How I look after your information
I’m Wes Reeves, a self-employed nutritionist and personal trainer trading as Wes Reeves Coaching. When you work with me, I’m responsible for the information you share. In data protection terms I’m the data controller, and I’m registered with the Information Commissioner’s Office under registration number ZC214177.
This covers what happens once you become a client. If you’ve only booked a call and haven’t gone further, the shorter notice on my website covers you instead.
What I hold, and why
Ordinary information. Your name, email address, phone number, and the practical details of our arrangement: what you’ve signed up for, when we speak, what you’ve paid.
Health information. Your intake form, your medical history, any conditions you’ve told me about, any medication you’re taking including weight-loss medication, your PAR-Q answers, and whatever comes up in our weekly check-ins and daily messages. Your weight, measurements and photos if you send them.
The law treats health information as a special category, with stronger protection than ordinary information. That’s right, and I treat it that way.
Why I need it. I can’t coach you safely without it. Your intake tells me whether what you want is something I can help with, whether anything needs to stay with your GP, and how to build a plan around your actual situation rather than a generic one. It’s the difference between coaching you and coaching a stranger.
The legal basis, in plain terms
For ordinary information, I rely on our contract: I can’t deliver the coaching you’ve paid for without holding your details.
For health information, I rely on your explicit consent. That means:
- You tick a specific, separate box on the intake form. It isn’t bundled into the terms and it isn’t pre-ticked.
- Saying no doesn’t cost you anything you’ve already paid for, though it does mean I can’t coach you, because I won’t work without knowing what I’m working with.
- You can withdraw it at any time, by emailing privacy@wesreeves.com. No reason needed, no penalty.
What happens when you withdraw. I delete your health information: intake form, medical history, medication details, check-in notes, photos and measurements. Coaching stops at that point, because I can’t safely continue without it. What I keep is the ordinary record of our contract, your name, dates, invoices and payments, because I need that for tax and in case of a dispute, and that’s held on a different basis that consent doesn’t cover.
Where your information lives
- Google Workspace holds your client record, our emails, the booking calendar, and every form you fill in. This is where your information actually lives.
- Stripe handles payments. Your card number goes straight to Stripe and I never see or hold it.
- WhatsApp Business is how we talk day to day. Messages between us are end-to-end encrypted, which means Meta cannot read what we send each other.
Please don’t put health information into the booking form on my website. There’s a proper place for it, with consent attached, on a separate form after we’ve spoken.
One thing worth being straight with you about. WhatsApp is a Meta product. Meta can’t read our messages, but it does see that we’re messaging and how often. If that bothers you, tell me and we’ll use email instead. It costs you nothing and I won’t ask why. Your client record never lives in WhatsApp, only the conversation does.
Stripe also uses payment information for its own purposes, to spot fraud and meet the checks the law requires of payment companies. For that part it decides for itself what it does, rather than acting on my instructions, and its own privacy policy covers it.
Everyone else on that list is contractually bound to use your information only for what I’ve asked them to do. Nobody sells it. Nobody advertises to you with it. I don’t pass it to other coaches, businesses, or anyone else.
Some of these companies operate internationally, so your information may be handled outside the UK. Transfers like these are covered by safeguards that UK law recognises.
I don’t share your information with your GP, your employer, your partner, or anyone else without asking you first. The one exception is if I genuinely believed someone’s life was at immediate risk.
How long I keep it
| What | How long | Why |
|---|---|---|
| Health information: intake form, medical history, medication, check-ins, photos, measurements | 2 years after we stop working together | Long enough to be useful if you come back or if something needs looking into, short enough that I’m not sitting on your medical history indefinitely |
| Contract records: name, dates, agreement, invoices, payments | 6 years after we stop working together | The period in which a contract dispute can legally be brought, and what my complaints policy commits to |
| If you fill in the health form and then decide not to go ahead | 30 days. Six months in the one case where I’ve written to your GP | There’s no coaching to look back on, so I hold it for the shortest time that makes sense. The GP letter is the exception because it records something I did on your behalf |
| If you withdraw consent | Health information deleted, contract records kept as above |
You can ask me to delete things sooner and I’ll do it unless there’s a legal reason I can’t, in which case I’ll tell you what it is.
What you can ask me to do
Ask for a copy of everything I hold about you. Ask me to correct anything wrong. Ask me to delete it. Ask me to restrict what I do with it. Ask me to send it to you in a portable format. Withdraw your consent for health information.
Email privacy@wesreeves.com. I’ll respond within a month, and there’s no charge.
If something goes wrong
If your information is lost, stolen or exposed, and there’s a real risk to you, I’ll tell you directly and I won’t wait to be asked. Where the law requires it, I’ll also report it to the Information Commissioner’s Office within 72 hours of finding out.
If you’re unhappy with how I’ve handled your information, tell me first and I’ll try to sort it. You can also complain to the Information Commissioner’s Office, the UK’s data protection regulator, on 0303 123 1113 or at ico.org.uk. You don’t need my permission, though the ICO will normally want to see that you came to me first.
Nothing about you is decided by a machine
No automated decision-making, no profiling. A person reads your intake form, and that person is me.