Privacy Policy

Last Updated 25th November 2025

1. Who We Are

We are Wellbeing First Limited, a company registered in England and Wales (Company No. 16126873).
Registered office: 2 Vache Mews, Vache Lane, Chalfont St Giles, Buckinghamshire, HP8 4UT, United Kingdom.
ICO Data Protection Registration Number: ZB855120.

For the purposes of UK data protection law, Wellbeing First Limited is the ‘data controller’ of your personal information.

You can contact us at:
contact@wellbeingfirst.co.uk

2. About This Policy

This Privacy Policy explains how we collect, use, store, and protect your personal information when you:

• visit our website
• purchase a subscription
• use our health and wellbeing services
• access courses, resources, journals, trackers, posters, or other content
• communicate with health and wellbeing coaches through our support portal

By using our services, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use our services.

We may update this Privacy Policy from time to time. When we do:

• we will post the updated version on our website, and
• where changes are significant, we will take reasonable steps to bring them to your attention (for example by email or on your account dashboard).

The latest version will always apply.

3. The Information We Collect

We collect the following categories of information:

A. Personal Identification and Contact Data

• Name
• Email address
• Postal address
• Telephone number
• Account login details (e.g. username, password – stored securely)

B. Subscription and Payment Data

• Billing details
• Payment transactions
• Subscription history (e.g. plan, billing periods, renewals, cancellations)

Note: Payments are processed securely via third-party payment providers. We do not store your full card details.

C. Health and Wellbeing Information (Special Category Data)

Only when you choose to provide it, including:

• journals and personal reflections
• tracker data (mood, habits, lifestyle, sleep, activity data, etc.)
• information shared with our health and wellbeing coaches
• optional assessments or questionnaires
• goals, progress notes, or plans

D. Technical and Usage Data

• IP address
• Device and browser information
• Pages visited and actions taken
• Access times and session information
• Cookie preferences and consent records

E. Communications

• Emails or messages sent to us
• Coach support portal chat messages
• Any feedback you provide (e.g. forms, surveys etc.)

F. Staff and Supplier Data

(Where applicable for employees or contractors.)

• Contact details
• Contract and payment information
• Relevant HR or supplier records

4. How We Collect Your Information

We collect information in the following ways:

• When you register for an account
• When you purchase a subscription
• When you complete journals, trackers or other forms
• When you download content or use the tools on the platform
• When you use coaching support services
• When you contact us (e.g. via the support portal, email or enquiry forms)
• Through cookies and similar technologies on our website
• From publicly available sources, where relevant (e.g. to verify business details for suppliers etc.)

We do not collect data from third parties for marketing or profiling. If we ever introduce features that allow login via social media or similar third-party integrations, we will explain clearly what is shared.

5. Why We Use Your Information

We only use your data when we have a lawful basis to do so.

A. To Provide and Manage Your Account (Contract)

• Create and manage your user account
• Deliver subscription services
• Provide access to courses, journals, trackers, content, and coaching
• Process payments and manage billing
• Send service-related notifications (e.g. renewal reminders, password reset emails, service changes)

Lawful basis: performance of a contract (UK GDPR Article 6(1)(b)).

B. To Provide Health & Wellbeing Support

(Explicit Consent – Article 9(2)(a))

We use your health and wellbeing information to:

• Supporting your health and wellbeing through journals, trackers, content and coaching
• Reviewing information you choose to share
• Personalising guidance and recommendations

We only process special category data (health data) with your explicit consent. You may withdraw this consent at any time (see Section 13). If you do, we may not be able to provide some or all of our wellbeing features or coaching services.

C. To Communicate with You (Consent or Legitimate Interests)

We use your information to:

• respond to your enquiries
• provide customer support
• send important notices about your account or service (e.g. changes to terms, privacy policy, or core features)

Lawful basis:

• Legitimate interests (Article 6(1)(f)) for essential service communications
• Consent where you specifically opt-in to certain communications

D. Marketing (Consent)

If you opt in, we may use your contact details to:

• Sending newsletters
• Share tips, updates and new features
• Tell you about offers of promotions related to our services

You will not receive marketing unless you have explicitly opted in.
You can withdraw marketing consent at any time by:

• clicking “unsubscribe” on any marketing email, or
• emailing us at contact@wellbeingfirst.co.uk

Lawful basis: consent (Article 6(1)(a)).

E. Analytics and Service Improvement (Legitimate Interests)

We use limited technical and usage data to:

• understand how our website and services are used
• fix bugs and improve performance
• develop and improve content and features

We use non-health data for analytics.
We do not use special category health data for analytics or marketing.

Lawful basis: legitimate interests (Article 6(1)(f)) – to run, grow and improve our services in a way that does not override your rights and freedoms.

F. Security and Legal Obligations

We may use your information to:

• prevent and detect fraud or abuse
• protect the safety of users, staff and systems
• maintain financial and tax records
• respond to lawful requests from authorities, regulators or courts
• enforce our Terms & Conditions

Lawful basis:

• legal obligation (Article 6(1)(c)), and
• legitimate interests (Article 6(1)(f)) for security and protection of our services.

