top of page

Website Privacy Notice  

1. Introduction

Ciao Change Ltd (“we”, “our”, “us”) is the data controller responsible for your personal data. Personal data means any information capable of identifying an individual.
This privacy notice explains how we collect, process and protect your personal information when you use our website www.ciaochange.com , sign up for coaching or contact us.

 

Here are our contact details:
Email: info@ciaochange.com
Postal Address: Ciao Change Ltd, 71-75, Shelton Street, London, WC2H 9JQ, UNITED KINGDOM
 

It is important that the information we hold about you is accurate and up to date. Please notify us if your personal details change at the email address above.

 

Changes to this notice

We may update this Privacy Notice from time to time to reflect changes in our business, our website, our services, or legal requirements. The latest version will always be available on our website
This notice was last updated on 23 July 2026.

 

2. Data we collect and how we collect it

We collect personal and sensitive information to provide effective health coaching services, comply with legal obligations, and manage our business.

​

By providing your data, you confirm that you are over 18 years of age.


We do not knowingly collect data relating to children without verified parental consent.

 

We may collect:

  • Identity and Contact Data: Name, email, phone, postal address.

  • Financial Data: Payment details (processed securely via third-party gateways).

  • Health and Lifestyle Data: Information you share about your health history, lifestyle, dietary habits, mental or physical wellbeing, medical conditions or goals.

  • User and Technical Data: IP address, browser type, device data, site analytics.

  • Communication Data: Messages, forms, feedback and emails.

  • Marketing Preference Data: Subscription choices and consent records.

 

We collect data through:

  • Registration or enquiry forms, coaching agreements and online sessions.

  • Direct communications by phone, email or video call.

  • Website cookies, analytics and hosting platforms (e.g., Wix).

  • Secure payment and scheduling systems (e.g., Stripe, Calendly, etc.).

 

3. Use of personal data and legal grounds

We process your personal data only where lawful and necessary. Our lawful bases include:

  • Performance of a Contract: To deliver health coaching sessions, manage bookings, communicating with you and process payments.

  • Legal Obligation: To maintain business, tax and accounting records.

  • Legitimate Interests: To operate, improve and communicate about our services.

  • Consent: To process sensitive information and send marketing materials (where you have explicitly agreed).

 

Processing of sensitive (Health) Data

 

Because we collect some health-related information, we rely on:

  • Your explicit consent under Article 9(2)(a) of the UK GDPR to process health and wellbeing data you provide voluntarily; and

  • Duty of confidentiality as part of our ethical and contractual commitment to professional coaching standards (registered with official body UKIHCA).

 

We use this data only to tailor your coaching programme, monitor progress and communicate effectively with you about your health goals.

 

You may withdraw consent for using your sensitive data at any time by contacting us. However, this may affect our ability to provide or continue coaching services.

 

3A. Summary of processing activities and legal bases

We use your personal data for different purposes. For each purpose we must identify a lawful basis under Article 6 UK GDPR, and for health (special category) data an additional condition under Article 9 UK GDPR (explicit consent).

a) Website visits and analytics

  • Data: Technical and usage data (IP address, device, browser type, pages visited, time on page, cookies, analytics).

  • Purpose: To operate and secure our website, understand how visitors use it, and improve content and performance.

  • Lawful basis (Article 6): Our legitimate interests in running an effective, secure website and growing our business.

  • Special category data: Not normally used here.

b) Enquiries and general communication

  • Data: Identity, contact and communication data (name, email, phone number, messages).

  • Purpose: To respond to your enquiries, provide information and keep appropriate records.

  • Lawful basis (Article 6): Our legitimate interests in responding to queries and keeping business records; and, where you request details about coaching, steps taken at your request before entering a contract.

  • Special category data: If you voluntarily share health details in an enquiry, we rely on your explicit consent to use that information to reply appropriately and decide whether our services are suitable (Article 9(2)(a) UK GDPR). Where you voluntarily provide health-related information before entering into a coaching agreement, we will process that information only where you have provided explicit consent or another lawful basis applies.

c) Providing health coaching services

  • Data: Identity and contact data; financial and transaction data; health and lifestyle data; Journaling or coaching tools; session notes and progress records.

  • Purpose: To assess your needs, design and deliver coaching programmes, monitor progress and communicate about sessions.

  • Lawful basis (Article 6):

    • Performance of a contract with you (to deliver coaching and manage bookings).

    • Legal obligation for invoicing and accounting records.

  • Special category data: Health and lifestyle information is processed on the basis of your explicit consent (Article 9(2)(a)), and under a duty of confidentiality consistent with professional standards.

d) Payment processing and accounting

  • Data: Identity data, contact data, financial data (handled via secure payment providers), transaction history.

  • Purpose: To process payments, prevent fraud and meet tax and accounting requirements.

  • Lawful basis (Article 6):

    • Performance of a contract (taking payments for services).

