How I look after your information

Last updated: 4 November 2026

This policy explains what information I collect, why I collect it, how I look after it and what your rights are. I've kept it as plain as I can.

Who I am

I'm Sonny Phull. I run SP Health Consulting Ltd, a company registered in England and Wales, company number 17222380, registered office 58a Ilford Lane, Ilford, IG1 2JY.

For this policy, SP Health Consulting Ltd is the "data controller". That means I decide how your information is used, and I'm responsible for it.

If you have any questions about your information, email me at info@fitnesswithsonny.com.

ICO registration number: ZC290984

What I collect, and why

The Health & Toxicity Assessment

The assessment is worked out inside your browser. Your answers are not uploaded, not sent to me and not stored on any server.

So you can pick up where you left off and compare your scores over time, your browser keeps your progress and your past scores on your own device. Only you can see them, and clearing your browser's site data removes them.

At the end, you can choose to have your results emailed to you. If you do, I keep:

• your name, email address and phone number
• your total score, your top three areas and the date you took it

I don't keep your individual answers.

I use this to send you your results, then a short series of emails and WhatsApp messages over the next two weeks about what your score means and how I can help. These stop as soon as you book a call, and you can stop them at any time by unsubscribing or replying "stop".

Because your score and top three areas say something about your health, I only keep them if you tick the box giving me permission.

Booking a call

When you book a free call, I keep:

• your name, email address and phone number
• the time of your booking
• your answers to the questions on the booking form, such as what you'd like help with, how long it's been going on and what you've already tried

I use this to prepare for our call, and to send your confirmation and reminders by email, text and WhatsApp. Your answers may include health information, so I only keep them if you tick the box giving me permission.

Applying for the 21-Day Detox

When you apply, I keep your contact details and your answers to the application questions. I use them to decide whether the detox is right for you and to get back to you. I only keep any health information in your answers if you tick the box giving me permission.

If you become a client

While we work together, I keep the information you share with me so I can coach you properly. That can include your health history, symptoms, any lab results you choose to share, notes on food, sleep, stress and training, your progress, and our messages.

If you decide to undertake laboratory testing, you can either order and pay for the tests directly through the laboratory provider, or I can arrange the tests on your behalf. Where I arrange testing, the test kits will be sent directly to you, and your results will be provided to you by the laboratory. You can then choose to share your results with me so that I can review them and use the findings to help personalise your health and wellness programme.

The laboratory provider is responsible for how it collects, processes and stores your personal information in accordance with its own privacy policy. Where I arrange testing on your behalf, I may need to share relevant personal information with the laboratory to process your order.

I also keep records of what you've paid and when. You pay me by bank transfer or through a PayPal invoice. PayPal doesn't share your card details with me.

Reviews and referrals

When a programme ends, I may ask you for a Google review and whether you know anyone who'd want the same help. Leaving a review is up to you. Google's own privacy policy covers anything you post there.

I also ask new enquiries how they heard about me, so I know which clients are recommending me. If a friend passed my details on, I don't contact them unless they get in touch with me first.

My website

My site doesn't use cookies, and it doesn't track you.

The site's font is loaded from Google Fonts, so your browser connects to Google's servers to fetch it. Google Fonts doesn't set cookies.

If I ever add tools that count visits, I'll update this page first.

My legal reasons for using your information

UK data protection law says I need a legal reason for each thing I do with your information. Mine are:

• Your permission (consent). For your health information, your assessment results and the follow up messages. You give it by ticking the box, and you can take it back at any time.
• Our agreement (contract). For the information I need to coach you once you're a client, or to set up a call you've asked for.
• Running my business properly (legitimate interests). For keeping basic records, answering your messages and improving my service, in ways you'd reasonably expect.
• The law (legal obligation). For keeping financial records, which I have to do for tax.

Health information is a "special category" of information under the law. I only use it with your explicit permission, and only to work with you.

Who else handles your information

I don't sell your information, and I don't share it with anyone to market to you.

I use a small number of trusted services to run my business. They only use your information to provide their service to me:

• My CRM, provided by HighLevel Inc. This holds contact details, form answers and bookings, and sends my emails and texts.
• WhatsApp, run by Meta, for messages from my WhatsApp Business number.
• Google, through Google Drive, where I keep client notes.
• My website hosting and security, Railway and Cloudflare.
• PayPal, for invoices and payments.
• Laboratories, only where I arrange testing for you.
• My accountant, for financial records.

Some of these services are based in the United States. Where your information leaves the UK, it's protected by the safeguards the law requires, such as the UK-US data bridge or contracts approved by the UK government.

I'd only share your information with anyone else if the law required it, or if I believed someone was at serious risk of harm.

How long I keep it

• Assessment results and enquiries that don't go further: 2 years from the last time we were in touch, then deleted.
• Booking form answers: 2 years after the call if you don't become a client.
• Client records: 6 years after we finish working together.
• Financial records: 6 years, as the law requires.

If you ask me to delete your information sooner, I will, unless the law says I have to keep it.

Your rights

You have the right to:

• see the information I hold about you
• ask me to correct anything that's wrong
• ask me to delete your information
• ask me to stop using it, or to limit how I use it
• get a copy of it to take elsewhere
• take back your permission at any time, which won't affect anything I did before you took it back

To use any of these, email me at info@fitnesswithsonny.com. I'll reply within one month. It's free.

If you're not happy with how I've handled your information, please tell me first and I'll put it right. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Keeping it safe

Your information is kept in password-protected systems. Only I, and the people who help me run those systems, can get into them, and only when they need to.

Under 18s

My services are for adults. I don't knowingly collect information from anyone under 18.

Changes to this policy

If I change how I use your information, I'll update this page and the date at the top.