This privacy notice explains what I do with your personal information, why I need this information, and what rights you have. I am the data controller, which means I am responsible for the personal information you share with me and what happens to it.
I am David Keens, a self-employed yoga teacher. You can reach me about anything in this privacy notice at contact@davidkeens.yoga.
The short version. I ask for your contact details, an emergency contact and some health information, so I can teach you safely and reach someone if something goes wrong. I keep it in an encrypted database that only I can sign in to. Nobody else sees it unless there is an injury or a claim. I keep it for seven years after your last class. You can ask me for a copy, or to correct or delete it, any time. Just email me.
You will be asked to complete a ‘new practitioner form’ before your first practice. This could be a paper or online form (both record the same information). This form asks for:
If you fill in a paper form, I type it into the same database, check what I typed against your sheet, and then shred the sheet. Until it is shredded it is treated as the health record it is.
If you are under 18, the last section of the same form also asks for your year of birth, and for a parent or guardian's name, their relationship to you, their emergency contact details, and whether you travel to the studio on your own or are brought and collected by a named adult.
I keep a register: your name, the date and time you signed in for each practice you come to, and sometimes a short observation about that practice (as requested by my insurer). Those observations may mention something about your health, such as an injury you told me about, or a modification we made. You can ask to see these notes whenever you like.
In the event of an accident, I will record your contact details and the specific details or nature of the injury or accident in a standard accident book.
I may hold photographs or video of classes that include you, but only if you have said you're happy with this.
I may store email correspondence, text messages and other electronic communications between us. Your name and contact details are also in my phone's contacts, which sync to an encrypted Apple iCloud account.
I maintain a WhatsApp community, where I share information about classes, times, changes, the occasional workshop, and other things that support your practice. Anything there is governed by WhatsApp's own policies. You add yourself by scanning the QR code in the studio, you can ask me to add you, or someone already in the community can add you. It is entirely optional, you can leave it at any time, and nothing about your practice depends on it.
There are no analytics on this website, no tracking, and no cookies are set. Nothing about you is recorded by me for reading a page. My host keeps ordinary server logs, which include the address your device connects from, for security and to keep the site running.
Giving me your information is not a legal requirement, but I cannot teach you without your contact details, an emergency contact and the requested health information, because without this information I could not keep you safe or reach anyone if something went wrong.
I never sell your information and I never share it for marketing. In the ordinary course of teaching you, nobody but me sees your form or your health answers. There is one exception: if you are under 18, your parent or guardian reads your health answers and signs to say they agree they are accurate.
Three situations do involve someone else seeing your details:
Apart from those, and from any photographs you have agreed to, your details go no further, except where the law requires it.
Your form and your health answers are held in an encrypted database that only I can sign in to. One thing is on paper: I print a sheet of names and phone numbers to keep in the studio, so I am not unlocking a phone to find your emergency contact in a hurry. It has no health information on it, and if you are under 18 it names your parent or guardian and anyone who collects you.
Cloudflare hosts this website and stores online registrations. The database sits in western Europe and is not copied to other regions, but Cloudflare is a US company whose staff may reach it for support, so transfers are covered by Cloudflare's Data Processing Addendum, which carries the UK International Data Transfer Addendum. Ask me and I will send you a copy.
Apple provides my devices, my email and my contacts. This is an ordinary consumer iCloud account, which does not come with a data protection contract of the kind the law provides for. That is exactly why I keep as little there as possible: anything about your health that reaches me by email is copied into your record and the message deleted.
WhatsApp is run by Meta, which is a data controller in its own right for your account and for the service itself. That part is governed by Meta's own privacy policy, not by this notice. I am the controller only for my decision to run the community and for what I post in it.
If you have been to a class, I keep your information for seven years after your last one. If you filled in the form but never came, I keep it for six months from the day you filled it in.
If you were under 18 when you attended, I keep your information at least until the end of the year in which you turn 25 (as a requirement of my insurance). I hold your year of birth to calculate this.
If someone reports an injury or makes a complaint, I keep the relevant records until that is fully resolved, and then for seven years from the date it was resolved.
An entry in my accident book is kept for seven years from the day it was written, or, if the person was under 18 at the time, until the end of the year they turn 25. That runs whether or not anything is ever claimed, and whether or not the person practises with me.
Where more than one of these applies to you, the longest of them is the one that runs.
Emails and messages are treated differently from your registration. Anything you send me about your health is copied into your record and the message itself deleted. Everything else is kept for seven years, the same as your registration. If a message bears on a claim or a complaint I keep it until that is resolved, and for seven years after. Your contact details in your registration are kept on the timetable above, not this one.
WhatsApp messages stay in the community until they are deleted. If you leave, you stop appearing in it, though messages you have already posted may remain visible to the people who were there. I cannot remove those for you.
You can ask me to delete your information at any time. If I need to keep any of your information , for example a legal obligation to keep records of an accident, then I will tell you where this applies.
Someone who practises with me has given me your name and phone number so I can reach you if they are taken ill or injured. That is all I hold about you, it came from them rather than from you, and I will not use it for anything else. I keep it for as long as I keep their record. See ‘How long I keep your information’ above. You can ask me what I hold, ask me to correct it, or ask me to take you off, and I will: email contact@davidkeens.yoga. The same applies if you are the adult named as bringing or collecting a young person.
You can ask me to:
Where I rely on your consent, you can withdraw it at any time, and that does not affect anything done before you withdrew it. Just email me. There is no charge. I will reply within one month. If your request is complicated, or you have asked for several things at once, I may need up to two months longer. I will tell you inside the first month if that happens, and why. If I am not sure who you are, or I need you to be more specific about what you want, I will ask, and the month starts when you answer.
When you ask me for one of these, I write down what you asked for and what I did about it, so there is a record that it was dealt with. That note holds the request and the date, not a second copy of your information.
If you are unhappy with how I have handled your information, you have the right to complain to me. Email contact@davidkeens.yoga, saying what has gone wrong. I will acknowledge your complaint within 30 days of receiving it, and respond without undue delay. You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk/make-a-complaint. You do not have to come to me first.
No decision about you is made by a computer alone in a way that has legal or similarly significant effects. Two things do happen automatically, and it is fairer to say so: your records are deleted by a scheduled job once they fall outside the periods above, and at the sign-in screen the name you type is matched against the register so you can confirm which record is yours.
If I change how I handle information, I will update this page. The version and date at the bottom tell you which one you are reading. If the change is significant I will email everyone whose details I hold, and post in the WhatsApp community as well. Telling you your privacy notice has changed is not marketing, so I will do it whether or not you are in the community.