Legal
Client Privacy Notice
This notice explains what happens to your information when you work with me: what I collect, why, who else handles it, and how long I keep it. It applies from the moment you buy.
In your health intake form, I ask for your consent to use your health information. This notice is what that consent refers to, so please read it before you tick the box.
Some details apply to all my privacy documents: who I am, how your information is kept secure and transferred, your rights, and how to complain. They live in my Privacy Policy, sections 1 and 10 to 15. I point to them here rather than repeat them, so the two documents never say different things.
1. Who this notice is for
Anyone who has bought something from me, and anyone whose partner has bought a Decoding Session for them.
Most of it is about health information, because most of my work involves it. If what you bought doesn’t ask you for your health history, those parts simply don’t apply to you.
2. What I collect
- When you pay: your name, email address, billing details and what you bought. Payment is handled by ThriveCart and Stripe, and your card details never reach me.
- In your health intake form: your contact details and preferred language, and your health history: your goals, medical history, each body system, your reproductive health, what you eat, and how you live.
- What you upload: blood test results, scans, a semen analysis, and any other tests you choose to share, including anything you upload later through the lab upload form.
- Your booking: the date and time you choose.
- Your session: it’s recorded and transcribed (section 8).
- My clinical notes, written before and after your session.
- Your Decoding Map.
- What you write to me by email about your care.
- The version of my Terms & Conditions you accepted, recorded on your client file.
3. Why I use it
- Your explicit consent (GDPR Article 9(2)(a)) covers everything I do with your health information: reading your form and results, preparing for your session, the session itself, my notes, your Decoding Map, and the AI-assisted work described in section 7.
- Our contract (Article 6(1)(b)) covers taking your payment, sending your booking link, emailing you about your service, and delivering your Decoding Map.
- Legal obligation (Article 6(1)(c)) covers keeping invoices and accounting records.
- Legitimate interests (Article 6(1)(f)) cover keeping a record of what you bought and which terms you accepted, so any question about a refund can be answered from your file, and keeping my systems secure.
Your explicit consent is the only basis I use for your health information.
4. Your consent, and the box you tick
Your health intake form has a consent box. Ticking it means you agree to my using the health information you give me, in the form, in what you upload, in your session and afterwards, for the purposes in this notice. It’s separate from accepting my Terms & Conditions, and separate from the other choices on that form, none of which is ticked for you.
If your partner bought your session, that box is where your own consent is given. Nothing agreed at the checkout covers your health information. Until you tick it, I don’t use anything you’ve told me about your health.
You can withdraw your consent at any time by emailing hola@angelsperez.com. From then on I stop using your health information. Withdrawing doesn’t make my earlier use of it unlawful. I can’t prepare or deliver a session without your health information, so withdrawing means the service can’t continue, and I’ll write to you about your payment under my Terms & Conditions.
5. If you and your partner both work with me
You each have your own health intake form, session, file and Decoding Map. I treat your health information separately.
By default, I don’t share your results, Decoding Map or plan with your partner, and I don’t share theirs with you.
If you invite your partner to join your session, they’ll hear what we discuss while they’re there. That’s your choice, and you don’t need to give me separate permission for it.
If you want me to share or discuss your information with them when you’re not there, you can give me permission in your health intake form. The optional box says: You can share my results, my Decoding Map and my plan with my partner, and talk to them about it when I’m not there.
You can change your mind at any time by writing to me.
If something in your results matters for both of you, what I can do depends on that box. If you’ve ticked it, I’ll talk to your partner about it directly. If you haven’t, I’ll tell you what it means for you and what’s worth sharing with them, and I’ll leave that with you.
6. Where your email address came from
For partners. Your partner gave me your name and email address in a short form after your session was bought, so that I could send you what you need for it. I use your address only for your health intake form and the emails about your own Decoding Session. It never goes into a newsletter or a marketing list unless you sign up for one yourself. Until you fill in your health intake form, your name and address are all I hold about you. If you haven’t gone ahead within six months of the purchase, I delete them.
7. AI-assisted analysis
I use an AI tool, Claude, made by Anthropic, to support parts of my work. I review your health history, forms and results myself and apply my own clinical criteria and judgement. I may then use Claude to help me organise information, draft clinical notes and draft sections of your Decoding Map. Parts of your session transcript may also be used for this.
Claude does not make clinical judgements or decide what I recommend. I decide what your results and health history mean in the context of your fertility, what I think is relevant, and what recommendations I make. I review and take responsibility for the final Decoding Map you receive.
