What I hold about you, why, and what you can ask me to do with it
You trust me with information about your health. This notice sets out exactly what I hold, why I hold it, who else sees it, how long I keep it, and your rights over it. If anything here is unclear, ask me and I will explain it.
Who I am
Beyond™ is the trading name of Nick Wallington, a sole trader, at 5 Brayford Square, London E1 0SG. I decide how your information is used (the “controller”, in data protection law) and am registered with the Information Commissioner’s Office, registration number ZC284740.
Contact me about anything in this notice: Nick Wallington, nick@beyondtm.uk.
What I hold, and why
Information | Why I use it | The legal basis |
Your name, contact details and how you heard of me | To reply to your enquiry and arrange a first conversation | My legitimate interest in answering you |
Your agreement and payments | To provide the programme you signed up for, and keep the accounts the law requires | Our contract; a legal obligation for accounts |
Your health: the PAR-Q+, medical history, injuries, medication, measurements, test results, session records and check-ins | To coach you safely and measure your progress | Our contract, and your explicit consent, which I ask for separately before I hold any of it |
Your blood and DEXA results | To include them in your programme and your reviews | Your explicit consent |
Photographs and video of you | Your own progress record, or marketing, only if you sign the consent for that use | Your consent, which you can withdraw at any time |
Your results or words in my marketing | Only if you sign the separate results consent | Your consent, which you can withdraw at any time |
Health information is “special category” data, which the law protects more strictly. I never sell your information, and I never use it to target advertising, including by uploading client lists to any advertising platform.
Who else sees it
Only me, and the services I use to run the business, each of which handles your information on my instructions:
Provider | What it does for me | Where the data is held |
Tally | The forms you fill in: the free fitness test form, weekly check-in, session log, questions | European Union |
Microsoft 365 (OneDrive and Outlook) | Storing your documents and records; email between us | United Kingdom |
Google (Sheets) | A spreadsheet that collects your form answers | United States and elsewhere |
WhatsApp (Meta) | Messages between us | United States and elsewhere |
Anthropic (Claude) | Helping me draft documents and your portal, which I check before anything reaches you | United States |
Nobody else sees your health information unless you agree, for example when a test result should go to your GP, or when the law requires it, or in an emergency to protect your life.
When it leaves the UK
Some of these services store information outside the UK. Where they do, I use only the protections UK law allows: a country the UK recognises as protecting data adequately (including the European Union, and United States companies certified under the UK extension to the Data Privacy Framework), or the Information Commissioner’s approved international data transfer agreement.
How long I keep it
Record | Kept for |
Your client record, including health information | 6 years after your last session |
An enquiry that did not lead to a programme | 12 months after we last spoke |
Accounts and payment records | 6 years, as the law requires |
Photographs, video and results used with your consent | Until you withdraw consent; then removed from anything I control |
When a client leaves, they receive a complete final copy of their record to keep. After the period above, the record is deleted.
How I protect it
Your portal is encrypted and opens only with your own password. My devices are locked with a passcode, and nobody else has access to your records. If something went wrong that put your information at risk, I would tell you, and the Information Commissioner where the law requires it.
Your rights
- To see what I hold about you, and have a copy.
- To have anything wrong corrected.
- To have your information deleted, unless the law requires me to keep it.
- To ask me to limit how I use it, or to object to a use.
- To take your information with you, in a form another coach can use.
- To withdraw any consent you have given, at any time. It doesn’t affect what was done before.
Ask me in writing, and I will reply within one month. There is no charge.
If you are unhappy with how I have handled your information, please tell me first. You can also complain to the Information Commissioner’s Office: ico.org.uk, 0303 123 1113.
Computers and AI
No decision about you is made by a computer. AI tools may help me draft documents; I read and approve everything before it reaches you, and they never decide anything about your programme or your health.
Changes
This notice was last updated on 27 October 2026. If it changes in a way that matters to you, I will tell you. If my business moves into a limited company, I will tell you before your information moves with it, and give you the new notice.
Nick Wallington, trading as Beyond™