Contact details
I am Lucas Araya Eacock, trading as Look Like You. I am the controller responsible for the personal information described in this notice. You can use the contact details below for privacy questions or to exercise your rights.
Email: hello@looklikeyou.uk
Telephone: 07889244890
What information I collect and why
Enquiries and bookings. Your name, contact details, consultation arrangements, correspondence and the information you choose to share about your goals. I use this to respond to you and arrange the next steps you request.
Coaching and client administration. Your contact details, age or date of birth where needed, relevant lifestyle and training information, goals, programme, session records, check-ins, agreed package and service history. I use this to assess suitability, deliver coaching and manage our agreement. If you request student pricing, I also use evidence of student status to check eligibility.
Health information. Relevant answers to screening and PAR-Q questions, injuries, medical conditions, limitations, and health-related assessment or progress information. This is special category data. I only ask for information needed to assess whether and how I can coach you safely.
Private photos and videos. With your agreement, progress photos and exercise videos help me assess technique and track progress. I ask for separate permission before using them publicly.
Payments. I receive payments by bank transfer or standing order set up by you. I keep payment amounts, dates, references, payer information shown by my bank and records of the services purchased. I may need bank details to make an agreed refund or referral payment. I do not collect card details or Direct Debit mandates.
Questions, complaints and incidents. Relevant correspondence, service records, incident details and, where necessary, witness contact details or statements. Some of these records may contain health information.
Optional publicity. If you separately agree, I may use an agreed testimonial, image or video on the specific channels covered by your permission.
Lawful bases and data protection rights
The UK GDPR requires a lawful basis for each use of your information. Health information has additional protection and requires a special category condition as well.
Enquiries and coaching. I rely on contract (Article 6(1)(b)) for information needed to take steps at your request before an agreement or to deliver your coaching. This includes necessary booking, student eligibility checks and payment administration. If you do not provide information essential for the service, I may be unable to offer it; I will explain this to you.
Health information. For health information necessary to assess suitability and provide your requested coaching, I rely on contract (Article 6(1)(b)) and your explicit consent (Article 9(2)(a)). I ask for this consent separately. For optional private progress photos and videos, I rely on consent (Article 6(1)(a)), including explicit consent where they reveal health information (Article 9(2)(a)).
You can withdraw health-data consent by contacting me. If I cannot safely provide a service without that information, I will explain what this means for your coaching. Withdrawal does not make earlier processing unlawful. Any continued retention requires its own applicable lawful basis and special category condition.
Tax records. I rely on legal obligation (Article 6(1)(c)) to retain the business and financial records required by UK tax law. This requirement does not extend to your whole coaching or health file.
Complaints and legal claims. Where necessary and proportionate, I rely on legitimate interests (Article 6(1)(f)) to resolve complaints and protect my legal position, balanced against your rights. Where health information is necessary to establish, exercise or defend legal claims, I also rely on Article 9(2)(f).
Public testimonials and images. I rely on separate, optional consent (Article 6(1)(a)), including explicit consent if the content reveals health information (Article 9(2)(a)). You can decline without affecting your coaching, and withdraw permission by contacting me.
Depending on the circumstances, you can ask to access your information, correct inaccuracies, have it deleted, restrict its use or receive certain information in a portable format. You can object to processing based on legitimate interests and withdraw consent at any time. Withdrawal does not affect the lawfulness of earlier use.
These rights are subject to legal conditions and exemptions. Contact me using the details above. I normally respond without undue delay and within one month; a lawful extension may apply to complex or multiple requests, and I will explain this where relevant.
More information about your rights: https://ico.org.uk/for-the-public/
Where I get personal information from
Most information comes directly from you through forms, consultations, messages and coaching. I also create records during coaching and receive appointment information through Calendly and payment information through my bank. Where necessary for an incident or complaint, information may come from people involved or their representatives.
How long I keep information
I keep information only for as long as it is needed for its purpose, including any justified legal or tax requirements. At the end of the relevant period, I delete it securely or anonymise it so that it no longer identifies you.
Enquiries that do not become clients. I keep ordinary enquiry and consultation correspondence for six months after our last meaningful contact. I review any health information sooner and delete it when no longer needed, unless a specific lawful reason requires retention.
Core client records. I keep agreements, package details and essential non-health service records for up to six years after coaching ends where needed to address contractual questions or claims. I delete information sooner if it is no longer needed.
PAR-Q and other health records. I keep information needed for safe coaching while we work together. When coaching ends, I review what remains necessary. Where records are needed for actual or prospective legal claims, I determine retention by the relevant claim time limits, the nature of any incident and whether the records are still needed to resolve or defend the claim. I retain only the relevant information with an applicable lawful basis and special category condition, review it regularly, and delete it when that justification ends.
Routine technique videos. I normally delete these three months after providing feedback. If a video remains needed for agreed coaching or a specific legal claim, I keep it only while that purpose continues and review the need for it.
Private progress photos. I retain these for the agreed progress-tracking purpose. I review them when coaching ends and delete them once that purpose is complete, unless a separate permission or specific legal-claims justification applies.
Invoices and tax payment records. As a sole trader, I normally retain these for at least five years after the 31 January submission deadline for the relevant tax year. Different requirements may apply to very late returns or an open HMRC enquiry.
Marketing permissions and content. I keep content for the use and duration agreed with you, reviewing whether it remains needed. If you withdraw permission, I stop new use and remove material from channels under my control as soon as reasonably practicable. Copies already distributed or independently shared by others may not be recoverable. I retain minimal evidence of permission and withdrawal only while needed for accountability or legal claims.
Incidents and disputes. Where a complaint or actual or prospective legal claim requires longer retention, I keep only relevant records for as long as needed to resolve it and deal with applicable claim or appeal periods. I review this need and securely delete or anonymise the records afterwards.
Sharing information outside the UK
Microsoft and Calendly operate internationally, so information may be processed outside the UK, including in Europe and the United States. Storage location does not necessarily cover all support access or processing by their suppliers.
Calendly provides appointment scheduling from the United States. Its Data Processing Addendum provides for the UK Extension to the EU-US Data Privacy Framework where applicable, with EU Standard Contractual Clauses and the UK Addendum as a contractual fallback. These are arrangements designed to protect personal information transferred internationally.
Microsoft provides business email, storage and forms services under its applicable data protection terms. Microsoft publishes regional storage arrangements for Forms rather than an exact country for every account. Its international-transfer commitments include Standard Contractual Clauses and participation in the Data Privacy Framework where applicable. I do not promise that all information stays in the UK.
You can contact me for details or a copy of the relevant safeguards. Supplier terms are available below:
Microsoft data protection terms: https://aka.ms/dpa
Calendly data protection terms: https://calendly.com/legal/data-processing-addendum
How to complain
If you have a concern about how I use your information, please contact hello@looklikeyou.uk so I can investigate and respond.
You also have the right to complain to the Information Commissioner's Office (ICO).
ICO helpline: 0303 123 1113
Website: https://ico.org.uk/make-a-complaint/