Ian Bibby Coaching ("we", "us", or "our") is committed to protecting your privacy. This policy explains how we collect, use, and safeguard your personal information when you use our website and coaching services.

Information We Collect

We collect information you provide directly to us, including:

Contact information: Name, email address, phone number when you enquire about coaching or sign up for our newsletter
Coaching data: Training data, performance metrics, health information, and goals shared as part of the coaching relationship
Payment information: Billing details processed securely through Stripe (we do not store card details)
Communications: Messages sent via email, contact forms, or WhatsApp

We also measure how the website is used, so we know which pages are worth writing and which are not. We do this in a way that cannot identify you, using two tools:

1. Our own measurement. This one is ours, not a third party's: when you leave a page, your browser sends a single summary of that page view to this website's own server, and it is stored in our own database. No outside company is involved and nothing is shared with one. That summary contains:

Which kind of page you were on, not which page. We record a template — "a blog post", "a climb page" — so we can see that the blog is read without recording which article you read. Anything we do not recognise is stored simply as "(other)", and anything after a "?" in the address is discarded.
Which website you arrived from, if any — the site's name only, never the full link
Campaign tags (utm_source, utm_medium, utm_campaign), if you followed a marketing link
How long the page was open and visible, and how far down it you scrolled
Whether your screen is phone, tablet or desktop sized — a category, not your actual screen size
Your country, which our server reads from the network connection

What that deliberately leaves out matters as much as what it contains. We never record or store your IP address — not even scrambled, because a scrambled IP address is still personal data with extra steps. We do not record your browser's user-agent string, we do not read anything else out of the web address, and we do not give you an identifier that survives the page. A page view cannot be linked to the one before it, so there is no trail through the site attached to you, no way for us to follow you between visits, and no profile to build. Individual page-view records are deleted automatically after 90 days, leaving only daily totals.

If your browser says no, we do not measure. If you have Global Privacy Control enabled, or "Do Not Track" switched on, this sends nothing at all.

2. Cloudflare Web Analytics. This one is a third party — a small script loaded from Cloudflare, the company that already serves this website to you. We use it because it reports how quickly pages genuinely load for real visitors, which our own measurement does not tell us. In Cloudflare's own words, it uses no client-side state such as cookies or localStorage, and does not fingerprint visitors by IP address or user-agent string. It gives us page-load speed and page-view counts, and nothing about you as an individual. It is the only third-party script on this website.

Neither tool stores anything on your device or reads anything from it. Under the Privacy and Electronic Communications Regulations consent is required for storing or accessing information on your device, and since neither of these does that, neither requires consent — which is why this site has no cookie banner.

Health and Medical Data

As part of our coaching onboarding process, we collect health information through our Health Questionnaire. This includes:

Physical Activity Readiness (PAR-Q) responses
Emergency contact details
GP surgery contact information
Training history and current fitness information
Details of any injuries, conditions, or ongoing treatment

This data is classified as "special category data" under UK GDPR (Article 9) and is processed on the basis of your explicit consent (Article 9(2)(a)), which you provide when completing the questionnaire.

Your health data is:

Encrypted before it is stored. Your answers to the PAR-Q health questions, along with your date of birth, address, emergency contact, GP details and any injuries or treatment you describe, are encrypted (AES-GCM) before being written to our database, which is hosted by Cloudflare in its Western Europe region. The decryption key is held separately from the database, so the stored records cannot be read from the database alone.
Kept out of email. When you submit the form, your coach is notified that a questionnaire has arrived and has to sign in to read it. No health information is sent by email, because email is forwarded, quoted and backed up in places we cannot control.
Readable only by your coach (Ian Bibby), through an administrative area protected by Cloudflare Access. Every time a health record is opened, that access is recorded first — if it cannot be recorded, the record is not shown. Two non-clinical flags — whether any PAR-Q answer needs following up, and whether you have confirmed GP clearance — are stored unencrypted so that routine safety checks do not require opening your medical history at all.
Not shared with any third-party service provider, and never used for marketing
Used solely for the purpose of providing safe and effective coaching services
Retained for 7 years, then deleted automatically, for liability and record-keeping purposes

You may withdraw your consent to health data processing at any time by emailing [email protected] or using the contact page. You do not have to give a reason. Please note that coaching services may not be able to continue without this information, as it is essential for your safety.

How We Use Your Information

We use your personal information to:

Provide personalised coaching services and training plans
Process payments and manage subscriptions
Send you training-related communications and updates
Send newsletters and marketing emails (with your consent)
Improve our services and website
Respond to your enquiries and support requests

Data Sharing

We do not sell your personal information. We may share data with:

Hosting and storage: Cloudflare, which serves this website and hosts the database your enquiry or questionnaire is stored in. That database runs in Cloudflare's Western Europe region, and read replication is switched off, so there are no copies of it running in other regions. See Cloudflare's Privacy Policy
Email delivery: Resend, which delivers the emails we send you — confirmations, replies and newsletters. They handle the message in order to deliver it; no health information is ever put in an email
Website analytics: Cloudflare Web Analytics, as described above. It collects no personal data and sets no cookies, so there is nothing about you to share
Service providers: Resend (transactional email); TrainingPeaks (coaching platform); Stripe (payments, once enabled)
Trusted third parties used to run the coaching service: a small number of everyday business tools — for example the ones that tell Ian an enquiry has arrived, or that help arrange sessions with you. Where one of these is involved it receives only what it needs to do its job, which is typically your name and the fact that you have been in touch. No health or medical information is ever shared with any of them, and none of them is used for marketing or advertising.
Country lookup: when — and only when — you open one of our contact forms, your IP address is sent to ipapi.co so the country field can be pre-filled. Nothing is sent if you never open a form, and you can simply pick your country from the list instead.
Legal requirements: When required by law or to protect our rights

All third-party providers are contractually obligated to protect your data.

