Privacy policy · THBC Practice Hub

Draft. This wording was written by the build team from how the platform actually works, and has not yet been reviewed by THBC's solicitor. It is here so nothing links to a missing page; treat it as a working document.

Who is responsible for your data

The Holistic Business Coach is the data controller for the information you give us as
a member. Contact us at support@thbcpractice.co.uk.
[[THBC: add your registered company name, address and ICO registration number.]]

Your clients are different. When you record a client in the Hub, you are the
controller for their information and we process it on your behalf under section
"Your clients' data" below.

What we collect about you

What	Why	Lawful basis
Name, email, password (hashed)	To give you an account	Contract
Membership tier, payment status, Stripe customer reference	To take payment and give you access	Contract
Your Business Profile answers	To place you on a Flourishing Stage and build your journey	Contract
Your progress: tasks, milestones, assets you write	To run your guided journey	Contract
Academy activity: lessons launched and completed	To mark Learn steps done	Contract
Conversations with your AI Guide, and the exact context sent with them	To give you the Guide, and so you can see what it knew	Contract
Notification preferences and quiet hours	To contact you the way you asked	Contract
Sign-in times, IP address, audit records of staff actions on your account	Security and accountability	Legitimate interests
Marketing consent, where you gave it	To send you THBC news	Consent

We do not store your card details. Payments are handled by Stripe, who are the
payment processor; we keep only their reference and the status.

What the AI Guide is given

This one is worth spelling out, because it is enforced in the code and not just
promised here. When you talk to your Guide we send it:

a defined list of Business Profile fields: what you practise, where your practice is,

your location and delivery mode, who you serve, what you offer, whether you have a
team, your client-count band, what you have in place, your available hours, your
confidence score, your goals and your blockers;

your Flourishing Stage, your chosen goal and how far through your plan you are;
counts and bands only from your operational data — how many clients, how many

offers, whether you can take payment, a revenue band. Never amounts, never names.

We never send your clients' names or details, your client notes, your payment details,
another member's data, or THBC's internal notes about you. We keep a record of exactly
what was sent with each conversation, and you can see it. If you turn off profile
context in your settings, we send none of it and the Guide works from the conversation
alone.

Your clients' data

Client records, notes, appointments and invoices you create are yours. We store them
so you can use them. Client notes are encrypted at rest. Client data is never used to
train an AI model, never shared with other members, and never sent to your Guide as
anything more than a count. THBC staff can see how many clients you have, not who they
are.

You can export or erase an individual client's data from their record at any time,
which is how you answer a subject access or erasure request from a client of yours.

Who else sees your data

Stripe — payments and membership billing.
Our learning platform (Hotline LMS) — your name and email, so you have an

Academy account and your lesson completions come back.

Anthropic — the content of a Guide conversation and the context described above,

to generate the reply. It is not used to train their models.

Our email and push providers — to deliver the messages you have asked for.
Our hosting provider — who stores the database on our behalf.

We do not sell your data, and we do not share it for anyone else's marketing.

How long we keep it

We keep your account and your work for as long as you are a member, and for
[[THBC: confirm — we suggest 12 months]] after you leave, so you can come back to the
same place. After that we delete or anonymise it. Records we must keep for tax or
accounting are kept for as long as the law requires. Audit records of staff actions on
your account are kept so we can always answer "who did that".

Your rights

Under UK GDPR you can ask us to give you a copy of your data, correct it, delete it,
restrict or object to how we use it, or hand it to another provider. Two of these you
can do yourself, immediately, from your settings: **export everything we hold about
you as a file, and erase your account**. For anything else, email support@thbcpractice.co.uk and we
will answer within one month.

If you are not happy with how we have handled your data you can complain to the
Information Commissioner's Office at ico.org.uk.

Cookies

We use one cookie to keep you signed in, and one to protect forms against
cross-site request forgery. Both are strictly necessary, so we do not ask for consent
for them. If you choose "remember me" we set a third, which you can clear by signing
out. We do not use advertising or tracking cookies.
[[THBC: update this if analytics are added later.]]

Security

Passwords are hashed and never stored in a readable form. Client notes are encrypted.
Access tokens are stored hashed. Connect (our staff system) requires a separate
permission for each action and writes an audit record for every one. We keep secrets
outside the web root.

Changes

If we change this policy in a way that matters, we will tell you before it takes
effect.