Privacy Policy

Last updated: October 2026

Your privacy matters. When you contact Groundwork, book a session or share something about yourself, you should know how that information will be used and looked after. This policy explains what personal information we collect, why we collect it, who we share it with and the choices available to you.

1. Who is responsible for your information?

Groundwork is operated by Jason Gilby, trading as Groundwork. We are the controller responsible for the personal information described in this policy. If you have questions about your privacy or would like to exercise your rights, contact: jason@doingthegroundwork.co.uk

2. Information we collect

Depending on how you interact with Groundwork, we may collect:

  • Contact and booking information - Your name, email address, telephone number, appointment details, purchases and correspondence with us.

  • Information you choose to share before or during sessions - This may include your reasons for booking, access requirements, relevant health information, medication, emergency contact details and information you share during a session.

  • We aim to collect only what is needed to assess suitability, make appropriate adjustments and provide our services. You do not need to share your personal history in detail to participate. [Confirm whether you keep session notes and describe their scope here.

  • Payment information - Payments are handled by Stripe. We receive information such as payment status, transaction references and the service purchased. We do not store full payment card numbers or card security codes.

  • Website information - Depending on your cookie choices and our website settings, we may collect information such as your IP address, browser, device and the pages you visit.

  • Marketing preferences and feedback - If you subscribe to updates, we keep your contact details and subscription preferences. We may also keep feedback you choose to provide.

3. How we use your information

We use personal information to:

  • Respond to enquiries.

  • Manage bookings, payments, cancellations and refunds.

  • Assess whether a session is suitable and discuss relevant adjustments.

  • Deliver sessions and communicate practical information.

  • Provide agreed follow-up support.

  • Maintain appropriate business and session records.

  • Respond to complaints and manage legal or insurance matters.

  • Send marketing updates where you have opted in.

  • Operate and protect our website.

We do not sell your personal information or use information shared in sessions for targeted advertising.

4. Our lawful bases

UK data protection law requires us to have a lawful basis for using your information.

We rely on:

Contract

Where information is needed to take steps at your request before booking, or to provide a service you have booked.

Legal obligation

Where we need to meet legal requirements, such as keeping appropriate financial records.

Legitimate interests

For reasonable business purposes such as responding to general enquiries, maintaining security, handling complaints and establishing or defending legal claims. We consider your rights and expectations before relying on this basis.

Consent

For activities such as optional email marketing and non-essential cookies, where applicable. You can withdraw consent at any time.

5. Health and other sensitive information

Health information and some other personal information receive additional protection under data protection law. These are known as special category data.

For relevant health information collected through our intake and suitability process, we rely on [confirm lawful basis] together with your explicit consent as the special category condition.

We will explain what information we need and why, and ask for explicit consent separately from acceptance of our Terms & Conditions.

Please share only information relevant to your participation or the support you are requesting. You do not need to disclose a diagnosis simply to ask about access arrangements.

You can withdraw your consent by contacting [email address]. This does not affect processing that was lawful before withdrawal. If the information is necessary to assess suitability or facilitate a session safely, withdrawing consent may mean we cannot continue providing that particular service.

In limited circumstances, we may retain or use relevant information where another lawful basis and special category condition apply, for example where necessary for legal claims. We will not treat your consent as permission for unrelated uses.

6. Emergency contacts

If we ask for an emergency contact, we use their details only for relevant safety arrangements or an emergency.

Please let that person know you have provided their details and direct them to this policy. We do not add emergency contacts to marketing lists.

7. Who we share information with

We share personal information only where needed for the purposes described in this policy.

Recipients may include:

  • Our website and booking providers: [confirm providers, such as Squarespace and Acuity Scheduling].

  • Payment providers: [confirm providers, such as Stripe].

  • Email, video-call and secure record-storage providers: [list providers].

  • Accountants, legal advisers and insurers, where relevant.

  • Emergency services or appropriate authorities, where sharing is necessary and lawful.

Providers receive only the information relevant to their role. Their responsibilities may differ: some process information on our behalf, while others act as independent controllers for particular activities.

For collaborative events, we will explain before booking if another organisation will receive participant information, what will be shared and who is responsible for it.

We do not routinely share intake forms or session notes with venues, employers, event partners or other participants.

