Privacy Policy

Kim Bloomhill (“we”, “us”) is committed to protecting and respecting your privacy. This policy explains how we collect, use, store, and protect your personal data when you use our website at kimbloomhill.com (the “Site”) and the services we provide, in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

Kim Bloomhill is the data controller for the personal data you provide through the Site. This means we are responsible for deciding how and why your information is held and used. You can contact us at any time using the form on our Contact page.

2. What personal data we collect

We may collect the following personal data:

• Contact details — your name and email address when you submit an enquiry, booking request, application, or community sign-up.
• Booking information — preferred dates, times, and any details you share when arranging a discovery call or session.
• Health information — when you book a discovery call or session, we ask whether you have a medical condition, or take any regular medication, that Kim should know about. If you answer yes, you can choose to share details. This helps Kim make sure the guidance she gives is safe and appropriate for you.
• Speaking enquiries — organisation or event name, event type, and approximate dates where relevant.
• Messages — the content of any message you send us through a form or by email.
• Newsletter subscriptions and waiting lists — your first name and email address, so we can send you updates and resources, or let you know when a programme such as Lighter, Not Weaker opens.
• Purchase information — when you buy a programme, your name, email address, what you bought, the amount, the date and a payment reference. Your card details are collected and processed by Stripe; we never see or store your full card number.
• Account details — if you create an account to access the members’ area, your name, email address and sign-in information.
• Testimonials — if you choose to share a testimonial, your full name and email address (only Kim sees these), how you worked with Kim, your testimonial, how you'd like your name to appear, any optional details you add (such as your age bracket or county), an optional photo, and a record of the permissions you gave.
• Technical data — limited, anonymised information such as browser type and pages visited, used to keep the Site secure and improve how it works.

Health information is “special category data” under UK GDPR, and we treat it with extra care. We only ask for what we need. Sharing details is optional, and the only person who sees your answers is Kim. Your health information is never added to calendar invites, used for marketing, or shared with anyone else unless the law requires it.

3. How we use your personal data

We use your personal data to:

• respond to your enquiries and provide the information you request;
• arrange, confirm, and send reminders for bookings and discovery calls;
• use any health information you share to make sure our coaching is safe and appropriate for you, and to know when to suggest you speak to your GP first;
• assess applications to work with Kim;
• publish testimonials you've chosen to share, in the way you agreed, and check they come from genuine clients;
• take payment for programmes, give you access to what you’ve bought, send your programme emails, and handle any refunds;
• send you our newsletter and blog updates, or tell you when a programme opens, where you have asked to receive them;
• keep our records accurate and provide a safe, effective service; and
• meet our legal and regulatory obligations.

4. Lawful basis for processing

Under the UK GDPR, we rely on the following lawful bases: taking steps at your request before entering a contract (for bookings and applications), performance of a contract (for delivering services and programmes you’ve signed up for or bought, including programme emails), your consent (for newsletter subscriptions, waiting lists and community sign-ups), legal obligation (for keeping financial records of purchases), and our legitimate interests in running and improving our practice (for replying to general enquiries).

For health information, which is special category data, we rely on your explicit consent, which you give when you book. You can withdraw your consent at any time by contacting us. We will then delete your health answers, although this may affect whether we can safely offer some types of guidance.

For testimonials, we rely on your consent, which you give on the testimonial form. If your testimonial mentions your health, we rely on your explicit consent, which you also give on the form. You can withdraw your consent at any time by emailing kim@kimbloomhill.com, and we will take your testimonial and photo down within 5 working days.

5. Sharing your data

We do not sell your personal data. We only share it with trusted third-party providers who help us operate the Site and deliver our services. These providers act on our instructions and are required to keep your information secure. They include:

• Base44 — hosts the Site, the members’ area and our records. Health information you share at booking is stored securely in our booking records, and only Kim can see it;
• Google — Gmail and Google Calendar, which we use to send emails and manage bookings;
• Stripe — processes payments. Stripe also uses some payment data for its own purposes, such as fraud prevention and meeting its legal obligations, as described in Stripe’s own privacy policy;
• Vimeo — hosts programme videos, which play inside the members’ area. We set the player to “do not track” to limit the data Vimeo collects while you watch.

We may also disclose data where required by law.

6. International transfers

Some of the service providers we use may process data outside the UK. Where this happens, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or the provider’s participation in recognised data protection frameworks, to ensure your information is protected to UK standards.

7. How long we keep your data

We keep your personal data only for as long as we need it to provide our services and meet our legal obligations. Newsletter, waiting-list and community sign-ups are retained while you remain subscribed; you can unsubscribe at any time using the link at the bottom of our emails. Purchase records are kept for six years, as required for tax and accounting purposes. Members’ area accounts are kept while you have access to a programme, or until you ask us to delete your account. Health information you share at booking is deleted 12 months after your last appointment; if you go on to work with Kim as an ongoing client, we keep it for as long as we work together and for 12 months afterwards, then delete it. Testimonials are kept while they are published. If you ask us to take yours down, or we don't publish it, we delete the testimonial and photo and keep only a record of the permissions you gave, which is deleted 12 months later. Booking and enquiry records are kept for a reasonable period to allow us to respond to follow-up questions and meet record-keeping requirements, after which they are deleted or anonymised.

8. Cookies

The Site may use essential cookies and similar technologies to function properly and to understand, in aggregate, how it is used. We do not use cookies to identify you personally for advertising. When you pay, Stripe’s checkout page may use its own cookies to process your payment securely and prevent fraud. You can control or delete cookies through your browser settings; disabling some cookies may affect how the Site works.

9. Data security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse. However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

10. Your rights

Under the UK GDPR, you have the right to:

• be informed about how we use your data;
• access the personal data we hold about you;
• ask us to correct inaccurate or incomplete data;
• ask us to erase your data in certain circumstances;
• restrict or object to how we process your data;
• receive a copy of your data in a portable format; and
• withdraw consent at any time, where we rely on consent.

To exercise any of these rights, please contact us through our Contact page. If you are unhappy with how we handle your data, you have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

11. Children

The Site and our services are intended for adults. We do not knowingly collect personal data from children. If you believe a child has provided us with information, please contact us and we will delete it.

12. Changes to this policy

We may update this policy from time to time to reflect changes in our practice or legal requirements. The “last updated” date at the top of this page will always show the most recent version.

13. Contact us

If you have any questions about this Privacy Policy or how we handle your personal data, please get in touch through our Contact page. We will respond to your request without undue delay and within one month, as required by the UK GDPR.