6. Cookies and Tracking Technologies

We use:

• Essential cookies – necessary for the website to function (e.g. login, security, basic settings)
• Analytics cookies – help us understand how the site is used (set only with your consent)

We do not use advertising or behavioural tracking cookies.

You can manage your cookie preferences via our cookie banner or your browser settings. For more information, please see our Cookie Policy.

7. Lawful Bases for Processing

We rely on the following lawful bases under the UK GDPR:

Article 6:

• 6(1)(b) – performance of a contract (e.g. subscriptions, account management)
• 6(1)(a) – consent (e.g. marketing, some cookies, health data where applicable)
• 6(1)(c) – legal obligations (e.g. tax and financial record keeping)
• 6(1)(f) – legitimate interests (e.g. service analytics, security, customer service)

Article 9 (special category data):

• 9(2)(a) – explicit consent (for health and wellbeing information you choose to share)

You can withdraw consent at any time. This will not affect processing that has already taken place but may limit our ability to offer certain features.

8. How We Store and Protect Your Information

We take appropriate technical and organisational measures to protect your information, including:

• storing data on secure, encrypted servers
• encrypting data in transit where appropriate
• restricting access to authorised personnel only
• using secure third-party providers who meet appropriate security standards

Servers are located in jurisdictions with UK adequacy decisions or are safeguarded using approved transfer mechanisms (e.g. IDTAs or SCCs, see Section 11).

While we take reasonable steps to protect your information, no method of transmission over the internet or method of electronic storage is completely secure. Any transmission is at your own risk.

9. How Long We Keep Your Data

We retain information only as long as necessary for the purposes explained in this Policy or as required by law.

Retention Periods:

• Financial and contractual data: 6 years + current financial year
• General contact and account data: 5 years after our last contact with you
• Health and wellbeing data: normally deleted within 90 days of account closure, unless you request earlier deletion or we need to retain it for legal reasons
• Communications (e.g. emails, support messages): up to 2 years
• Backups: retained securely for limited periods before automatic deletion

We may keep anonymised or aggregated data (which does not identify you) for longer, for statistical or research purposes..

10. Who We Share Your Information With

We only share your data when necessary, with appropriate safeguards, and never sell your data.

We may share your information with:

• Payment processors – to process subscription payments securely
• Cloud storage and IT service providers – to host and support our systems
• Analytics service providers – for non-identifiable usage analysis (no health data)
• Professional advisers – such as lawyers, accountants and auditors where necessary

We may also share information where required by law, for example with:

• Courts
• Law enforcement agencies
• Regulators (including the ICO)

Where we use third-party service providers, they act under our instructions and are contractually required to keep your data secure and confidential.

11. International Transfers

If we transfer your data outside the UK, we ensure appropriate safeguards, such as:

• UK adequacy regulations
• International Data Transfer Agreements (IDTAs)
• Standard Contractual Clauses (SCCs)
• Other approved safeguards

You may request more information about specific safeguards in place for international transfers by contacting us.

12. Automated Decision-Making and Profiling

We do not use automated decision-making or profiling that has legal or significant effects on you.

Any personalised wellbeing guidance we provide is human-led, based on information you voluntarily share, not algorithmic.

13. Your Data Protection Rights

Under UK data protection law, you have the following rights:

• Right to be informed – about how we use your data (which this policy explains).
• Right of access – to request a copy of the personal data we hold about you.
• Right to rectification – to ask us to correct inaccurate or incomplete data.
• Right to erasure (“right to be forgotten”) – in certain circumstances, to ask us to delete your data.
• Right to restrict processing – in certain circumstances, to limit how we use your data.
• Right to object – to certain types of processing (e.g. direct marketing or processing based on legitimate interests).
• Right to data portability – to receive your data in a commonly used, machine-readable format and, where technically feasible, have it transmitted to another controller.
• Right to withdraw consent – at any time, where we rely on consent (e.g. marketing, health data).

You may exercise these rights by contacting us at:
contact@wellbeingfirst.co.uk

We may need to verify your identity before fulfilling your request.

14. Complaints and Supervisory Authority

If you have concerns about how we handle your personal data, we encourage you to contact us first so we can try to resolve the issue.

If you are not satisfied, you have the right to complain to:

Information Commissioner’s Office (ICO)
https://ico.org.uk/concerns/

If you are located in another country, you may also have the right to complain to your local data protection authority.

15. Children’s Privacy

Our services are intended for adults aged 18 and over. We do not knowingly collect data from children.

If you believe a child has provided us with personal information, please contact us and we will take steps to delete it.

16. Links to Other Websites

Our website may contain links to third-party websites or services.

We are not responsible for:

• the privacy practices of those websites, or
• any content, products or services they provide.

We recommend checking the privacy notices of any third-party sites you visit.

17. Community Features and Public Areas

If, now or in the future, we provide features such as comments on blog posts, forums, or community spaces:

• any information you choose to post in public areas may be visible to others
• you should avoid posting sensitive personal information, including health data, in public areas

We are not responsible for how others use information you share publicly.

18. Contact Us

If you have any questions, concerns, or wish to exercise your data rights, contact us:
contact@wellbeingfirst.co.uk
2 Vache Mews, Vache Lane, Chalfont St Giles, HP8 4UT, UK