Privacy notice

Last updated: [October 2026]

This notice explains how I handle personal information when you visit my website, contact me, book an appointment or work with me.

Who is responsible for your information?

Jason Heward
Email: hello@jasonheward.com

I am the controller of personal information processed in running my coaching and relational advisory practice.

Information I collect

Depending on how you interact with me, I may collect:

  • Your name, contact details, time zone and appointment information.
  • Information you share in enquiries and correspondence.
  • Information relevant to our work, including your goals and brief session notes.
  • Billing details, invoices and payment records.
  • Technical information processed by the services that host this website and provide appointment booking.

Most information comes directly from you. Where an organisation arranges or funds an engagement, it may provide professional contact details and information about the proposed work.

Please avoid putting sensitive personal information about yourself or others in appointment-booking forms.

How and why I use information

I use information to respond to enquiries, arrange appointments, deliver services, maintain continuity between sessions, manage payments and meet legal obligations.

The legal bases are:

  • Steps before entering a contract and performance of a contract: discussing your enquiry and providing agreed services (Article 6(1)(b) GDPR).
  • Legal obligations: keeping accounting records and complying with applicable requirements (Article 6(1)(c) GDPR).
  • Legitimate interests: administering a secure practice, communicating with organisational contacts, and handling complaints or legal claims (Article 6(1)(f) GDPR).
  • Consent: where required for an optional activity or particular use of information (Article 6(1)(a) GDPR).

Where I rely on consent, you may withdraw it by contacting me. Withdrawal does not affect processing already carried out lawfully.

Sensitive information

Our conversations may touch on health, relationships, beliefs or other sensitive matters.

I aim to collect and record only what is necessary. Where processing special-category information requires your explicit consent, I obtain it separately and explain the purpose. Explicit consent provides the additional condition under Article 9(2)(a) GDPR where applicable.

You may choose not to share particular information. If you withdraw consent, we will discuss whether and how the work can continue without it.

Notes and security

I keep brief paper notes to support continuity in our work. These are stored in a locked location in my office.

I limit access to client information and use appropriate security measures for the devices and accounts used in my practice.

Services I use

I use the following providers to run the practice:

  • Squarespace: website hosting.
  • Acuity Scheduling: appointment booking and booking communications.
  • Apple/iCloud: email and associated communications.
  • Zoom: online sessions and optional transcription.
  • Wise: invoicing and payment-related services.

I also prepare invoices as PDFs.

Providers process information needed for their functions. Some act on my instructions; others also process information for their own legal, security or regulatory purposes.

Relevant information may be shared with professional advisers or authorities where necessary and lawful. I do not sell your personal information.

Optional Zoom transcripts

I do not routinely transcribe sessions.

At your request, I can use Zoom’s transcription feature, with the express agreement of everyone taking part. Before enabling it, we agree whether any audio or video recording is involved and who will receive the transcript.

I delete my copies of requested transcripts and associated recordings within 30 days after the session, including downloaded copies and items in Zoom’s recoverable Trash, unless a longer period is legally necessary. Any such exception will be explained where lawful.

You are responsible for storing any copy you receive.

Use of AI

I occasionally use AI tools to explore general coaching questions and support professional reflection.

For this purpose, I use only material that has been anonymised and generalised so that a client or another person cannot reasonably be identified. Removing names alone is not sufficient.

I do not upload identifiable client notes, correspondence or session recordings for this purpose. Optional Zoom transcription is handled separately as described above.

Confidentiality and joint work

I treat information shared during our work as confidential, subject to the arrangements agreed before we begin and applicable legal requirements.

For couples or working partnerships, we agree how separate conversations and messages will be handled.

Where an organisation funds the work, we agree any reporting arrangements in advance. Funding an engagement does not automatically entitle an organisation to session content.

International processing

Some providers may process information outside the European Economic Area, including in the United States.

Where required, international transfers are covered by recognised safeguards, such as an applicable adequacy decision or approved Standard Contractual Clauses. You can contact me for information about the arrangements relevant to your data and how to obtain details of the safeguards.

Website cookies and technical information

I do not use advertising trackers, and optional Squarespace analytics cookies are disabled.

Squarespace and Acuity may still use necessary cookies, browser storage and technical information to provide website security, appointment booking and related functions.

You can manage cookies through your browser, although restricting necessary cookies may affect functionality.

Retention

I use the following retention periods:

  • Enquiries that do not lead to work: up to 12 months after our last contact.
  • Paper session notes: during the engagement and for up to two years after our final session, followed by secure destruction.
  • Requested Zoom transcripts and associated recordings: up to 30 days after the session.
  • Agreements and essential engagement correspondence: up to three years after the engagement ends, or longer where necessary to meet a legal obligation or handle an ongoing complaint or legal claim.
  • Invoices and accounting records: generally seven years from the end of the relevant calendar year, or longer where legally required.

Relevant records may be retained longer for an ongoing complaint, legal claim or legal obligation. Detailed session notes are not automatically retained for the same period as accounting records.

Your rights

Subject to applicable legal conditions, you may request access, correction, deletion, restriction of processing or a portable copy of your information. You may object to processing based on legitimate interests and withdraw consent where processing relies on it.

Contact hello@jasonheward.com to exercise your rights.

You may also complain to the Austrian Data Protection Authority, or another competent supervisory authority.

Contact, appointment and billing details are necessary to arrange and deliver paid services. Other information is generally your choice, although withholding information essential to the work may limit what I can offer.

I do not make decisions about your access to coaching solely through automated processing.

Changes to this notice

I may update this notice when my services or data practices change. The date above identifies the current version.