Privacy policy

Startstrong Fitness CIC (Community Interest Company registration number 15060988) is the data controller for personal information collected through this website.

You can contact us at emma@startstrongfitnesscic.com with any questions about this policy or your data.

Startstrong Fitness CIC is registered with the Information Commissioner's Office (ICO), registration reference ZC182020.

Emma Shaw is our Data Protection Lead. For any question about your data, contact emma@startstrongfitnesscic.com.

When you use our contact form, we collect the information you provide: your name, email address, enquiry type, message and whether you are a health professional.

When a health or social care professional refers a parent to us, we collect the information entered on our referral form — see “Referrals from professionals” below.

When you book a class through our booking provider (Bookwhen), booking and payment data is handled by that provider according to their own privacy policy.

When you come to our classes, we copy from Bookwhen a record of which classes each person booked and whether they attended. We use it to count how many families our classes reach and how often they come, for the figures we give our funders. It is stored in our own database, hosted by Supabase in London. It holds no names or contact details: each person appears only as a code. It is still personal data, because we could match a code back to that person's account in Bookwhen.

Our class feedback survey is anonymous by design: it does not ask for or store your name, email address, IP address or any device identifier. We record only the town, how long you have been coming, your four ratings, any comment you choose to write, whether we may share that comment in funding applications and reports, and the month — deliberately not the date or the time, so that a response cannot be traced back to a particular class. The one free-text box is the comment field, so please do not include your name or anything else that identifies you there. To protect the survey from automated abuse, your IP address is checked briefly in memory when you submit — it is never stored or connected to your answers.

When you visit this website, standard server and analytics data may be collected by our hosting provider (Vercel) — such as IP address, browser type and pages visited.

Our Parent and Carer Needs Survey (run with Families Together Suffolk) is anonymous in the same way as our class feedback: no name, email, IP address or device identifier is stored with your answers, your postcode is reduced to its first half (like IP14) before it is saved, and the month — not the date or time — is recorded. If you choose to leave your name and email at the end so we can tell you about new classes, those details are stored completely separately from your answers and the two are never connected.

A health visitor, midwife, GP, social prescriber or similar professional can refer you to our classes. If that has happened, they will have told you about it and asked your permission first — and this section explains what we then hold about you, because you did not fill anything in yourself and may never have visited this website.

Where the information came from. We did not collect it from you. It came from the professional who referred you, who gave it to us on our referral form. They tell us their own name, job role, organisation and contact details, so that we can reply to them.

What we hold about you. Which of our class locations would suit you, and a short list of reasons the professional ticked — things like cost or childcare being a barrier. Nothing more is kept in our records.

What we deliberately do not ask for. Until 10 August 2026 the form had a free-text box, and professionals often used it to describe a parent's health. We removed it. We do not need that information at the referral stage, and you will complete your own health questionnaire when you book a class — which is where it belongs, given by you rather than about you.

We do not keep your name in our records, or any way of contacting you: no email address, no phone number, no address. The professional may give us your name so that we recognise you when we reply to them. It reaches us only in the referral email, which is held in our email account with Google Workspace for a year from when it arrives, then deleted at our next six-monthly clear-out. We keep no link between a referral and our class registers.

Who sees it. Two of our directors and our administrator. If something about your referral affects how a session should be run, a coach is told that by a person — it does not come from our records, which cannot connect a referral to anyone in the room.

How long we keep it. One year from when the referral reached us. After that, our record and the referral email are both deleted at our next six-monthly clear-out. If you ask us to delete it sooner, we will.

If you would like to know what we hold, have it corrected, or have it deleted, contact emma@startstrongfitnesscic.com. You do not need a reference number — tell us roughly when you were referred and by whom, and we will find it. You can also complain to the Information Commissioner's Office at ico.org.uk, and you do not have to raise it with us first.

One consequence of holding no contact details for you is worth being straightforward about: it means we cannot write to you to tell you any of this. It is why it is published here, and why we ask the professional referring you to pass this page on.

We use contact form submissions to respond to your enquiry — whether that is a class question, a professional enquiry, or a partnership request. Referrals from professionals come through the separate referral form.

We use class feedback to improve our sessions and to report our impact to funders and commissioners. We report totals and percentages — for example, the proportion of parents reporting improved wellbeing — and never an individual response. The only exception is a comment you have agreed we may share, which appears without a name.

We use referral information to contact the referring professional and arrange a suitable class for the parent. Where something about the referral affects how a session should be run, that is passed on by a person, not by the record — our system deliberately stores no link between a referral and a class register.

We do not sell your personal data. We do not use your data for unrelated marketing without your consent.

We process contact form data on the basis of our legitimate interest in answering your enquiry.

We keep the class attendance record on the basis of our legitimate interest in showing our funders how many families our classes reach.

Parent and Carer Needs Survey: the answers are designed to be anonymous as we hold them (see above). If you leave your name and email at question 14, we hold those on the basis of your consent, which you can withdraw at any time by emailing us or replying to any message from us; we then delete your details.

