Your privacy matters.

1. Who is responsible?

Leanne Holt, operating Leanne Holt Coaching and HELD in Warrington, United Kingdom, is responsible for the personal information handled through these services (the data controller).

This policy covers leanneholtcoaching.com, its member portal and /learn area, the HELD web app, the free introduction and HELD: The Method workspaces. It also covers those services when accessed through an associated mobile app. It does not mean every feature or payment option is available on every platform.

For privacy questions, to exercise your rights or to request our postal contact details, email leanneholtcoaching@gmail.com.

2. Information we collect

Information depends on what you choose to use. You do not have to complete every optional field.

• Account and membership details: name, email address, sign-in/session information, membership or programme entitlement, subscription status, relevant payment references and communication preferences.
• Forms and bookings: contact details, enquiries, event or retreat interests, referral names, booking information and messages you submit.
• Optional wellbeing records: mood, emotions, energy, sleep, body sensations, symptoms, medication notes, menstrual cycle or bleeding information, pregnancy or postpartum context, menopause or other life-stage information, and reflections about your experiences. These entries may contain sensitive health information.
• Learning and creative work: saved journals, answers, Method reflections, reading progress, selected focuses, practice preferences, favourites, boards, photos, text and creations you choose to save.
• Community contributions: messages, questions, testimonials and the display information you choose to submit to shared spaces.
• Technical information: information needed to deliver and protect the service, which may include IP address, browser/device information, request times, error information, security logs and essential session identifiers. Hosting providers may process this information even where HELD does not keep it as a member profile field.
• Service activity: saved content visits or progress, toolkit opens/downloads and associated sign-up activity where a feature records them.

We receive information directly from you and, where you use them, from sign-in, payment and booking providers to verify identity, purchases or access. We do not need your full payment-card details in the HELD member database.

3. Why we use information

• To create and manage your account, confirm access and provide the services you request.
• To save and reopen your work, show your history and prepare the reports you choose to generate.
• To organise your selected learning, preferences and optional practice suggestions.
• To manage bookings, respond to enquiries, provide support and handle payment or account issues.
• To deliver essential service messages and optional updates or affirmations in line with your preferences.
• To moderate shared spaces, protect accounts, troubleshoot problems and meet applicable legal obligations.

Patterns and summaries reflect the information recorded, not a clinical assessment. Missing days can affect the picture. HELD does not diagnose conditions or make automated decisions with legal or similarly significant effects about your employment, healthcare or eligibility for treatment.

The current guided support features use prepared educational guidance. Private journal history is not automatically sent to a generative AI coaching provider. If a future feature involves additional processing, its privacy information and relevant choices must be provided before use.

Partnership enquiries

If you enquire about workplace, practitioner or community partnerships, we store your name, email, organisation, enquiry type, potential group size and message to respond and manage that discussion. Please do not submit employee or client health information. Enquiring does not subscribe you to marketing. You may contact us to request deletion, subject to any necessary legal retention.

4. Our lawful bases

Under UK data-protection law, we use contract where necessary to provide requested accounts, memberships and services; legitimate interests for proportionate security, support, administration and service reliability; legal obligation for required financial and legal records; and consent for optional communications and optional processing that depends on permission. Our legitimate interests are operating a safe, reliable service and responding to people who contact us. You can object to processing based on legitimate interests.

Health-related information requires an additional legal condition. For optional health and wellbeing tracking, the relevant condition is explicit consent under Article 9(2)(a), alongside the applicable Article 6 basis. Health details are not required to read general educational content. Consent to sensitive processing must be specific and separate from simply reading this policy or accepting general terms.

You can withdraw consent by contacting us. Withdrawal does not undo earlier lawful processing, but may mean an optional feature can no longer use or retain the relevant information. This policy does not itself give consent on your behalf.

5. Who can receive information?

Access is limited to what is needed to operate and support the service. Leanne and authorised service providers may process information for those purposes. Private does not mean end-to-end encrypted or invisible to all service administration.

• Hosting and storage: the website/app is hosted through OpenAI Sites infrastructure using Cloudflare services for application delivery and database storage.
• Sign-in: OpenAI/ChatGPT sign-in may provide verified identity information if you choose that sign-in route. HELD also uses its own member sessions.
• Payments: Stripe processes existing online payments and subscription management. If you purchase an Apple subscription once available, Apple will process that purchase under its own terms and privacy policy. HELD may receive purchase or entitlement information; it does not receive your Apple payment-card details.
• Email: Resend is used for supported membership sign-in emails. Email delivery services process recipient details and the message being delivered; private journal history is not included in routine sign-in emails.
• Bookings and external services: linked booking services such as Acuity/Squarespace Scheduling, Spotify, WhatsApp, social networks and other linked sites handle information under their own policies when used.
• Legal and professional recipients: information may be disclosed where necessary for legal duties, lawful requests, protection of rights or professional advice, with access limited to the relevant purpose.

