Privacy policy

01Data controller

The data controller is [REAL: full name or company name], [REAL: address], VAT no. [REAL], trading as Coach Elyy.

For any question about your data, write to [REAL: contact email].

02What I collect

• Contact details: name, email and WhatsApp number, which you give me in the forms or at checkout.
• Payment details: payment happens on Stripe. I receive your name, email, billing address, any VAT number and the payment result. I never see or store your card details.
• Questionnaire data: age, sex, height, weight, goals, training experience, work, sleep and activity habits, diet, allergies and intolerances, supplements.
• Health data: any medical conditions, medication, blood tests and injuries you choose to share in the questionnaire. These are “special categories of data” under Article 9 GDPR.
• Photos: the front, side and back photos you upload to assess your starting point and progress.
• Messages: what you send me by email or WhatsApp during the program or for the video consultation.
• Technical data: IP address and browser data logged automatically by the servers hosting the site, for security and operation.

03Why I use it, and on what basis

• To provide the service you bought — writing your program and meal plan, the check-ins and the video consultation: performance of a contract (Art. 6.1.b GDPR).
• To use your health data and photos: your explicit consent (Art. 9.2.a GDPR), given with the checkbox in the questionnaire. Without this data I cannot build a safe plan tailored to you.
• For tax and accounting obligations tied to payments: legal obligation (Art. 6.1.c GDPR).
• To answer your questions before you buy: pre-contractual steps (Art. 6.1.b GDPR).
• For site security and to defend my rights in a dispute: legitimate interest (Art. 6.1.f GDPR).

I do not use your data for advertising, I do not sell it and I do not profile you. I only publish a client’s photos, videos or words with their separate written consent, which can be withdrawn at any time.

04Who I share it with

Your data is handled by me and, only as far as the service requires, by:

• The registered nutritionists who prepare your meal plan: Dr Andrea Lagonigro (all coaching plans). They receive the questionnaire data the plan needs. [CONFIRM: their privacy role — processors under a written agreement, or independent controllers.]
• Stripe Payments Europe Ltd., for payments.
• Tally BV (Belgium), which hosts the forms and the questionnaire.
• Vercel Inc., which hosts the site.
• WhatsApp Ireland Ltd. (Meta), if we talk on WhatsApp.
• [REAL: email provider, e.g. Google Workspace], for email.
• My accountant, for tax compliance.

Some of these providers may process data outside the European Economic Area, notably in the United States. Where they do, the transfer is covered by the EU-US Data Privacy Framework or by the European Commission’s standard contractual clauses.

05How long I keep it

• Questionnaire, health data and photos: for the length of your program and [CONFIRM: 12] months after it ends, so you do not start from zero if you come back. Then I delete them. You can ask me to delete them sooner.
• Payment and invoicing records: 10 years, as Italian law requires (Art. 2220 of the Civil Code).
• Enquiries without a purchase, and messages: 12 months from the last contact.
• Technical data: as long as the hosting providers technically need, usually a few days.

06Your rights

At any time you can ask me to:

• access your data and get a copy;
• correct or complete it;
• delete it;
• restrict its use, or object to it;
• receive it in a machine-readable format (portability);
• withdraw your consent for health data and photos. Withdrawal does not affect the past, but without that data I can no longer personalise your program.

Just write to [REAL: contact email]; I reply within 30 days. If you believe your data is being handled unlawfully you can complain to the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or to the authority where you live.

07Cookies

This site uses no profiling, analytics or advertising cookies, so it needs no cookie banner. When you go to checkout on Stripe or fill in a form on Tally, those services may set their own technical cookies on their pages, under their own policies.

08Minors

The services are for people aged 18 and over. [CONFIRM] I do not knowingly collect data from minors; if it happens, I delete it as soon as I notice.

09Changes

If I change how I handle data, I update this page and the date at the top. For significant changes I email anyone with a program in progress.