Privacy Notice

The coaching application (on the main site): your name, email address, your selected goal, and whatever you choose to write about your situation. The form also asks whether you are currently using a GLP-1 medication. That question is optional, and the answer is health data.

The Win Your Money Back application (on the challenge page): your name, email address, mobile number, where you are now and where you want to get to, whether you have been coached before, and why now.

The waitlist: just your email address, and whether you joined before or after doors opened.

Where your visit came from: if you arrive from an ad or a shared link, the site records the campaign labels on that link (utm parameters), the click identifiers some platforms add (such as Meta’s fbclid), which headline variant you saw, and the page that referred you. This is stored with your enquiry so I can tell which ad or post actually brought the people who sign up. See Cookies below for how this works.

Technical details: my server records a truncated version of your IP address (the final portion is discarded, so it identifies a network rather than you), your browser type, your country, and which page you submitted from. These help detect spam and abuse of the forms.

I also record which form you used and how you agreed to this notice, because the two forms ask for agreement in different ways.

Under UK GDPR my lawful basis for handling your name, contact details and enquiry is consent (Article 6(1)(a)): the ticked box on the application forms, or, for the waitlist, submitting a form whose label says exactly what you are signing up for.

Health information, including GLP-1 use, is “special category” data and needs a second, higher condition. I rely on your explicit consent (Article 9(2)(a)). You do not have to answer that question, and declining will not stop your application being considered. It is asked only because it is clinically relevant to whether and how I can coach you safely.

You can withdraw consent at any time by emailing me. See Your rights below.

Applications: to read and respond, and, if we look like a fit, to arrange a call. Waitlist signups: to email you about the challenge, which is what the signup form says, and nothing else. Campaign labels: to measure which ads and posts are working, so I stop paying for the ones that are not.

I do not sell your data and I do not share it with anyone for their own marketing. Every marketing email I send includes an unsubscribe option, and unsubscribing takes effect immediately.

Challenge participants provide progress photos for tracking and verification. Publishing any photo or testimonial in marketing (this website, social media, ads) happens only with your separate written consent, which is optional, is never a condition of participation or of any refund, and can be withdrawn at any time by emailing me, after which the material is taken down from anywhere I control. The full rules are in the Terms & Conditions.

I use three service providers, each acting on my instructions as a processor:

• Supabase: stores enquiries in a database only I can access.
• Resend (EU region, Ireland): delivers the notification email to me and any confirmation or welcome email to you.
• Vercel: hosts the website and runs the code that receives your form.

There are currently no third-party analytics or advertising scripts on this site. If that changes (for example, a Meta advertising pixel when ads launch), the site will ask for your consent before any such script runs, and this notice will be updated first.

• Applications that do not lead to coaching are deleted within six months.
• Waitlist emails are kept until the cohort they relate to has filled, and no longer than six months, unless you have asked to hear about future cohorts.
• Submissions marked as spam are deleted within 30 days.
• If you become a client, your records are kept for the duration of our work together and for three years afterwards, then deleted.

Health information is deleted as soon as it is no longer needed for the purpose you gave it for.

The site sets one measurement cookie, named aj_attr, and only with your consent: when you arrive from a link carrying campaign labels, a banner asks first, and declining costs you nothing. If you agree, the cookie remembers those labels (utm parameters, click identifiers such as fbclid, the headline variant you saw, and the referring page) for up to 90 days, so that if you come back later and sign up, I still know which ad brought you.

It is a first-party cookie: it is set and read by this site only, it is not shared with any third party, and it does not track you across other websites. It exists for my ad measurement, not for anything you need, so you can delete it in your browser at any time and the site works identically without it.

One more cookie, aj_consent, remembers your answer to the consent banner itself for 12 months, so you are not asked on every visit. There are no other cookies and no third-party analytics.

Under UK GDPR you can ask me for a copy of your data, ask me to correct it, ask me to delete it, object to how I am using it, or withdraw your consent, at any time, at no cost, by emailing adam@adamjohnston.uk. I will respond within one month.

If you are unhappy with how I have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk, though I would rather you told me first so I can put it right.