EDENREBUILT PRIVACY POLICY
​
Last updated: 19/09/2026
1. Introduction
EdenRebuilt respects your privacy and is committed to protecting your personal information.
This Privacy Policy explains how EdenRebuilt collects, uses, stores and shares personal information when you:
-
visit the EdenRebuilt website;
-
contact EdenRebuilt;
-
complete the EdenRebuilt Health Spectrum Assessment;
-
book or attend a consultation;
-
purchase or participate in an EdenRebuilt service or programme;
-
subscribe to emails or other communications; or
-
otherwise interact with EdenRebuilt.
EdenRebuilt processes personal information in accordance with applicable UK data-protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. Who We Are
Business name: EdenRebuilt
Data Controller: David Ngochinya, trading publicly as David Eden
Email: david@edenrebuilt.com
Website: edenrebuilt.com
For the purposes of UK data-protection law, David Ngochinya is the data controller responsible for determining how and why personal information is processed by EdenRebuilt.
If you have any questions about this Privacy Policy or how your information is handled, please contact:
3. Personal Information We Collect
The information EdenRebuilt collects depends on how you interact with the business.
This may include:
Identity and contact information
Such as your:
-
name;
-
email address;
-
telephone number;
-
postal address, where required; and
-
other contact information you choose to provide.
Health and lifestyle information
Where relevant to an assessment, consultation or service, this may include information relating to:
-
energy and fatigue;
-
sleep and recovery;
-
nutrition and eating habits;
-
digestion;
-
physical activity and fitness;
-
pain or physical symptoms;
-
physical health;
-
mental and emotional wellbeing;
-
stress;
-
lifestyle;
-
health concerns and goals;
-
medications or supplements where relevant;
-
health history; and
-
other health or lifestyle information you voluntarily provide.
Information concerning your physical or mental health may constitute special category personal data under UK data-protection law and receives additional protection.
Consultation and client information
If you use EdenRebuilt's services, information may include:
-
consultation forms;
-
assessment information;
-
consultation and session notes;
-
health and lifestyle goals;
-
recommendations and plans;
-
progress information;
-
agreements and consent records;
-
relevant correspondence; and
-
records necessary to document the services provided.
Booking and transaction information
This may include:
-
services booked or purchased;
-
appointment dates and times;
-
transaction information;
-
invoices;
-
payment status; and
-
relevant financial or accounting records.
EdenRebuilt does not normally receive or store your complete payment-card details. Payments are processed through third-party payment providers.
Communications
EdenRebuilt may retain communications you send by email, website forms or other communication services where necessary to respond to you, provide services, maintain appropriate records or protect legal rights.
Website and technical information
When you use the website, certain technical information may be processed automatically, such as:
-
IP address;
-
device and browser information;
-
security and session information;
-
cookie preferences; and
-
information technically necessary to operate and secure the website.
The use of cookies is explained further in Section 16.
4. The EdenRebuilt Health Spectrum Assessment
The EdenRebuilt Health Spectrum Assessment is a voluntary health and lifestyle assessment designed to help you understand your current health foundations and Health Capacity.
The assessment asks a series of questions relating to areas including:
-
energy and vitality;
-
sleep and recovery;
-
nutrition and digestion;
-
physical health and movement; and
-
mental and emotional wellbeing.
The assessment may also ask which areas you would like to discuss or improve and may provide an opportunity for you to supply additional information.
Because some questions concern your physical or mental health, information submitted through the assessment may constitute special category health data.
Information generated from your answers
Your responses are used to generate assessment information including:
-
a Total Score;
-
Health Capacity;
-
individual category scores and percentages; and
-
a Health Spectrum position, such as Surviving, Struggling, Compensating, Optimising or Thriving.
These results are derived from the answers you provide and are therefore treated as health-related information where appropriate.
How assessment information flows through EdenRebuilt
The assessment is provided using Tally.
Assessment submissions and calculated information are transferred to Google Sheets, where EdenRebuilt maintains assessment records and performs the limited processing required to organise assessment information.
Where you have provided the relevant marketing permission, selected information may subsequently be imported into EdenRebuilt's Wix customer relationship management system.
The information imported into Wix from the assessment is limited to:
-
first name;
-
email address;
-
Health Capacity;
-
Health Spectrum position; and
-
Health Assessment Date.
EdenRebuilt does not routinely import the complete set of individual Health Spectrum Assessment answers into Wix.
This approach is intended to limit the amount of detailed health information distributed between systems.
5. Health Spectrum Assessment Scoring
The Health Spectrum Assessment uses predefined scoring rules to calculate results from the answers you provide.