I use Claude only under a business agreement with Anthropic. That agreement includes a data processing agreement, Standard Contractual Clauses for the transfer to the United States, and a ban on using your information to train Anthropic’s models. Your health information never goes into a free or personal AI app.
Your consent in section 4 covers this use.
8. Session recording
Your session is recorded and transcribed, so that I can listen to you rather than write while we talk. I use the recording and the transcript to write my notes afterwards, to build your Decoding Map, and for the AI-assisted work in section 7.
The recording and the transcript stay with me. I don’t send them out to anyone, and they’re never used for marketing or for anything outside your own care. If you’d like a copy of what I hold about you, including these, ask me. Section 12 explains how.
I delete the recording 60 days after your Decoding Map goes out, and the written transcript two years after that. I keep the transcript for those two years because it’s the record of what we actually said, and it’s what I read first if we work together again, whether that’s another session or a programme. My notes and your Decoding Map stay in your file for longer. Section 10 sets out every period.
9. Who else handles your information
I don’t sell, rent or trade your information. I share it only with the providers that help me deliver your service, each bound by contract to protect it and use it only on my instructions.
- ThriveCart and Stripe · payment · US, under a data processing agreement and Standard Contractual Clauses. Card details never reach me.
- Google Workspace (Google LLC) · email, the health intake form (Google Forms), stored uploads (Google Drive) and documents · US, under a data processing agreement and Standard Contractual Clauses
- Typeform S.L. · the lab upload form · Spain (EU), hosted on AWS in the US under Standard Contractual Clauses
- Make, operated by Celonis Inc. · the automation that sends the right email after your form and creates your client file · your information is stored in the European Union. Celonis Inc. is in the US and can reach it to run and support the service, under a data processing agreement, the EU-US Data Privacy Framework and Standard Contractual Clauses
- Notion Labs Inc. · my client database and clinical notes · US, under a data processing agreement and Standard Contractual Clauses
- MailerLite · automated emails after your purchase · Ireland (EU)
- Calendly LLC · booking · US, under a data processing agreement and Standard Contractual Clauses
- [Video platform and recording tool, once chosen] · your session
- Anthropic PBC · AI-assisted analysis (section 7) · US, under a commercial data processing agreement and Standard Contractual Clauses
- The supplement dispensary I work with, currently Welldium in the EU and Amrita in the UK · the directory I set up for you, if you use one · your name and email address, so that the directory can be created in your name
Discussing cases with colleagues. Like most practitioners, I talk about cases with trusted colleagues and mentors, because a second pair of eyes makes the work better. When I do, you’re anonymous. I don’t give your name, your contact details or anything else that could identify you. What I describe is your situation, your age and your results. Everyone I speak to is bound by confidentiality. If I ever wanted to discuss your case in a way that identified you, I’d ask you first, and saying no wouldn’t change the care you receive.
I may also share information when the law, a court or an authority requires it, or to protect my legal rights.
10. How long I keep it
- Your clinical file (health intake form, results, notes and Decoding Map): for as long as I’m working with you, then five years.
- The recording of your session: deleted 60 days after your Decoding Map goes out.
- The transcript of your session: deleted two years after your Decoding Map goes out.
- Invoices and payment records: seven years, as Estonian accounting law requires.
- The version of my Terms you accepted: kept with your client file.
- Emails about your care: kept as part of your client file.
- Records of your consent: for as long as I hold the information the consent covers, then three more years.
After that, your information is securely deleted or fully anonymised, unless the law requires me to keep it longer or it’s needed for a legal claim.
11. Testimonials
If I ever refer to your case in anything public, such as social media or educational content, I won’t identify you without your explicit consent first. If you see something you’re not comfortable with, tell me and I’ll remove it.
I do learn from the way women describe things to me. Where a phrase comes up again and again, I might use that kind of language in what I publish. Nothing that identifies you, and nothing about your health, is ever part of that. If I ever wanted to use your own words as yours, I’d ask you first.
12. Your rights, security, transfers and complaints
You can ask to see, correct or delete your information, take a copy of it, or limit how I use it, at any time, by emailing hola@angelsperez.com. Some records, such as invoices, I’m required by law to keep. The full list of your rights, how your information is kept secure, how transfers outside the EEA are protected, and how to complain to a data protection authority are in my Privacy Policy, sections 10 to 15.
13. Changes to this notice
This notice carries the date it was last updated, at the top. If I change it in a way that affects information you’ve already given me, I’ll email you before the change applies.