8. Confidentiality in sessions

We treat information shared in sessions with care and respect.

Confidentiality is not absolute. We may disclose relevant information where required by law, necessary for legal claims, or necessary and lawful to respond to a serious safety or safeguarding concern. Where appropriate, we will discuss this with you first.

In shared and group sessions, other participants can hear what you choose to share. We ask everyone to respect one another’s privacy, but cannot guarantee another participant’s conduct.

9. Recordings, photographs and testimonials

We do not routinely record sessions.

If we propose taking photographs or making a recording, we will explain the purpose, how it will be used, who can access it and how long it will be kept. We will obtain any consent required before proceeding.

We ask for separate, optional permission before publishing identifiable feedback, testimonials, photographs or recordings. Declining will not affect your access to sessions.

You can contact us to withdraw permission for future use. We will explain any practical limits, such as material already printed or content independently shared by others.

10. Marketing emails

If you opt in, we may email you about Groundwork sessions, events, resources and news.

You can unsubscribe at any time using the link in an email or by contacting us. Unsubscribing does not stop essential messages about an existing booking.

We may retain a minimal record of your unsubscribe request so that we can honour it.

11. Cookies and website analytics

Our website uses cookies and similar technologies.

Some are necessary for the website and booking functions to work. Others, such as optional analytics or advertising technologies, require your consent before they are used.

[Insert details of the cookies and analytics actually enabled, their providers and durations, or link to a separate Cookie Policy.]

You can manage non-essential cookie choices through [cookie settings link or banner]. You can also change your browser settings, although blocking essential cookies may affect some functions.

12. International transfers

Some providers may store or access personal information outside the UK.

Where this happens, we use the safeguards required by UK data protection law. Depending on the destination and provider, these may include UK adequacy regulations or approved contractual safeguards.

[Confirm the arrangements used by your providers.] Contact us if you would like information about the safeguards relevant to your data.

13. How long we keep information

We keep information only for as long as needed for the purpose it was collected, taking account of legal obligations and relevant insurance requirements.

Our retention periods are:

  • General enquiries that do not lead to a booking: [period].

  • Booking records and routine correspondence: [period].

  • Intake forms, consent records and any session notes: [period and when it starts].

  • Financial and tax records: [period required for your business structure].

  • Marketing records: until you unsubscribe or [inactivity period].

  • Photographs, recordings and testimonials: [period or agreed usage terms].

We may retain relevant records longer where needed for an ongoing complaint, legal claim or legal obligation.

When information is no longer needed, we securely delete or anonymise it. Copies in backups are removed in accordance with [backup deletion cycle] and are protected while awaiting deletion.

14. How we protect information

We use appropriate technical and organisational measures to protect personal information against unauthorised access, loss, misuse or disclosure.

These include [confirm measures actually in place, such as restricted access, strong passwords, multi-factor authentication and secure storage].

Access is limited to people who need the information for their role.

No system can be guaranteed completely secure. If a personal data breach occurs, we will assess it and notify the Information Commissioner’s Office and affected individuals where legally required.

15. Your rights

Depending on the circumstances, you may have the right to:

  • Be informed about how your information is used.

  • Request access to your personal information.

  • Correct inaccurate or incomplete information.

  • Request deletion.

  • Restrict how information is used.

  • Object to certain processing, including processing based on legitimate interests.

  • Receive certain information in a portable format.

  • Withdraw consent where we rely on it.

These rights are not absolute. For example, we may need to retain some records to meet a legal obligation or handle a legal claim.

To make a request, contact [email address]. We normally respond within one month. If an extension is permitted and necessary, we will explain why. We may need to verify your identity before releasing information.

We do not use your personal information to make solely automated decisions that have legal or similarly significant effects on you.

16. Information about children

Groundwork’s services are intended for people aged [minimum age] and over.

If you believe we have collected information from someone below this age outside an agreed and appropriate arrangement, please contact us so we can investigate.

17. Questions or complaints

Please contact [email address] if you have a concern about how we handle your information.

You also have the right to complain to the UK Information Commissioner’s Office. You do not need to raise your concern with us first.

Website: https://ico.org.uk/

18. Updates to this policy

We may update this policy as our services or practices change. The latest version will appear on this page with an updated date.

Where a change materially affects how we use your information, we will provide additional notice where appropriate.