    • Legal obligation (keeping financial records for tax and regulatory purposes).

  • Special category data: Health data is not needed for payments and is not processed for this purpose.

e) Appointment reminders and service messages

  • Data: Identity and contact data, limited service details (e.g., session type/time).

  • Purpose: To send reminders, confirmations, and important service-related updates.

  • Lawful basis (Article 6): Our legitimate interests in ensuring appointments are attended and services run smoothly and performance of a contract (where reminders are part of the service you expect).

  • Special category data: We do not include detailed health information in reminders.

f) Marketing and newsletters

  • Data: Identity and contact data, marketing preference data, basic usage data (e.g., which emails you open).

  • Purpose: To send you relevant resources, news, and offers about our services.

  • Lawful basis (Article 6):

    • Consent, where you actively opt in to receive marketing; and/or

    • Legitimate interests in promoting our services, where permitted by e‑privacy rules and you have not opted out.

  • Special category data: We do not need health data for marketing and do not use it for this purpose.

g) Legal, regulatory and dispute-related use

  • Data: Any relevant data needed to handle complaints, legal claims or regulatory queries.

  • Purpose: To establish, exercise, or defend legal claims and to cooperate with regulators or authorities when required.

  • Lawful basis (Article 6): Our legitimate interests in protecting our business and complying with legal processes and legal obligation where the law requires disclosure.

  • Special category data: Where health data is involved, we rely on your explicit consent where appropriate or, where applicable, the necessity for the establishment, exercise or defence of legal claims under Article 9(2)(f) UK GDPR.

h) Receiving data from third parties

We may receive data from third parties such as analytics providers such as Google based outside the EU&UK, Facebook based outside the EU&UK, providers of technical, payment and delivery services, such as data brokers. Also, data from publicly availably sources such as Companies House and the Electoral Register based inside EU or outside it and inside the UK or outside it.

​

4. Marketing communications

We may send carefully selected updates, resources or offers if you have opted in.
You can unsubscribe at any time by contacting us directly.
Unsubscribing will not affect essential service-related communications.

 

5. Sharing data with Third Parties

We respect your confidentiality and only share information where necessary:

  • With service providers (e.g., website host, CRM or HER platforms, email platform, payment processor etc) under strict confidentiality terms.

  • With professional advisers (such as accountants or legal representatives).

  • With health professionals only where you have given explicit written consent.

  • With law enforcement or regulators if legally required.

All third parties must comply with data protection and security standards.

 

6. International transfers

Some service providers may store or process data outside the UK or EEA (e.g., US-based cloud or payment systems).
Where this occurs, we ensure equivalent safeguards by using:

  • Adequacy decisions by UK/EU authorities; or

  • Standard Contractual Clauses and secure data transfer terms.

 

7. Data security

We use appropriate technical and organisational security measures through platforms we adopt for running our business, including:

  • Encrypted data storage and transfer.

  • Password protection, antivirus and firewall systems.

  • Restricted access to authorised personnel only.

  • Secure client files stored through our hosting platform (e.g., Wix.com) following PCI-DSS standards for payment data.

If a data breach occurs, we will promptly notify affected individuals and where required, the ICO.

 

8. Data retention

We retain information only as long as needed for business, legal, or professional obligations:

  • Client records (including health notes): up to 7 years after last session.

  • Financial data: at least 6 years (for accounting and tax compliance).

  • Marketing data: until you unsubscribe or withdraw consent.

  • Enquiry data: retained until no longer required or upon your request for deletion.

Anonymised data used for research or statistics may be stored indefinitely.

 

9. Your rights

You have the right to:

  • Request access to your data.

  • Request correction or deletion.

  • Restrict or object to processing.

  • Withdraw consent for processing or marketing communications.

 

We may need proof of identity before fulfilling such requests.

We will normally respond to requests concerning your personal data within one month, subject to any lawful extension permitted by UK GDPR.

 

If you have concerns about our handling of your data or your requests remain unresolved, please contact us first.
You may also file a request with the Information Commissioner’s Office (ICO) if you think is necessary:
Website: https://www.ico.org.uk
Helpline: 0303 123 1113

Ciao Change Ltd is registered with the Information Commissioner's Office (ICO).

 

10. Cookies

We use cookies to improve functionality, analyse website traffic and remember your preferences.
Cookies do not collect personally identifying data unless you choose to submit it.
You can manage or disable cookies in your browser settings.
For full details, see our Cookie Policy.

​

11. External links

Our website may include links to external sites. We are not responsible for their privacy practices and recommend reviewing each site’s privacy notice before submitting personal data.

​

12. Complaints and Contact

We process all personal data in compliance with this policy and UK GDPR.
If you wish to raise a concern about how your information is handled, please contact:
Data Controller: Simona Vinci
Email: info@ciaochange.com
Postal Address: 71-75, Shelton Street, London, WC2H 9JQ, UNITED KINGDOM

bottom of page