Privacy Policy

1. Who We Are

Thrive Portal is operated by CM Training. We are committed to protecting your personal data and being transparent about what information we collect, how we use it, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. What Data We Collect

We collect and process the following personal data:

• Account information: Your name and email address
• Daily recap entries: Battery levels, selected signals, tools used, reflections, and wins you record
• Energy accounting data: Energy deposits and withdrawals you log, including sources and values
• Task completion data: Tasks assigned by your coach and their completion status

3. Legal Basis for Processing

We process your data based on legitimate interest (to provide coaching services you have engaged with) and consent (which you provide when you sign up and use this portal). Health-related data (such as energy levels and wellbeing signals) is processed with your explicit consent.

4. How We Use Your Data

• To provide personalised coaching worksheets and tools
• To allow your coach to monitor your progress and tailor support
• To allow you to track patterns in your energy, signals, and wellbeing over time
• To maintain your account and provide the service

5. Who Can See Your Data

Your data is accessible only to you and your assigned coach. We do not share, sell, or disclose your data to any third parties. Your coach can see your recap entries, energy logs, and task progress to provide effective coaching support.

6. Data Storage & Security

Your data is stored securely in an encrypted database. All connections use HTTPS encryption. Passwords are hashed using industry-standard bcrypt encryption and are never stored in plain text.

7. Your Rights

Under UK GDPR, you have the right to:

• Access your data — you can export all your data at any time from Settings
• Rectification — request corrections to inaccurate data
• Erasure — request deletion of your account and all associated data from Settings
• Restrict processing — ask us to limit how we use your data
• Data portability — receive your data in a structured, machine-readable format
• Withdraw consent — at any time, by deleting your account

8. Data Retention

We retain your data for as long as your account is active. If you delete your account, all associated data is permanently removed within 30 days. If your coaching engagement ends, we will retain your data for up to 12 months unless you request earlier deletion.

9. Cookies

This portal uses only essential cookies required for authentication and security. We do not use advertising, analytics, or tracking cookies. Essential cookies cannot be disabled as they are necessary for the portal to function.

10. Contact

For any questions about your data or to exercise your rights, please contact CM Training at cmtraining.co.uk.