Privacy Policy

Last updated: 29 July 2026

This policy explains how Orbit & Balance ("we", "us", "our") collects, uses, stores, and protects your personal data when you use our website, book a discovery call, join a coaching programme, or otherwise interact with us. We are the data controller of the information you provide.

1. What data we collect

Information you give us directly

• Contact details: your name and email address when you book a discovery call, submit a quiz, download a resource, apply to a programme, or create a client portal account.
• Booking details: your timezone and preferred call times.
• Account details: if you register for the client portal, your password (stored as a one-way hash — we never see or store your actual password).
• Coaching data: as an active coaching client, we collect information you share as part of the coaching relationship — including goals, dietary preferences, weight logs, check-in responses, feedback, and any files you choose to upload.
• Payment details: we do not store your card or bank details. Payments are processed by Stripe (see "Third parties" below).

Information collected automatically

• Anonymous usage analytics: we log which pages are viewed, quiz completions, and time-on-page against a random session identifier that is generated per page load. This data does not identify you personally.
• Authentication cookie: if you log in to the client portal, we set a single essential cookie containing an encrypted session token so you stay signed in.
• Server logs: our hosting provider automatically records basic request logs (IP address, browser type, timestamp) for security and abuse prevention.

2. Special category data (health)

Nutrition and habit coaching involves data about your health — including weight, body composition, dietary habits, energy, sleep, and any medical context you share with us. Under UK GDPR this is "special category" data and has additional protections.

We collect and process this data only with your explicit consent, given when you sign up as a coaching client. You can withdraw consent at any time by emailing us; if you do, we will stop processing your health data and delete it in line with the retention periods below.

3. Why we use your data (lawful bases)

• To deliver the coaching service you've paid for — lawful basis: contract.
• To respond to enquiries, book calls, and send you the resources you requested — lawful basis: consent, or steps to enter into a contract.
• To process payments and handle billing — lawful basis: contract and legal obligation.
• To send transactional emails (booking confirmations, coaching-related messages, receipts) — lawful basis: contract.
• To send occasional marketing emails about new content or offers — lawful basis: consent. You can unsubscribe at any time.
• To process your health data as part of coaching — lawful basis: your explicit consent.
• To understand how the website is used and improve it — lawful basis: legitimate interests in running a good service, using anonymous analytics.
• To keep records for tax, accounting, and legal compliance — lawful basis: legal obligation.

4. Third parties we share data with

We only share the minimum data needed, and only with providers that meet UK GDPR standards:

• Stripe — processes card payments and subscriptions. Stripe is the controller of your payment card data. See Stripe's privacy policy.
• Resend — sends our transactional and coaching emails. Your name and email are shared to deliver messages. See Resend's privacy policy.
• Hostinger / IONOS — our VPS hosting provider stores the database and files.
• Google Fonts — our website loads fonts from Google's CDN. Google may log your IP address as part of that request. See Google's privacy policy.
• Telegram — used for internal admin notifications only. Your data is not sent to Telegram.

We do not sell your data. We do not use advertising cookies, retargeting pixels, or third-party analytics like Google Analytics or the Meta Pixel.

5. International transfers

Some of our providers (Stripe, Resend, Google) are based outside the UK. Where personal data is transferred internationally, we rely on the provider's Standard Contractual Clauses, UK Addendum, or adequacy decisions to keep your data protected to UK GDPR standards.

6. How long we keep your data

• Enquiry / quiz / lead-magnet data: up to 3 years, or until you unsubscribe / request deletion.
• Active client records (including coaching and health data): for the duration of our coaching relationship and up to 3 years after it ends, so we can respond to follow-up questions and demonstrate compliance.
• Financial records (invoices, payments): 6 years, in line with HMRC record-keeping requirements.
• Anonymous analytics: retained indefinitely in aggregated form only.
• Server logs: up to 90 days.

7. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Ask us to correct data that is inaccurate.
• Ask us to delete your data ("right to be forgotten"), subject to our legal record-keeping obligations.
• Restrict or object to how we process your data.
• Withdraw consent at any time, where consent is the lawful basis.
• Receive a copy of your data in a portable format.
• Lodge a complaint with the UK's Information Commissioner's Office (ICO) at ico.org.uk.

To exercise any of these rights, email contact@orbitandbalance.com. We'll respond within 30 days.

8. Security

We take reasonable technical and organisational measures to protect your data: passwords are hashed with bcrypt, sessions are secured with signed JWT tokens, our site runs over HTTPS with TLS certificates, and access to the client database is restricted to Orbit & Balance staff. No system is ever 100% secure — if you become aware of a security concern, please contact us immediately.

9. Children

Orbit & Balance's coaching services are for adults (18+). We do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

10. Changes to this policy

We may update this policy from time to time. When we do, we'll update the "last updated" date at the top. For material changes we will notify active clients by email.

11. Contact

Questions about this policy or your data? Email contact@orbitandbalance.com.