Privacy Notice

Last updated: 22 October 2026

1. Who I am

This notice explains how I, Laura Cheng, collects, uses and protects your personal information when you visit my website, enquire about or book my services, or work with me as a client. I am the “data controller” for your information under UK data protection law.

Contact: info@rootebylc.co.uk

2. What information I collect

Information you give me

  • Contact details: name, email address, phone number.

  • Health and lifestyle information: health history, medical conditions, medications, symptoms, sleep, stress, energy levels, movement, goals and a 3-day food diary, collected through consultations and forms.

  • Notes and records: my notes from sessions, your personalised plan, check-in records and your Foundations Journal.

  • Payment details: billing information. Card details are handled by my payment provider, and I don’t store them.

  • Workshop information: if you’re attending a group workshop, your name, contact details and relevant event information, which may be provided by your employer or organiser.

  • Enquiries and communications: emails, messages and anything you send me.

Information collected automatically

  • Website usage data (pages visited, device and browser type, approximate location) via cookies and similar technologies. See Section 9.

Information about your health is “special category data” and receives extra protection under the law.

3. How and why I use your information

I only use your information where I have a lawful reason to do so. Here is what I use it for and why:

Responding to enquiries and arranging bookings

Lawful basis: taking steps at your request before entering a contract.

Delivering my coaching services and creating your personalised plan

Lawful basis: performing a contract with you.

Using your health and lifestyle information to design your programme

Lawful basis: your explicit consent. This applies because health information is special category data.

Taking payments and keeping financial records

Lawful basis: performing a contract with you, and meeting my legal obligations.

Sending my newsletter or marketing emails

Lawful basis: your consent. You can unsubscribe at any time.

Running and improving my website and keeping it secure

Lawful basis: my legitimate interests in operating a safe, effective business.

Handling complaints or legal claims

Lawful basis: my legitimate interests and the establishment or defence of legal claims.

You can withdraw your consent at any time (see Section 8). Withdrawing consent for health information may limit what I can safely provide.

4. Who I share your information with

I never sell your information. I only share it with trusted providers who help me run my business, and only as needed:

  • Website and hosting: Squarespace

  • Payments: [Stripe, PayPal, Squarespace Payments]

  • Email and newsletters: [Mailchimp, Substack, Squarespace Email Campaigns]

  • Video calls: [Zoom, Google Meet]

  • Forms and scheduling: [Acuity, Typeform, Google Forms]

  • Accountants and professional advisers, where necessary

  • Authorities, if required by law or to protect someone’s safety

These providers act on my instructions or under their own privacy terms. For group workshops arranged through an organisation, I do not share your individual health information with them.

5. International transfers

Some of my providers are based outside the UK (for example, in the USA). Where this happens, I make sure appropriate safeguards are in place, such as the UK International Data Transfer Agreement or the UK Extension to the EU-US Data Privacy Framework.

6. How long I keep your information

  • Client records and health information: 7 years, after which they are securely deleted.

  • Financial records: 6 years, as required by HMRC.

  • Enquiries that don’t become bookings: 12 Months

  • Newsletter subscriptions: until you unsubscribe.

7. How I keep your information safe

I use secure, password-protected systems, limit access to information, and use trusted providers. No online system is completely secure, but I take reasonable steps to protect your information.

8. Your rights

Under UK data protection law, you can ask me to:

  • Access the information I hold about you

  • Correct anything inaccurate or incomplete

  • Delete your information (in certain circumstances)

  • Restrict or object to how I use it

  • Receive it in a portable format

  • Withdraw consent at any time (for example, unsubscribing from emails using the link in each message)

To use any of these rights, email [your email address]. I will respond within one month.

9. Cookies and website analytics

My website uses cookies and similar technologies to make it work and to understand how it’s used. You can manage cookies through the banner on my site or your browser settings.

10. Important: what I am and am not

I provide lifestyle and wellbeing coaching. I am not a substitute for your GP or other medical professionals, and I do not diagnose or treat medical conditions. [DipCNM Level 5]

11. Complaints

If you have a concern about how I handle your information, please contact me first at info@rootedbylc.co.uk so I can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO): ico.org.uk | 0303 123 1113.