Privacy Policy
Josh Ricketts Coaching
Last updated: 28 August 2026
1. Who we are
Josh Ricketts Coaching ("we," "us," "our") is a sports therapy, strength & conditioning, and personal training business operating in Swindon, UK.
We are the data controller for the personal data described in this policy.
- Business name: Josh Ricketts Coaching
- Contact: info@joshrickettscoaching.co.uk
If you have any questions about this policy or how we handle your data, contact us at info@joshrickettscoaching.co.uk.
2. What personal data we collect
Depending on how you interact with us, we may collect:
When you visit our website:
- Technical data (IP address, browser type, device, pages viewed)
- Cookies and analytics data (see our Cookie Policy)
When you use our contact or booking forms:
- Name
- Email address
- Phone number
- Reason for enquiry (which may include information about an injury or health condition)
When you become a client:
- All of the above, plus:
- Date of birth
- Address
- Emergency contact
- Payment information (processed by our payment provider — we do not store card details)
When you receive sports therapy or coaching:
- Special category health data, including: medical history, injury history, medications, treatment records, assessment notes, progress notes, photographs or video (only where you have given specific consent)
When you subscribe to our newsletter:
- Name and email address
3. Why we collect it and our lawful basis
Under UK GDPR we must have a lawful basis for processing your data. Ours are:
| What we use your data for | Lawful basis |
|---|---|
| Responding to enquiries | Legitimate interests (responding to you) |
| Providing sports therapy, coaching or training | Contract (delivering the service you booked) |
| Handling your health data as part of treatment | Explicit consent (Article 9(2)(a)) plus provision of healthcare (Article 9(2)(h)) |
| Sending appointment reminders | Contract |
| Sending marketing emails | Consent (you can withdraw at any time) |
| Taking and storing payment | Contract + legal obligation (tax records) |
| Keeping clinical records | Legal obligation + legitimate interests (defence of legal claims, continuity of care) |
| Website analytics | Consent (via cookie banner) |
4. Who we share your data with
We share your data only with the following categories of recipient, and only to the extent necessary:
- Squarespace — website hosting and forms (US-based; see international transfers below)
- Our booking platform — appointment scheduling
- Our payment processor — payment processing (we do not store card details)
- Our email marketing tool — newsletter delivery (only if you subscribe)
- Our accountant / bookkeeper — financial record keeping
- HMRC — where legally required
- Your GP or other healthcare providers — only with your explicit consent, e.g. if a referral or shared care is appropriate
- Insurers or legal advisers — only where necessary for a legal claim
We do not sell your data to anyone, ever.
5. International transfers
Some of our providers (including Squarespace and, where used, US-based email tools) store data outside the UK/EU. Where this happens, we rely on appropriate safeguards including the UK International Data Transfer Agreement or the EU Standard Contractual Clauses to ensure your data is protected to UK GDPR standards.
6. How long we keep your data
| Type of data | Retention period |
|---|---|
| Website enquiries (no booking made) | 12 months |
| Client contact and booking records | Duration of the client relationship + 7 years (HMRC requirement) |
| Clinical records (adults) | 8 years from the last appointment (in line with Society of Sports Therapists / professional indemnity requirements) |
| Clinical records (under-18s) | Until the client's 25th birthday, or 26th birthday if aged 17 at last appointment |
| Marketing consents / newsletter records | Until you unsubscribe, plus a suppression record to ensure we don't accidentally email you again |
| Financial records | 7 years (HMRC requirement) |
| Website analytics | Aggregate data retained per Google Analytics standard retention (currently 14 months) |
After these periods, we securely delete or anonymise your data.
7. Your rights
Under UK GDPR you have the right to:
- Access — ask for a copy of the personal data we hold about you
- Rectification — ask us to correct inaccurate data
- Erasure — ask us to delete your data (subject to legal retention requirements, e.g. clinical records)
- Restriction — ask us to pause processing of your data
- Portability — ask for a copy of your data in a portable format
- Object — object to processing based on legitimate interests, including direct marketing
- Withdraw consent — where we rely on consent, you can withdraw it at any time
To exercise any of these rights, email us at info@joshrickettscoaching.co.uk. We will respond within one calendar month.
If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk/concerns or on 0303 123 1113.
8. How we protect your data
We take reasonable technical and organisational measures to protect your data, including:
- Encrypted storage of clinical records
- Password-protected devices
- Secure, reputable third-party providers
- Regular review of who has access to what
- Immediate notification to the ICO and affected individuals in the unlikely event of a breach
9. Cookies
Our website uses cookies. Full detail is in our Cookie Policy.
10. Children's data
We do not knowingly collect data from anyone under 16 without parental consent. If you are under 18 and want to work with us, a parent or guardian must book on your behalf and provide consent for treatment.
11. Changes to this policy
We may update this policy from time to time. The date at the top of this page will reflect the most recent update. Material changes will be communicated by email to current clients.
12. Contact
For any question about this policy, your data, or to exercise any of your rights:
Email: info@joshrickettscoaching.co.uk
This policy is written in plain English on purpose. If any of it is unclear, get in touch and we'll explain.