Privacy Policy
Last updated: 22 July 2026 · ICO registration number: ZC200957
This policy explains what personal information Sorrel Lucy ADHD Coaching collects, why, and what your rights are. If you have any questions about this policy or how your data is handled, please do not hesitate to contact me.
1. Who I am
I am Sorrel Lucy Shalet, trading as Sorrel Lucy ADHD Coaching, a sole trader business based in Brighton, East Sussex. “Sorrel Lucy ADHD Coaching” is a trading name only; there is no separate company. For data protection purposes, I, Sorrel Lucy Shalet, am the “data controller”, the person legally responsible for deciding how and why your personal data is used. This policy applies to data collected via my website at sorrellucy.co.uk, as well as through our direct interactions.
Contact: sorrel@sorrellucy.co.uk
2. What information I collect
I collect different information depending on how we’re in touch:
- Website contact form: your name, email address, and whatever you write in the message.
- Booking tool (Google Calendar appointment scheduling): your name, email address, any information you share in the ‘Please share anything that will help prepare for our meeting’ box and the date/time you book, when you schedule a discovery call or session.
- Email: your name, email address, and the contents of our correspondence.
- Coaching clients: the above, plus information you share during our work together, such as your ADHD diagnosis or assessment status, health and wellbeing information relevant to coaching (sleep, nutrition, stress, etc.), coaching goals, and session notes.
- Feedback forms: your feedback and, if you choose to give one, a testimonial and permission to use it.
- Corporate clients: business contact details (name, role, company, email) for the person commissioning training or consultancy.
- Employees of corporate clients: where I deliver training, coaching, or consultancy to a business’s staff, I may process attendee lists, feedback forms, or (for 1:1 employee coaching) health-related information. In this context, the employer is the data controller and I act as a data processor on their instructions, under a separate agreement with that business.
I do not use cookies or website analytics that track you personally beyond basic, anonymous website traffic data provided by my website host. If this changes, this policy will be updated.
3. Special category data: health information
Information about your ADHD, mental health, or related health matters counts as “special category data” under UK GDPR, which has extra legal protection. I only collect this where you choose to share it as part of coaching, and I rely on your explicit consent to process it, given when you sign your coaching agreement, which references this privacy policy, and confirmed at the start of our work together. You can withdraw this consent at any time by emailing me, though this may affect my ability to continue coaching you.
4. Why I use your information, and my legal basis
| What I use it for | Legal basis |
|---|---|
| Responding to enquiries and booking discovery calls | Legitimate interest: you’ve asked me to get in touch |
| Delivering 1:1 coaching sessions | Contract: necessary to provide the service you’ve paid for |
| Processing health/ADHD-related information during coaching | Explicit consent |
| Invoicing and record-keeping | Legal obligation (UK tax law) and legitimate interest |
| Corporate training and consultancy | Contract with the commissioning organisation |
| Displaying testimonials (with your permission) | Consent |
| Keeping in touch about future sessions | Legitimate interest, or consent where required |
5. Where your information is stored
Your information is stored securely using:
- Google Workspace: email, calendar and appointment scheduling, documents, and a password-protected client tracking spreadsheet in Google Sheets, accessible only to me
Everything above sits within the same Google Workspace account, there’s no separate third-party scheduling tool or spreadsheet provider involved. These services may store data on servers outside the UK, but Google Workspace has its own GDPR compliant safeguards in place. I don’t sell, rent, or share your personal data with third parties for marketing purposes, and I don’t use any mailing list or marketing software.
5.1 Data Security
I take the security of your personal data seriously. I use strong passwords, two-factor authentication on all relevant accounts (Google Workspace), and keep my devices updated with the latest security software.
6. How long I keep your information
- Coaching client records (including session notes): kept for the duration of our work together, plus 7 years afterwards, in line with standard professional and insurance practice.
- Financial records (invoices, payments): kept for 7 years, as required by HMRC.
- Enquiries that don’t become bookings: deleted after 12 months of inactivity.
- Testimonials: kept until you ask me to remove them.
7. Your rights
Under UK GDPR, you have the right to:
- Ask what personal data I hold about you, and get a copy of it
- Ask me to correct anything inaccurate or incomplete
- Ask me to delete your data (subject to my legal obligations to keep some records, e.g. for tax)
- Withdraw consent at any time, where consent is the basis for processing
- Object to processing based on legitimate interest
- Ask for your data in a portable format
- Complain to the Information Commissioner’s Office (ICO) if you think I’ve handled your data incorrectly: ico.org.uk
To exercise any of these, email sorrel@sorrellucy.co.uk. I’ll respond within one month.
8. Social media
If you message me via Instagram (@sorrellucyadhd) or LinkedIn, I’ll handle that in the same way as email. Your name/handle and message content are used only to respond to you, and deleted if it doesn’t lead to further contact.
Instagram and LinkedIn are separate platforms with their own privacy policies. When you visit or interact with my profile there, Meta (Instagram) or LinkedIn are the data controller for that platform, not me, I don’t control their cookies or tracking. This policy covers my website and any direct communication with me; it doesn’t cover what those platforms do with your data more broadly.
If you send me a testimonial via DM rather than the feedback form, I will not publish or share it without obtaining your separate, explicit written confirmation via email.
9. Children
My services are for adults. I don’t knowingly collect personal data from anyone under 18.
10. How to complain
If you have any concerns about our use of your personal data, you can make a complaint to
me, using the contact details at the top of this privacy policy.
If you remain unhappy with how we’ve used your data after raising a complaint with me, you
can also complain to the Information Commissioner’s Office (ICO).
The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
Website: https://www.ico.org.uk/make-a-complaint
11. Changes to this policy
I’ll update this page if how I handle your data changes, and update the date at the top. For anything major, I’ll let existing clients know directly.