1. Who I am
This website, the client area and all coaching services are run by me personally, as a sole trader.
Mary Arianne
Trading as Mary Arianne
Chamber of Commerce / business registration: 92719546
Registered in: the Netherlands
E-mail: hello@maryarianne.com
Under the General Data Protection Regulation (GDPR) I am the "controller" of your personal data. That means I decide what is collected and why, and I'm accountable for it.
2. What I collect
When you fill in a form on the website
- Your first name and e-mail address (free tracker, newsletter, contact form)
- The topic and message you write in the contact form
When you book a free call
- Name, e-mail, time zone and anything you choose to write in the booking notes
When you become a client
- Contact and billing details: full name, address, e-mail, phone number
- Payment plan chosen and payment status (I don't see or store your card or bank details; my payment provider handles those)
- Your intake questionnaire, session notes, charts and messages between us (see section 3)
When you use the client area
- Your account: name, e-mail address, and which programmes, workshops and documents you have access to
- Your progress: which steps and actions you've ticked off, and the dates of your sessions
- Your weekly check-ins: your answers (for example sleep, energy, stress, digestion and cycle symptoms) and any chart you upload
- Session recaps and your current plan, which I write for you
- If you choose to use cycle notes: the first day of your last period, your usual cycle length, and the reflections you write
- A copy of the e-mails I send you through the website, including any attachments, so you can find them all in one place
- The messages you send me, written in the client area or as a reply to one of my e-mails. I also receive each message in my mailbox (Gmail), so I don't miss it. Images and files you send me, in the client area or with an e-mail reply, are kept with the message, where only you and I can open them. Please share health information such as lab results through Whole Practice instead.
- If you buy online: what you bought, the payment option and the payment status
The client area doesn't hold your health questionnaire, journals or test results. Those go to Whole Practice (see section 4).
Automatically
- Basic technical data when you visit the site: IP address, browser and the page requested, in the server logs of my hosting provider. See section 10 for cookies.
3. Health and cycle data
To coach you I need to know about your cycle, your symptoms, your contraception history and often your wider health. You share this in the intake questionnaire, in sessions, in charts and in messages between sessions.
I only process this data with your explicit consent.
You give that consent when you sign the coaching agreement at the start of a programme, and you can withdraw it at any time by e-mailing me. If you withdraw, I stop processing and delete the data, except where I'm legally required to keep part of it (see section 6, How long I keep it).
Your health data is:
- Used only to coach you. Never for marketing, never for profiling, never sold or shared with anyone for any other purpose.
- Stored in the tools listed in section 4, and nowhere else. Not in my personal phone notes, not in unencrypted spreadsheets.
- Never used in testimonials, examples or content without your separate, written permission for that specific use.
If you chart in the Read Your Body app and choose to share your charts with me, Read Your Body's own privacy policy also applies to what happens inside the app. I only see what you share.
4. Where your data is stored
I use a small number of tools to run my practice, and your data lives only in these:
- Whole Practice: intake forms, health questionnaires, client onboarding, and documents you upload, such as food journals and blood test results
- DocuSeal: signed agreements and consent forms
- Notion: coaching notes, protocols, client records
- Gmail: e-mail communication
- Google Drive: documents and files shared with or about clients
- Google Calendar and Cal.com: booking calls and sessions. When you book through Cal.com, the date, time and meeting link of your booking are also shown in your client area.
- Granola: if you agree to it in your coaching agreement, notes and a transcript of our online sessions, which I use to write your session recap
- Anthropic (Claude): when I use a session transcript to draft your recap, the transcript is sent to Anthropic's Claude API to write a first version, which I then check and edit. It is not stored in the client area, and under Anthropic's commercial terms it is not used to train their models. Anthropic is based in the United States; the transfer is covered by the EU Standard Contractual Clauses.
- Cloudflare: hosts this website and the client area, including your weekly check-ins, session recaps, plan and messages. The client area's database is stored in the European Union.
- Resend: sends the e-mails from this website (login links, access e-mails, messages and programme e-mails) and receives your replies to them, which it keeps for up to 30 days
- Stripe: online payments. Stripe handles your card or bank details; I never see them.
- ConvertKit: newsletter and e-mail list management
Each of these providers processes data on my behalf under a data processing agreement. Some of them are based in the United States. Where data leaves the European Union, it's protected by the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
5. Why I use your data, and on what legal basis
Replying to your message or booking: I use your name, e-mail, and message, based on legitimate interest (answering you).
Sending a free product and occasional e-mails: I use your first name and e-mail, based on your consent (you signed up; you can unsubscribe any time), and where relevant, contract and legal obligation (tax law).
Delivering coaching, programmes and workshops, including the client area: I use your contact details, intake, notes, charts, check-ins and messages, based on our coaching agreement (contract) plus your explicit consent for health data.
Invoicing and payments: I use your name, address, payment plan, and invoices, based on contract and legal obligation (tax law).
Keeping the website running and secure: I use technical data, based on legitimate interest.
Logging in to the client area: I use your e-mail address, your (encrypted) password and a login cookie, based on our agreement (contract), because you can't use the client area without it.
6. How long I keep it
Contact form messages: kept for up to 12 months after our last exchange, then deleted.
Newsletter and tracker sign-up: kept until you unsubscribe, which you can do with one click at the bottom of every e-mail.
Booking data for the free call: kept for 6 months if you don't become a client.
Coaching records (intake, notes, charts, messages): kept for 2 years after the programme ends, deleted earlier on request.
Client area account, our messages and the copies of my e-mails in it: kept as long as you're a client and up to 2 years after your programme ends, like your coaching records. You can ask me to delete it sooner.
Login links and login sessions: login links work once, expire after 30 minutes and are deleted within a day. You stay logged in for up to 30 days, or until you log out; after that the session is deleted.
Invoices and payment records: kept for 7 years, because tax law requires it.
7. How it's protected
- All tools I use are password-protected with two-factor authentication where available.
- This website uses HTTPS. Forms are transmitted encrypted.
- You log in to the client area with your e-mail address and your own password. Your password is stored only in encrypted form (a salted hash); nobody, including me, can read it. After several wrong attempts, logging in is paused for 15 minutes. Documents, recordings and e-mail attachments are only shown to you, and I can remove access at any time.
- Session notes and health data are stored only in the tools listed above, never on unencrypted devices or in shared documents.
- I'm the only person with access. I have no employees and don't outsource client work.
- If a breach ever affects your data, I'll tell you and the supervisory authority within 72 hours, as the GDPR requires.
8. Your rights
You can, at any time:
- See what data I hold about you (access)
- Correct anything that's wrong
- Delete your data, except what I must keep by law
- Restrict or object to how I use it
- Take it with you in a readable format (portability)
- Withdraw consent for health data or e-mails, without affecting anything before that
E-mail hello@maryarianne.com and I'll respond within one month. I may ask you to confirm your identity first, so I don't hand your data to someone else. There's no charge.
9. Changes to this statement
If I change tools or the way I work, I'll update this page and the date at the top. For anything significant, clients get an e-mail.
10. Cookies
This website doesn't use analytics, advertising or tracking cookies, so there's no cookie banner.
The only cookie is a functional one that keeps you logged in to the client area. It's set when you log in, can't be read by other websites, and is removed when you log out or when the session ends.
11. Questions and complaints
Ask me first: hello@maryarianne.com. I'd rather fix something than have you worry about it.
If you're not satisfied with my answer, you have the right to complain to the data protection authority in your country. In the Netherlands, that is the Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl.