Privacy Notice

Who we are

Paulo Erilson Nutrition Coaching ("we", "us") provides personalised nutrition coaching. This notice explains how we handle your personal data and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

For any privacy request or question, contact your coach at the email address used to invite you to the platform.

What data we collect

We only collect data needed to deliver your coaching:

• Account details: your name, email address and encrypted password.
• Coaching data: your goals, service plan, coaching start/end dates and coach notes.
• Health & nutrition data: food diary entries, weight, body measurements, progress photos and weekly check-ins that you choose to record. Some of this is special-category (health) data, which we process on the basis of your explicit consent to receive coaching.
• Usage data: sign-in timestamps, kept to keep your account secure.

How we use your data

We use your data solely to:

• Provide and personalise your nutrition coaching.
• Let your coach review your progress, check-ins and photos.
• Send you service emails such as invitations, activation links, password resets and coaching reminders.
• Keep the platform secure and prevent unauthorised access.

Legal bases

We rely on your explicit consent for health-related data, on the performance of our coaching agreement for account and service data, and on our legitimate interest in keeping the platform secure for sign-in records.

Who can see your data

Your personal and coaching data is visible only to you and to your coach. Clients can never see one another’s data. We do not sell your data or share it for advertising.

We use trusted infrastructure providers to host the application, store files and send email on our behalf. They process data only on our instructions.

How long we keep it

We keep your data for as long as your account is active. If your coaching ends, your nutrition history is retained so it remains available to you and your coach unless you ask us to delete it. When you request deletion, we remove your personal data within 30 days, except where we must retain limited records to meet legal obligations.

Your rights

Under UK GDPR you have the right to:

• Access a copy of your data — use “Export my data” in your account settings at any time.
• Ask us to correct inaccurate data.
• Ask us to delete your data — use “Request account deletion” in your account settings.
• Withdraw consent or object to processing.
• Lodge a complaint with the UK Information Commissioner’s Office (ico.org.uk).

Security

Passwords are stored using strong one-way hashing and are never visible to anyone, including your coach. Access is protected by authenticated sessions, role-based permissions and rate limiting to guard against brute-force attempts. Progress photos and uploaded files are stored privately and served only through short-lived secure links.