This calculation is automated.
The assessment uses your responses to calculate category scores, Health Capacity and your position on the Health Spectrum.
The assessment is intended as an educational and lifestyle tool. It does not diagnose a disease or medical condition and its result should not be treated as a medical diagnosis.
The automated assessment result is not used by EdenRebuilt to make decisions producing legal or similarly significant effects about you, such as determining eligibility for employment, insurance, credit or essential services.
You remain free to decide whether to act upon the information provided by the assessment.
6. Special Category Health Information
Information concerning health receives additional protection under UK data-protection law.
For the Health Spectrum Assessment, EdenRebuilt relies on your explicit consent under Article 9(2)(a) UK GDPR to process the health information you provide for the purpose of calculating and providing your personalised assessment results.
You will therefore be asked to provide a clear, affirmative indication of explicit consent before submitting the assessment.
You are not required to complete the Health Spectrum Assessment. However, processing the health information contained within the assessment is necessary to calculate and provide the assessment results.
Your consent to the processing of health information for the assessment is separate from any consent you may choose to give for marketing communications.
You may withdraw your consent to consent-based processing at any time by contacting:
Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
Where particular information must subsequently be retained for another lawful purpose — for example, where it forms part of a client record or is necessary for the establishment, exercise or defence of legal claims — EdenRebuilt may retain that information where permitted by applicable law.
UK GDPR requires an Article 6 lawful basis plus a separate Article 9 condition when special-category data is processed; explicit consent is one available Article 9 condition and must be specific, affirmative and capable of withdrawal. ICO
7. How EdenRebuilt Uses Your Information
EdenRebuilt may process personal information to:
-
provide the Health Spectrum Assessment and calculate your results;
-
respond to enquiries;
-
arrange and administer bookings;
-
provide consultations, programmes and other requested services;
-
understand relevant health, lifestyle and nutritional information;
-
communicate with clients in connection with services;
-
maintain appropriate consultation and client records;
-
process payments and maintain accounting records;
-
provide customer support;
-
operate, maintain and secure the website;
-
manage the business and its services;
-
send marketing communications where permitted;
-
comply with legal, regulatory, tax, accounting or insurance requirements;
-
prevent or investigate misuse, fraud or security incidents; and
-
establish, exercise or defend legal claims where necessary.
EdenRebuilt does not sell your health information or other personal information to third parties.
8. Lawful Bases for Processing
Under UK data-protection law, EdenRebuilt must have a lawful basis for processing personal information.
Depending on the particular processing activity, EdenRebuilt may rely on:
Contract
Where processing is necessary to provide a service you have requested, take steps at your request before entering into a contract, administer a booking, or perform an agreement with you.
For the Health Spectrum Assessment, EdenRebuilt relies on Article 6(1)(b) where processing ordinary personal information is necessary to provide the assessment you have requested.
Consent
Where you have given consent for a particular purpose, including where appropriate:
-
receiving email marketing; or
-
another optional use of your information.
Where explicit consent is used for special category health information, the relevant Article 9 condition is addressed separately in this policy.
Legitimate interests
EdenRebuilt may rely on legitimate interests where processing is reasonably necessary for running and protecting the business and those interests are not overridden by your rights and interests.
This may include activities such as:
-
responding to appropriate business correspondence;
-
maintaining business security;
-
preventing misuse;
-
maintaining necessary administrative records; and
-
establishing or defending legal rights.
Where required, EdenRebuilt considers the impact of such processing on your privacy before relying on legitimate interests.
Legal obligation
Information may be processed where necessary to comply with a legal obligation, including applicable tax, accounting or regulatory requirements.
Different processing activities may rely on different lawful bases.
9. Consultations and Client Records
If you become an EdenRebuilt client, information relevant to the services provided may form part of your client record.
This may include relevant Health Spectrum Assessment information where it is useful for understanding your starting position, progress or the services being provided.
Client records may include:
-
intake and consultation information;
-
relevant health and lifestyle information;
-
consultation notes;
-
recommendations;
-
agreements and consent records;
-
progress information;
-
relevant communications; and
-
other documentation reasonably necessary to record the professional service provided.
EdenRebuilt aims to collect only information reasonably relevant to the service and its professional record-keeping responsibilities.
10. Marketing Communications
EdenRebuilt may offer you the option to receive health education, guidance, business updates, resources, information about services and occasional promotional communications.
Where consent is required, you will only receive these communications after actively choosing to receive them.
Marketing consent is separate from consent to process health information for the Health Spectrum Assessment.
