Privacy & health information Version · 2026-09-29-v1 Who looks after your information Origin Project Performance Ltd, trading as Dr Sean Aspinall, is responsible for the personal information described here (the data controller). Company number 13566975; registered office: 34 Burdons Close, Wenvoe, Cardiff, CF5 6FE, United Kingdom. Contact origin_project@outlook.com for privacy questions or requests. What we collect and why Orders and contact details: your name, email, selected tier, payment status, purchase reference and billing information needed to provide coaching, manage payments and respond to you. The usual lawful basis is taking steps at your request or performing our contract (UK GDPR Article 6(1)(b)); accounting obligations use Article 6(1)(c). Your athlete profile: age, height, weight, sport, training, competition details, food preferences, routines and relevant health information. This helps Sean assess suitability and build or adjust your plan. Health and other sensitive details: allergies, intolerances and information that reveals health, as well as any religious dietary requirements you choose to share. We ask for your explicit consent to use these details for suitability assessment and personalised coaching (Articles 6(1)(a) and 9(2)(a)). Service communications: profile links, coaching messages, check-ins, support requests and necessary records of consent. These support delivery and accountability. We may retain limited records for our legitimate interests in resolving disputes or legal claims; sensitive information is retained for legal claims only where Article 9(2)(f) applies. Security information: technical logs, connection details and access records used to prevent unauthorised access and keep the service working. This is our legitimate interest under Article 6(1)(f). Give accurate information and only share health details relevant to your coaching. Do not include another person’s confidential information. We do not make solely automated decisions about your health or eligibility for coaching. Your choice about health information The athlete form asks you separately to consent to Sean using your health information to assess suitability and personalise your coaching. It is not marketing consent and is not a waiver of your rights. You can decline or withdraw that consent at any time by emailing us. Withdrawal does not undo processing already lawfully carried out. We will stop processing based on that consent and explain whether we can continue safely with less information or another arrangement. Where the service cannot be safely provided, we will discuss cancellation and the refund policy; withdrawal does not automatically forfeit payment. Information no longer needed will be deleted or anonymised, unless a specific legal obligation or legal-claims need justifies keeping a limited record. We will explain any such exception. Who receives it Sean uses your profile to deliver coaching. Access to completed profiles is restricted; ordinary notification emails should direct Sean to the private worklist rather than contain your health answers. Cloudflare: website and profile hosting, database storage and protected coach access. Stripe: payment processing, receipts and subscription records. Card details are handled by Stripe; do not put medical information into payment fields. Zapier and AWeber: where connected, limited contact, purchase, tier and onboarding-status information to deliver service emails and reminders. Your completed health questionnaire is not sent to these marketing/automation lists. Microsoft Outlook and, where used for coaching, WhatsApp: communications you choose to send through these services. Keep sensitive detail to what is necessary; the private profile is the preferred place for your questionnaire. Providers may act as processors on our instructions or, for parts of their own services, independent controllers. We may also share limited information with professional advisers or authorities where necessary and lawful. We do not sell athlete profiles or share them with sponsors, teams or other athletes without a separate lawful basis. Some providers process information outside the UK. Where an international transfer requires safeguards, the applicable arrangements must use an adequacy decision or approved contractual safeguards, with additional measures where needed. Contact us for details of the safeguards relevant to your information. How long we keep it We keep information only while it is needed for its stated purpose. Active profiles and check-ins are kept for your coaching. After coaching ends, we review whether any part is still needed for an agreed follow-up, a complaint, a legal claim or a relevant insurance requirement; information without a continuing need is deleted or anonymised. Financial records follow applicable accounting and tax retention requirements and need not include your health answers. Consent records are kept while we rely on the consent and for any necessary accountability or claims period. Security logs follow the service provider’s relevant settings. We review retention when coaching closes, when consent is withdrawn and when a dispute is resolved. Ask us for the retention criteria applying to your record. Emails and website storage Necessary purchase, onboarding and coaching emails are separate from optional marketing. If you request the Five Free Recipes book and nutrition emails, AWeber uses your supplied name and email for that signup. You can unsubscribe from marketing at any time without ending your coaching. Purchasing a plan does not automatically opt you into marketing. The website uses local browser storage to remember your basket’s tier and payment choice; it does not store your athlete answers there. Payment, email signup and secure sign-in services may use their own essential cookies. Any optional analytics or advertising added later will need an appropriate notice and consent control before use. Your rights and questions You can ask to access or correct your information, and, where applicable, request deletion, restriction or portability. You can object to processing based on legitimate interests and withdraw consent as explained above. We normally respond to a rights request within one month; if a lawful extension is needed, we will explain it. We may need to verify your identity securely. Email origin_project@outlook.com. You can also complain to the UK Information Commissioner’s Office, or the relevant authority where you live. We will update this notice when the way we handle information changes and tell you about significant changes where appropriate. The date and version above identify this notice.