Last updated: August 2026

I am Kate Oakley, a sole trader trading as Kate Oakley PT and Thrive in 5.

I take your privacy seriously and only collect and use personal information where I have an appropriate reason to do so.

This Privacy Policy explains what information I collect, how I use it and your rights.

For data-protection purposes, I am the data controller for personal information I determine how and why to use.

You can contact me at:

kate@kateoakley.com

1. Information I may collect

Depending on how you interact with me, I may collect:

• Contact and account information, such as your name, email address, telephone number and account details.
• Booking and transaction information, including services booked, appointment history, attendance and payment status.
• Fitness and coaching information, including goals, exercise history, progress, measurements, check-ins and programme information.
• Health information, where relevant, including injuries, medical conditions, medication, pregnancy/postpartum information, symptoms, birth/recovery information and answers to health-screening questionnaires.
• Nutrition information, including food diaries, dietary preferences and information you provide during nutrition coaching.
• Communications, including emails, messages, forms and feedback.
• Technical information, such as IP address, device/browser information and website usage information.
• Marketing preferences, including whether you have chosen to receive marketing communications.
• Photographs and video, where you have separately agreed to their use.

 

The ICO classifies health information as special-category personal data, which receives additional protection.

2. Why I use your information

I may use personal information to:

• Provide services you have purchased or requested
• Manage appointments and class bookings
• Create and manage training or coaching programmes
• Assess exercise suitability and make appropriate adaptations
• Communicate with you about your service
• Process payments
• Manage memberships and accounts
• Maintain appropriate business and financial records
• Respond to enquiries
• Improve my services
• Protect my business and establish or defend legal claims
• Send marketing where you have chosen to receive it
• Analyse use of my website where you have permitted relevant cookies or tracking technologies

The ICO requires organisations to explain both their purposes for processing and the relevant lawful bases in their privacy information.

3. My lawful bases

Depending on the circumstances, I may rely on:

• Contract — where using your information is necessary to provide a service you have purchased or requested.
• Legal obligation — where I need to retain or use information to comply with the law, including relevant tax and accounting requirements.
• Legitimate interests — where reasonably necessary to operate, protect or improve my business and those interests are not overridden by your rights and interests.
• Consent — where I ask you to make a genuine choice, including marketing, certain cookies/tracking technologies and promotional photography.

4. Health and other special-category information

Information concerning health is classed as special-category personal data.

Where I need health information to assess your suitability for exercise, safely adapt services or provide personalised coaching, I will ordinarily rely on:

An appropriate Article 6 lawful basis for the underlying processing; and
your explicit consent under Article 9(2)(a) UK GDPR to process relevant health information.

You may withdraw that consent by contacting me.

However, if the information is necessary for me to safely provide a particular service, withdrawing consent may mean I can no longer provide that service.

In limited circumstances, another lawful special-category condition may apply, for example where information is necessary for the establishment, exercise or defence of legal claims.

I aim to collect only health information that is relevant and necessary for the service being provided.

UK GDPR requires both an Article 6 lawful basis and an Article 9 condition when special-category information is processed.

5. Marketing

I will not automatically add you to my marketing list simply because you purchase or enquire about a service.

Where consent is required, you will be asked to actively choose whether you would like to receive marketing from me.

Marketing communications may include information about fitness, nutrition, classes, Thrive in 5, services, resources and business updates.

You can unsubscribe at any time using the unsubscribe option in an email or by contacting me.

6. Who I share information with

I use trusted third-party providers to operate my business. Depending on the services you use, these may include:

• Google Forms and Google Drive – Booking, feedback and health forms
• Bookwhen  class booking
• Calendly and/or Google Calendar – appointment scheduling
• Stripe – payment processing
• Trainerize – online coaching
• Uscreen – Thrive in 5 membership and digital content
• Mailchimp – email marketing
• Google Workspace and Google Drive – business communications and storage
• Google Analytics – website analytics, subject to applicable consent requirements
• Meta / Instagram – social media and, where used, advertising or analytics
• WordPress and Simply.com – My website, hosting and content-management providers
• Professional advisers, insurers, accountants or legal advisers where necessary

These providers may process information on my behalf or, in some circumstances, operate as independent data controllers.

I do not sell your personal information.

7. International transfers

Some service providers I use may process information outside the UK.

Where UK data-protection law requires safeguards for an international transfer, I will rely on an appropriate transfer mechanism or safeguards provided by the relevant service provider.

8. How long I keep information

I retain information only for as long as reasonably necessary for the purpose for which it was collected, including legal, tax, insurance and professional requirements.

Different information may therefore have different retention periods.

I periodically review information and securely delete or anonymise information that I no longer need.

9. Security

I take reasonable technical and organisational measures to protect personal information.

However, no internet-based system can be guaranteed to be completely secure.

10. Your rights

Depending on the circumstances, UK data-protection law may give you rights to:

• Be informed about how your information is used
• Access personal information held about you
• Correct inaccurate information
• Request deletion
• Restrict certain processing
• Object to certain processing
• Receive certain information in a portable format
• Withdraw consent where processing relies on consent

To exercise your rights, contact kate@kateoakley.com.

You also have the right to complain to the Information Commissioner’s Office (ICO) if you are unhappy with how your information has been handled.

11. Children

My paid services are purchased by adults aged 18 or over.

Babies or children may attend designated parent-and-baby sessions, but I do not intentionally collect information directly from children unless necessary and appropriate. 

Where photographs or video of a child may be used for promotional purposes, separate permission will be sought from their parent or legal guardian.

12. Changes

I may update this Privacy Policy when my business, services or legal requirements change.

The current version will be published on my website.

13. Contact

For privacy questions or requests:

Kate Oakley
kate@kateoakley.com