You can complete the Health Spectrum Assessment without agreeing to ongoing marketing communications.
You can unsubscribe from marketing emails at any time using the unsubscribe option contained within the email or by contacting:
Unsubscribing from marketing does not necessarily require EdenRebuilt to delete other information that is being lawfully retained for a different purpose.
EdenRebuilt may retain limited suppression information where necessary to record that you have unsubscribed and prevent you from being inadvertently added back to marketing communications.
11. Payments
Payments may be processed through providers including Wix Payments and Stripe, depending on the service purchased.
These providers process payment and transaction information required to complete and administer payments.
Banks, payment networks and other financial institutions may also process transaction information as part of the payment process.
EdenRebuilt does not ordinarily store your complete debit or credit card details itself.
Business transaction information may also appear within EdenRebuilt's business banking and accounting records where necessary for financial administration, accounting and tax purposes.
12. Service Providers and Sharing of Information
EdenRebuilt uses carefully selected third-party services to operate the business.
Depending on how you interact with EdenRebuilt, these may include:
Tally — providing the Health Spectrum Assessment and processing assessment submissions.
Google — including Google Sheets for assessment data and Google Meet for online consultations.
Wix — website hosting and functionality, bookings, CRM/contact management, email communications, forms and payment-related services.
Stripe — payment processing, including programme payments where applicable.
Zoho Mail — business email services.
Spark — email-client functionality used to access and manage EdenRebuilt business email.
Starling Bank — business banking and financial transaction records.
Westminster Insurance — where information is reasonably required in connection with professional insurance, a complaint or an actual or potential claim.
EdenRebuilt may also use professional advisers, IT/security providers, accountants or other suppliers where reasonably necessary to operate the business or comply with legal obligations.
Personal information is only shared where there is an appropriate reason to do so and only to the extent reasonably necessary for the relevant purpose.
EdenRebuilt may also disclose information where required by law, court order or an appropriate regulatory authority, or where necessary for the establishment, exercise or defence of legal claims.
If EdenRebuilt introduces services such as WhatsApp for client communications in the future, this policy will be reviewed and updated where necessary before or when that processing begins.
13. International Transfers
Some of the technology and service providers used by EdenRebuilt operate internationally.
As a result, personal information may in some circumstances be processed outside the United Kingdom.
Where a transfer of personal information from the UK constitutes a restricted international transfer, EdenRebuilt takes reasonable steps to ensure that an appropriate transfer mechanism or safeguard applies where required.
Depending on the circumstances, these safeguards may include:
-
UK adequacy regulations;
-
the UK International Data Transfer Agreement;
-
the UK Addendum to approved Standard Contractual Clauses;
-
other recognised contractual safeguards; or
-
another lawful transfer mechanism permitted under UK data-protection law.
Providers may also use approved subprocessors in different jurisdictions subject to their applicable data-processing and transfer arrangements.
You may contact david@edenrebuilt.com if you would like further information about safeguards relevant to your personal information.
The ICO requires privacy information to address international transfers and applicable safeguards where relevant. ICO
14. How Long We Keep Your Information
EdenRebuilt does not intend to keep identifiable personal information indefinitely.
Retention depends on the nature of the information and why it is held.
Health Spectrum Assessment — detailed responses
Where you complete the Health Spectrum Assessment but do not subsequently become a client, detailed identifiable assessment responses are normally retained for up to 12 months from submission.
After this period they will normally be deleted or anonymised unless there is a lawful reason for continued retention.
Limited Health Spectrum information in Wix
Limited assessment information held in EdenRebuilt's CRM — such as Health Capacity, Health Spectrum position and assessment date — may normally be retained for up to 24 months following your last meaningful interaction with EdenRebuilt.
Client records
If you become an EdenRebuilt client, relevant assessment information may become part of your client record.
Client records, including consultation records, agreements, relevant communications and information necessary to document services provided, are normally retained for at least seven years in accordance with EdenRebuilt's professional and insurance record-keeping requirements.
Information may be retained longer where reasonably necessary to meet a legal requirement or establish, exercise or defend legal claims.
Financial records
Invoices, transaction records and other information required for accounting or tax purposes are retained for the period required by applicable UK law.
Marketing records
Marketing contact information may be retained while you remain subscribed.
If you unsubscribe, limited information may be retained where necessary to maintain a suppression record and respect your preference not to receive further marketing.
Enquiries and other information
Other information is retained only for as long as reasonably necessary for the purpose for which it was collected, taking account of legal, regulatory, security and dispute-resolution requirements.