Data Security

We implement appropriate technical and organisational measures to protect your personal information, including:

Secure, encrypted connections (HTTPS)
Encryption of health data before it is written to storage, with the key held separately from the database
Administrative access protected by Cloudflare Access, with sign-in required and access to health records logged
Secure payment processing through Stripe (we never see or store your card details)
Limited access to personal data on a need-to-know basis
Automatic deletion of data once its retention period expires, rather than relying on manual housekeeping
Regular review of security practices

Your Rights

Under UK GDPR, you have the right to:

Access the personal data we hold about you, and get a copy of it
Correct anything inaccurate or incomplete
Delete your data ("the right to erasure")
Object to us processing your data, including for marketing — if you object to marketing, we must stop
Restrict how we use your data while a query about it is being resolved
Portability — receive the data you gave us in a machine-readable form, or have it sent elsewhere
Withdraw consent at any time, wherever we relied on your consent. This includes withdrawing the explicit consent for health data you gave on the Health Questionnaire — see the section above, and note that withdrawing it may mean coaching cannot safely continue

How to exercise them: email [email protected], or use the contact page if you would rather not use email. Tell us what you want and we will do it — you do not need to quote legislation or use any particular form. We will respond within one month, which is the deadline UK GDPR sets us. There is no charge.

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain directly to the UK's data protection regulator, the Information Commissioner's Office, at ico.org.uk/make-a-complaint or on 0303 123 1113. Complaining to them does not cost you anything and does not require our agreement.

Cookies and on-device storage

This website sets no cookies at all — not for analytics, not for advertising, not for anything else. There is no cookie banner because there is nothing to consent to.

A few features do save small amounts of information in your own browser's storage. None of it is an identifier, and none of it is used to track you here or on any other site. Most of it never leaves your browser at all; where a value does reach us, it is only because it forms part of a form you chose to submit. It stays on your device until you clear it. In full, everything this site can store:

Your rider profile — the weight, FTP and unit preference you type into the climb calculator and training tools, so you do not have to re-enter them on every page or on your next visit. This never leaves your browser; we cannot see it.
Form drafts — if you are part-way through the coaching questionnaire or health questionnaire, your answers are kept for the life of the browser tab so that an accidental refresh does not lose your work. They are discarded when you close the tab or submit the form.
A submission reference for the health questionnaire, so that pressing submit twice cannot create two copies of your record.
Anti-spam counters — a count of how many enquiries have been sent from this browser in the past hour, used to block automated abuse of our contact forms.
"Already seen" and "already signed up" flags — so the newsletter prompt is not shown to you repeatedly, and never again once you have signed up.
Your country, if it was looked up when you opened a contact form (see "Country lookup" under Data Sharing above), so the lookup is not repeated while you are on the site.

We consider all of the above strictly necessary for the features you have chosen to use, or for security, which is why we do not ask for consent to store it. The alternatives would be to lose your work on a refresh, ask you the same questions repeatedly, or show you the same prompt on every page.

Clearing it: everything listed above can be removed at any time by clearing site data for ianbibby.cc in your browser settings, or by browsing in a private window. Nothing will break; you will simply be asked for your details again.

Newsletter & Marketing

If you subscribe to our newsletter, we'll send you training tips and updates. We manage the mailing list ourselves rather than through a third-party marketing platform; the emails themselves are delivered by Resend. We only send marketing email to people who have asked for it and confirmed the request, and every message carries a one-click unsubscribe link. Unsubscribing takes effect immediately and is recorded so it cannot be undone by a later sign-up form.

Enquiring about coaching does not sign you up to anything. Marketing consent is a separate, optional tick.

Data Retention

We keep personal data only as long as we need it, and deletion is automatic rather than something we have to remember to do:

Health questionnaires: 7 years, for liability and record-keeping
Enquiries that did not become coaching: 2 years
Enquiries that became coaching: 7 years, alongside the coaching record
Contact details: 3 years after your last activity, unless you are an active client
Record of consent (what you agreed to, when, and the exact wording): 7 years. We keep this deliberately, because "did this person agree to be emailed?" is a question we may need to answer long after the enquiry itself has been deleted.
Website analytics: 90 days for individual page-view records, after which only aggregate daily counts remain. There is no personal data in either.

If you ask us to delete your data, we remove your personal details but keep the record that you unsubscribed or objected — otherwise a later sign-up could quietly undo your own request. You can request deletion at any time.

Children's Privacy

Our services are not directed at individuals under 18. We do not knowingly collect personal information from children. If coaching services are provided to under-18s, parental consent is required.

Changes to This Policy

We may update this privacy policy from time to time. We will notify you of significant changes by posting the new policy on this page and updating the "last updated" date.

Contact Us

If you have questions about this privacy policy or our data practices, contact us at:

Email: [email protected]
Or use the contact page
Address: Lancashire, United Kingdom

IMB TRADING LTD (company number 16419234), a company registered in England and Wales and trading as Ian Bibby Coaching, is the data controller for everything described in this policy — including the health data covered by the Health and Medical Data section above. Registered office: 91 Broadwood Drive, Fulwood, Preston, Lancashire, PR2 9TE, United Kingdom.

Privacy Policy