We process referral information on the basis of consent. The referring professional confirms, when they submit the form, that they have the parent's consent to share their information with us and that they have told the parent about the referral; that confirmation is what we rely on, and we keep a record of which version of the wording they confirmed. Since 10 August 2026 the form no longer collects free text about a parent, so a referral holds only the locations that suit them and a short list of ticked reasons. A parent can withdraw consent at any time by contacting us, and we will delete the record.

Contact enquiries: one year from when your message reached us, then deleted at our next six-monthly clear-out.

Referrals: one year from when the referral reached us, then deleted at our next six-monthly clear-out, or sooner if the parent or the referrer asks us to remove it.

Emails: a copy of every enquiry and referral is emailed to us and held in our email account with Google Workspace. We keep these emails for one year from when they arrive, then delete them at the same six-monthly clear-out.

You can ask us to delete your information at any time, and we will. Because our database is backed up daily, a deleted record can take up to seven days to disappear from those backups as well.

Financial records: six years from the end of the financial year they relate to, as tax rules require.

Class feedback: kept indefinitely, so that totals covering several years remain available to show funders the difference our classes make over time.

Parent and Carer Needs Survey answers: kept indefinitely, as anonymous data, for the same reason. The waiting list from question 14 (your name and email): one year after we last contact you, or one year after you joined if we never do, then deleted.

Website analytics and server logs: kept according to our hosting provider's own retention periods, over which we have no control.

Class attendance record: six years from the date of each class, then deleted. After that we keep only totals, which identify nobody.

Class bookings are held by Bookwhen under their own retention policy, not ours.

Contact and referral forms: Messages from our contact form and referrals from professionals are both stored in our own database, hosted by Supabase in London, and a copy is emailed to us. Our email account is with Google Workspace, so Google holds those copies until we delete them (see “How long we keep your information”). We do not use a third-party form processor.

Class booking: We use Bookwhen for class bookings. When you book, your data is handled by Bookwhen according to their privacy policy at bookwhen.com/privacy.

Feedback survey: Anonymous survey responses are stored with Supabase, our database provider. No personal data is included in what we store there. See supabase.com/privacy for their policy.

Parent and Carer Needs Survey: answers, and separately the question 14 waiting list, are stored with Supabase in London. Families Together Suffolk, our partner in the survey, receives grouped results and quotes you have agreed to at question 15 — never individual answers and never the waiting list.

Hosting and analytics: This website is hosted on Vercel, and we use Vercel Analytics and Speed Insights to understand how the site performs. These measure page visits and loading speed in aggregate. They use no cookies, they are not tied to your IP address, and they cannot follow you from one page to the next or on to another website. See vercel.com/legal/privacy-policy for their policy.

Some of the providers above are based outside the United Kingdom, or store data on servers outside it. Vercel, Supabase and Google are US companies.

Where personal data is transferred outside the UK, that transfer relies on the safeguards those providers put in place in their terms, such as UK adequacy regulations or standard contractual clauses with the UK Addendum. You can ask us for more detail about any specific provider.

Under UK GDPR, you have the right to access, correct, or delete your personal data, restrict or object to processing and data portability where applicable. Where we rely on your consent, you can withdraw it at any time.

One practical limit: the feedback survey and the Parent and Carer Needs Survey do not record who submitted a response, so we have no way of finding which one was yours. That means we cannot retrieve, change or delete an individual response — it is the trade-off that keeps them anonymous. We can show, correct or delete your needs-survey waiting-list entry, because that is stored with your name.

To exercise any of these rights, email emma@startstrongfitnesscic.com.

If you are unhappy with how we have handled your personal data, please tell us. Email Emma Shaw at emma@startstrongfitnesscic.com and say what has gone wrong. You do not need to use any particular form of words.

We will acknowledge your complaint within 30 days of receiving it, and often much sooner. We will start looking into it straight away, keep you updated while we do, and tell you what we have found.

If you are not happy with our response — or if you would rather not come to us at all — you can complain to the Information Commissioner's Office. You can reach them at ico.org.uk, on 0303 123 1113, or by writing to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. You can go to the ICO directly at any point; you do not have to complain to us first.

Complaining is not the same as asking us for a copy of your data. If you want to know what we hold about you, that is a separate request — just say so and we will treat it that way.

We do not set any cookies on the pages of this site you are reading. There is no cookie banner because there is nothing to consent to.

The tools we use to measure how the site performs — Vercel Analytics and Speed Insights — do not use cookies at all. They count page views and loading speed, and Vercel does not tie that to your IP address or follow you between pages.

There is one exception. The class booking calendar on our classes page is provided by Bookwhen. Since 3 September 2026 it only loads when you choose to open it, and Bookwhen may set its own cookies from that point.

We do not use advertising or tracking cookies anywhere on this site. You can control cookies through your browser settings.

We may update this policy from time to time. The latest version will always be published on this page.

Last updated: September 2026.