Article 6(1)(f)). These are running her business and keeping your information safe. You can object (see your rights below).
• To keep the minimal record described under “How long Lucy keeps it”: Lucy’s legitimate interests (Article 6(1)(f)) in being able to establish or defend a legal claim, with Article 9(2)(f) for any health detail in it.

Saying yes, and changing your mind

The first time you open the app after this notice, you see a step with an empty tick box: “I agree that Lucy can use my health and fitness information to coach me through this app, and keep it for up to 3 years after I leave unless I ask her to delete it.” You choose. Nothing is ticked for you.

To withdraw: in the app go to Me, then Privacy. You can still sign in. Nothing is deleted automatically. Alerts and coaching emails stop (a sign-in code still arrives if you ask for one). The app closes to you until you agree again. Lucy sees that you have withdrawn and will be in touch. She deletes your health details by hand, as set out under “How long Lucy keeps it” below. Withdrawing does not make earlier use unlawful.

If you do not agree, the app stays closed to you, and you can talk to Lucy about being coached without the app. Agreeing to the app’s use of your health information is not a condition of being coached by Lucy.

Who else handles it

Lucy does not sell your information. These companies help her run the website and app, and handle your information only for that:

• Cloudflare. Hosts the app and its database, in the Let Luce Cloudflare account, and runs a bot check (Turnstile) on the online coaching page.
• Resend. Sends the emails. It carries your sign-in codes and app invitations, the coaching emails Lucy sends you through the app, and the text of what you send in website forms (to Lucy’s inbox, and a confirmation back to you). Based in the US.
• Apple, Google and Mozilla push services. Deliver phone alerts through your browser’s own service, only if you switch alerts on. No health detail is in the text.
• Vercel. Hosts the public website at let-luce.uk, separately from the app. Website forms pass through a small Vercel function, on Elev8Depictions’ Vercel account, that emails Lucy and stores nothing. Your coaching records are not held on Vercel.

Two things Lucy does not run: booking a bootcamp happens on GymCatch, which has its own privacy notice, and messages on Instagram, Facebook or WhatsApp are handled by those companies.

Where it is stored

The app’s records are stored in the EU, in a database in the Let Luce Cloudflare account. The website is hosted separately, on Vercel. Cloudflare does not offer a UK-only option. Requests travel through Cloudflare’s worldwide network and the app code runs at a data centre close to you, so your information can pass through other countries on the way. Resend processes emails in the US.

Sending data outside the UK

The UK treats the EU as providing adequate protection, so keeping the database there needs no extra safeguard. Some of the companies above work from the US or run worldwide networks. This is the safeguard for each, as their own data processing terms state it:

• Cloudflare. Its data processing terms use the European Commission’s standard contractual clauses, with the ICO’s UK Addendum for UK data. It also states that it complies with the EU-US Data Privacy Framework.
• Resend. Its data processing terms use the standard contractual clauses with the UK Addendum for transfers from the UK. It also states that it complies with the EU-US Data Privacy Framework, including the UK Extension.
• Vercel. Its data processing terms use the standard contractual clauses and, for transfers from the UK, the UK transfer terms it calls the UK IDTA.
• Apple, Google and Mozilla push services, only if you switch alerts on. Run by those companies under their own terms and their own safeguards for sending data abroad. The alert text carries no health detail, and you can switch alerts off at any time.

To get a copy of the safeguards, ask Lucy (see “Your rights”).

How it is kept safe

• Encrypted when stored and when it travels.
• No password. You sign in with a code sent to your email. The app stores only a scrambled form of your sign-in, never the sign-in itself.
• Sign-in cookies cannot be read by scripts on the page, and only travel over secure connections. A client sign-in lasts 90 days on a device, Lucy’s lasts 14.
• Automated tests check that one client cannot see another client’s information.
• The reason you give for missing a workout, and the text of your messages, are never put in an email or phone alert.
• Backups are kept for a short time, then roll off.

Cookies and trackers on this website

This website has no analytics, no advertising trackers and no cookie banner. Fonts are served from the site itself. The site remembers a class you tapped for the length of your visit, in your browser, and forgets it when you close the tab.

Two things come from other companies, only when you reach them. The map on the home, contact, group and small-group pages loads from Google when you scroll to it, so Google receives your IP address. The online coaching page loads Cloudflare’s Turnstile bot check. Both companies may use cookies or similar technology under their own policies. The app uses sign-in cookies, which it needs to work.

How long Lucy keeps it

• Clients: 3 years after you stop training with Lucy, then deleted. You agree to this period in the app when you tick the box. If you withdraw consent or ask for deletion sooner, the next paragraph applies.
• Applications that do not go ahead: 12 months, then deleted.
• Enquiry emails in Lucy’s inbox: as long as needed to deal with them, then up to 12 months.
• Sign-in codes and old sign-ins: removed automatically.
• Backups: roll off within 30 days.

Lucy relies on your explicit consent for your health information (Article 9(2)(a)). When you withdraw that consent or ask for deletion, she deletes your health details, unless you tell her you plan to come back and want them kept. The one exception is a minimal record she needs to establish or defend a legal claim (Article 9(2)(f)). She keeps that record for up to 3 years after you leave, because 3 years is the normal time limit for a personal injury claim in England and Wales (Limitation Act 1980, section 11). The minimal record is: who was coached, when, which programme, and any injury or health issue you reported. Everything else follows the 3 years after you leave, or earlier deletion if you ask.

Children

Let Luce coaching is for adults. If you are under 18, please speak to Lucy first.

Your rights

You can ask Lucy to: show you what she holds, correct it, delete it, limit how she uses it, stop using it where she relies on legitimate interests, give you a copy you can move elsewhere, or take back your consent. Lucy can export and delete a client’s information from the app, so most requests are quick. She will answer within one month.

To ask, email let_luce@outlook.com or message her on Instagram. She may check it is really you first.

If something is wrong

Tell Lucy first, by email or Instagram. She will tell you she has your complaint within 30 days, and answer without undue delay.

If you are still not happy, you can complain to the Information Commissioner’s Office (ICO): ico.org.uk, 0303 123 1113.

If there is a breach of security that puts your information at risk, Lucy tells the ICO within 72 hours where the law asks her to, and tells you if the risk to you is high.

Changes

If this notice changes in a way that matters, the version date above changes and the app asks you again where it needs to.