UK GDPR's storage-limitation principle requires organisations to justify how long identifiable personal information is kept rather than retaining it indefinitely. Privacy notices should state retention periods or the criteria used to determine them. ICO
15. Security
EdenRebuilt takes reasonable technical and organisational measures designed to protect personal information against unauthorised access, alteration, disclosure, loss or destruction.
These measures include appropriate use of reputable service providers, account security controls and limiting access to personal information to what is reasonably necessary for business purposes.
Health information is treated with particular care because of its sensitive nature.
No internet-based service or electronic storage method can guarantee absolute security. EdenRebuilt therefore keeps its data-handling practices under review and takes proportionate measures appropriate to the nature of the information being processed.
16. Cookies and Similar Technologies
The EdenRebuilt website is built using Wix and may use cookies or similar technologies required to operate the website securely and correctly.
EdenRebuilt uses a cookie-consent management system to provide visitors with information and choices about cookies and similar technologies.
At the date of this policy, EdenRebuilt's website scan identified Wix CMS functionality classified as essential and EdenRebuilt has not separately connected advertising or marketing-tracking integrations such as Meta Pixel or Google Analytics.
Strictly necessary technologies may operate without consent where they are required to provide functionality requested by the visitor.
If EdenRebuilt introduces non-essential analytics, advertising, marketing or similar technologies, the cookie settings and this policy will be reviewed as appropriate. Where consent is legally required, such technologies will be subject to the visitor's consent choices.
You can use the website's privacy/cookie controls to manage available preferences.
Under PECR, users must generally be told about cookies and give active consent before non-essential technologies are used; technologies that are strictly necessary to provide a requested online service can fall within an exemption. ICO
17. Your Data Protection Rights
Depending on the circumstances and the lawful basis being relied upon, UK data-protection law may give you rights including:
Right of access — to request a copy of personal information EdenRebuilt holds about you.
Right to rectification — to request correction of inaccurate information or completion of incomplete information.
Right to erasure — to request deletion of personal information in certain circumstances.
Right to restriction — to request restriction of processing in certain circumstances.
Right to object — to object to certain processing, including an absolute right to object to personal information being used for direct marketing.
Right to data portability — in certain circumstances, to receive information you provided in a structured, commonly used and machine-readable format or request its transfer to another controller.
Right to withdraw consent — where processing relies on consent, you may withdraw that consent at any time.
Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
Not every right applies in every situation, and lawful exemptions may sometimes apply. ICO
To exercise a data-protection right, contact:
EdenRebuilt may need to verify your identity before acting on a request.
18. Health Data Consent Withdrawal
If you wish specifically to withdraw your explicit consent for EdenRebuilt to process health information provided through the Health Spectrum Assessment, contact:
Please state that you wish to withdraw your Health Spectrum Assessment health-data consent and provide sufficient information for EdenRebuilt to identify the relevant assessment.
EdenRebuilt will stop processing information that depends upon the withdrawn consent unless there is another applicable legal basis and special-category condition permitting or requiring particular information to be retained for a separate purpose.
Withdrawing consent does not retrospectively make previous lawful processing unlawful. ICO
19. Children
EdenRebuilt's services and Health Spectrum Assessment are intended primarily for adults aged 18 or over.
EdenRebuilt does not knowingly seek to collect health information from children through the Health Spectrum Assessment.
Where services involving a person under 18 are considered, appropriate arrangements, consent and privacy information will be considered separately before personal information is processed.
20. Third-Party Websites and Services
The EdenRebuilt website may contain links to third-party websites or services.
EdenRebuilt is not responsible for the privacy practices of independent third parties acting as their own data controllers.
You should review the privacy information provided by those organisations when using their services.
21. Changes to This Privacy Policy
EdenRebuilt may update this Privacy Policy where its services, technology, data-processing activities or legal obligations change.
The latest version will be published on the EdenRebuilt website with an updated revision date.
Where a change materially affects how existing personal information is used, EdenRebuilt will take reasonable steps to bring the change to the attention of affected individuals where required.
22. Contacting EdenRebuilt
For questions about this Privacy Policy, requests concerning your personal information, withdrawal of consent or concerns about how your information has been handled, contact:
EdenRebuilt
Data Controller: David Ngochinya, trading publicly as David Eden
Email: david@edenrebuilt.com
Website: edenrebuilt.com
23. Complaints
If you have concerns about how EdenRebuilt has handled your personal information, please contact EdenRebuilt first so that the matter can be investigated.
You also have the right to complain to the UK's data-protection regulator:
Information Commissioner's Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Information Commissioner's Office
The ICO's current published contact details confirm this address and helpline.