We do not sell your private wellbeing records or use them for advertising audiences. We do not give employers, workplace sponsors or other members automatic access to personal check-ins or journals. An employee access grant is separate from the person's wellbeing history.

Providers processing data on our behalf are expected to act under applicable data-protection terms, use suitable safeguards and limit use to the relevant service. Independent services, including payment platforms and external links, may act as controllers for their own activities. Their policies include OpenAI, Cloudflare, Stripe, Resend and Apple.

6. Community and sharing your records

Content submitted to a community space is intended for that space's audience, not your private journal. Other participants may copy what they see. Please avoid sharing sensitive details about yourself or other people in community posts. Testimonials are reviewed before publication through the website's testimonial process.

In My Patterns & Records, eligible members can select dates and record categories, review a report and download PDF or CSV copies. Nothing is sent automatically to a GP, therapist, coach, trusted family member or workplace wellbeing professional.

Once you send a report yourself, the recipient handles their copy under their own responsibilities. Downloaded files and exported images remain on the device or service where you save them. Deleting an account does not delete copies you or recipients have already downloaded.

7. Cookies, device storage and links

Essential cookies keep you signed in, protect sessions and remember necessary access state. Some interface choices, introduction preferences or device-side work may use browser storage. Blocking or clearing these can sign you out or remove device-only information; it does not necessarily delete records stored in your member account.

The current HELD features do not use a dedicated advertising-tracking integration. Optional non-essential tracking must not be introduced without the applicable information and consent choices. Infrastructure providers and external services may use their own technologies under their policies.

Choosing a photo allows the browser/app to process the selected file for your creation; saving the creation uploads the saved image content to your account. This does not grant access to your entire photo library. Linked media or messaging services may receive technical information when opened or loaded.

8. Storage, security and international processing

Information is transmitted over HTTPS and access to private features is controlled through sessions and entitlements. We use reasonable organisational and technical measures and limit access according to service needs. No online service can guarantee complete security. Protect your device, email and sign-in links, particularly on shared devices.

Service providers may process data outside the UK, including in the United States and other locations where they operate. The service is not represented as UK-only storage. Where a restricted transfer requires safeguards, applicable arrangements should include an adequacy decision or appropriate contractual safeguards, such as the UK International Data Transfer Agreement or UK Addendum, as relevant. Contact us for details of the arrangements applicable to your information.

9. How long information is kept

Saved member history is intended to remain available over time. Cancelling a subscription does not automatically erase your account or records. We keep account and saved content while needed to provide the ongoing service, honour your choices and handle reasonable support, security or legal needs. We review retention when an account is closed or deletion is requested.

Financial, tax, dispute or legal records may need to be retained after other account information is deleted, for the period required by the applicable obligation or claim. Access tokens and security records have separate expiry or operational retention needs. Backup copies, where present in provider systems, may remain until the relevant backup lifecycle ends and are not intended for routine use.

There is no promise that every copy is erased instantly or that every record has a single fixed retention period. You can ask about the criteria and retention applying to your records.

10. Your privacy choices and rights

Subject to applicable conditions and exemptions, you can ask for access to your information, correction, erasure, restriction, portability and objection to relevant processing. You can withdraw consent where processing depends on it, without affecting earlier lawful processing.

You can skip optional tracking, avoid sensitive entries, choose what to post publicly, select export contents and change available communication preferences. Use unsubscribe instructions in optional emails, or contact us to stop them. Essential account or payment messages may still be needed to provide the service.

We may need proportionate identity verification before releasing, changing or deleting records. We normally respond to rights requests within one month; if a lawful extension or exception applies, we will explain it.

11. Request account or record deletion

Email leanneholtcoaching@gmail.com with the subject “HELD account or data deletion”. State the email linked to your account and whether you want the whole account or particular records deleted. Please do not include sensitive journal content in the initial request.

We will verify the request and explain any information that must be retained and why. Some areas also have their own delete controls. Deleting the app from your phone does not delete server-side account information. An account deletion request does not itself cancel a subscription held with Apple or Stripe: manage that subscription through the relevant provider to stop future charges.

To withdraw consent for optional health processing, use the same contact route and tell us which processing you want stopped. You do not need to explain your personal reasons.

12. Younger users

HELD is not designed for children under 13. Teen wellbeing content does not make every feature suitable for every age. Younger users should avoid posting sensitive information in shared spaces and seek support from a trusted adult where appropriate. If you believe a child has provided information without an appropriate basis, contact us so we can investigate and take suitable action.

13. Questions, complaints and updates

Please contact Leanne first if something is unclear or you have concerns. You can also complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint, or to your local data-protection authority where applicable.

We may update this policy when the service or relevant practices change. The date at the top identifies the current notice. Material changes affecting your choices should be brought to your attention through an appropriate service message; fresh consent will be sought where required.