Client Privacy Notice

1. Who This Notice Is For

This notice applies once you become a client of Calibre Performance Consulting (we, us, our), from the point you book your Audit. It explains how we collect, use, share and protect your personal data, including your health data, while we work with you and after your service ends. If you have only made an enquiry through our website, our Privacy Policy applies instead.

2. Who We Are

Calibre Performance Consulting is responsible for your personal data. You can contact us about anything in this notice at info@calibreperformance-c.com.

3. What We Collect

While you are a client, we collect:

• Your contact details: name, email address, phone number and the address where your blood samples are taken
• Your intake answers: age, health history, medications and supplements (including photos of product labels), sleep, nutrition, training, stress, goals and motivation
• Blood test results from your Audit and any retests
• Data from the WHOOP device we provide, including sleep, heart rate, heart rate variability, activity and blood pressure readings
• Glucose data from the continuous glucose monitor used during your Audit and any later monitoring periods
• Your daily check-in answers, such as alcohol intake
• Any existing blood results or wearable data you choose to share with us, which we record as background only
• Clinical records, such as our clinician's screening of your results and any exercise clearance
• Your protocol, your 90-day measurement plan and our notes from calls and check-ins
• Payment and invoice records
• Messages you send us

Information about your health is special category data under UK data protection law, and we treat it with extra care.

4. Why We Use It and Our Lawful Bases

• To deliver your service (arranging your Audit and retests, preparing your protocol and supporting you through it): performance of our contract with you
• To process your health data: your explicit consent, which you give by signing our client consent form before onboarding
• To keep payment and invoice records: our legal obligations and our legitimate interest in keeping accurate financial records
• To run our service safely, for example keeping records of clinical screening: our legitimate interests

You can withdraw your consent at any time by contacting us. This does not affect processing we have already carried out, but because our service depends on your health data, we will not be able to continue providing it without your consent.

5. How Your Protocol Is Prepared, Including AI

Your protocol is drafted with the help of an AI engine that runs on Anthropic's Claude models. To do this, your intake answers, results and wearable data are sent to Anthropic for processing. Every draft is reviewed and signed by a Calibre consultant before it reaches you, and every result is screened by our clinician. No decision about you is made solely by automated means.

6. Who We Share It With

We share your data only with the people and providers who need it to deliver your service:

• The phlebotomist or nurse who takes your blood samples
• The UK laboratories that analyse your samples
• Our clinician, a registered doctor who screens your results and gives any exercise clearance
• WHOOP, which provides your wearable device and its data
• The provider of your continuous glucose monitor
• Google, through Google Workspace, where we store your records and email
• Anthropic, which processes your data to draft your protocol
• Our website host (Vercel) and email delivery provider (Resend), for messages sent through our website
• Our payment provider, when you pay us

We never share your results, wearable data, intake answers or protocol with your GP, employer, board, insurer or anyone else without your explicit consent, except where we are required to do so by law. Where a result needs medical attention, we will ask you before anything is passed on. We never sell your data, and we never use it for marketing without your agreement.

7. Transfers Outside the UK

WHOOP and Anthropic are based in the United States, and some of our other providers may process data outside the UK. Where your data is transferred outside the UK, we only do so with the safeguards UK data protection law requires.

8. How Long We Keep It

We keep your health data, protocol, notes and any existing data you shared with us for 24 months after your service ends, then delete it. Payment and invoice records are kept indefinitely.

9. How We Protect It

Access to your health data is limited to the Calibre team members and clinician who need it to deliver your service. All data transmitted to and from our website is encrypted using HTTPS/SSL.

10. Your Rights

Under UK data protection law, you have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your data
• Restrict processing of your data
• Object to processing
• Request data portability
• Withdraw your consent at any time

To exercise any of these rights, please contact us at info@calibreperformance-c.com. If you are unhappy with how we handle your data, please contact us first. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).

11. Changes to This Notice

We may update this notice from time to time. We will post the new version on this page and update the Last updated date above, and we will tell you directly about any significant change.

12. Contact Information