Privacy policy
Last updated: 31 August 2026
This page explains what information The Human Lab collects about you, why we collect it, how long we keep it, and what you can ask us to do with it. It's written to be read rather than skimmed past.
Who we are. The Human Lab Ltd., company number 15712372. We're registered with the Information Commissioner's Office under number 00015349971. We're the data controller for the information described here, which means we decide what's collected and what happens to it.
How to reach us: hello@human-lab.co.uk
What we collect, and why
If you book a Lab, a class or a private session
We collect your name, email address, phone number, and whatever you tell us on the health screening form.
We need the name and contact details to run the booking and to reach you if something changes. The health information tells us whether a session is appropriate for you and what to adjust on the day.
The legal basis for the booking details is that we're performing a contract with you. Health information is a special category under UK data protection law, so we collect it with your explicit consent, given through a separate tick box on the form. You can withdraw that consent at any time by emailing us, though we may not be able to teach you safely without it.
If you attend a session
We keep brief session notes: what we tested, what we taught you, and anything you told us we should know next time. Where you've had a Capacity Check, we keep the scores so we can retest against them.
We keep these because they're how the teaching works. Without a baseline there's nothing to compare a retest to. The legal basis is our legitimate interest in teaching you properly, and for the health elements, your explicit consent.
If you join the mailing list
We collect your email address, and your name if you give it.
We send new Lab dates, class updates and practical material. The legal basis is your consent, given when you signed up. Every email has an unsubscribe link, and unsubscribing takes effect immediately.
If you contact us
We keep the message you send and the details you send it with, so we can reply and so we've got a record of what was agreed. The legal basis is our legitimate interest in responding to enquiries, and where it leads to a booking, performing a contract with you.
If your employer books us
For Humans at Work engagements we hold the contact details of the people organising it, and any health information participants give us on their own screening forms. Individual health information isn't shared with the employer. Reporting to a client is at group level only.
When you use the website
We collect analytics about which pages people read and where they arrive from. This only runs if you accept analytics cookies through the banner.
Who else sees your information
We use a small number of suppliers to run the practice. Each of them handles information on our instructions, under a contract that limits what they can do with it.
SupplierWhat they handleBookwhenBookings, health screening formsStripeCard payments. We never see your card numberBrevoMailing list and email sendingSquarespaceWebsite hosting, contact form, analyticsMicrosoft 365Email[SYSTEM]Session notes and Capacity Check records[ACCOUNTANT NAME]Invoices and transaction records[INSURER NAME]Only in the event of a claim
We don't sell your information. We don't share it for anyone else's marketing.
Some of these suppliers process data outside the UK. Where that happens it's covered by the UK's approved transfer mechanisms, which means the protections travel with the data.
We'd disclose information without your consent only where the law requires it, or where there's a serious and immediate risk to someone's safety.
How long we keep it
| What | How Long |
|---|---|
| Health screening forms and session notes | 7 years from your last session |
| Capacity Check records | 7 years from your last session |
| Booking and payment records | 6 years from the end of the tax year, HMRC requires |
| Mailing list | Until you unsubscribe. We then keep a re cord that you unsubscribed, so we don't email you again by mistake |
| Enquiries that don't become bookings | 12 months |
| Website analytics | 24 months |
When a retention period ends, we delete or securely destroy the information.
Your rights
Under UK data protection law you can ask us to:
Tell you what we hold about you, and give you a copy
Correct anything that's wrong or out of date
Delete it, where we don't have a legal or insurance reason to keep it
Restrict what we do with it while a query is resolved
Send it to you or someone else in a portable format, where you gave it to us with your consent or under a contract
Object to us using it on the basis of legitimate interest
Stop marketing to you, at any time and for any reason
Email hello@human-lab.co.uk and we'll respond within one month. There's no charge.
If you're not happy with how we've handled your information, tell us first and we'll try to put it right. You can also complain to the Information Commissioner's Office at ico.org.uk, or on 0303 123 1113.
How we keep it secure
Accounts are protected with strong passwords and two-factor authentication. Health forms and session notes are stored in [SYSTEM] and access is limited to Markus and Holly. Paper forms, where we use them, are stored securely and destroyed once transferred. We review this as the practice grows.
No system is perfectly secure. If a breach happens that's likely to put you at risk, we'll tell you and we'll tell the ICO within 72 hours.
Cookies
The website uses cookies that are necessary for it to work, and analytics cookies that tell us which pages people read and where they arrive from. The analytics ones only run if you accept them through the banner. You can change your mind at any time, or by clearing cookies in your browser.
Our booking pages are provided by Bookwhen and payment pages by Stripe, and both set their own cookies. Their policies apply to those.
Under 18s
Our sessions are for adults. We don't knowingly collect information about anyone under 18. If you think we hold information about a child, email us and we'll delete it.
Changes to this policy
We'll update this page when what we do changes. The date at the top tells you when it last changed. If a change materially affects how we use information you've already given us, we'll email you about it.
Contact