Privacy Policy

VitalCore LLC, Lewes, DE 19958, United States, is the controller for its website presentation and the enquiries it receives. Contact: ianapriestley.it@gmail.com. The website presents Iana Priestley’s nutrition and lifestyle coaching, educational courses, guides and menus. This notice covers browsing and initial enquiries. A separate, specific notice is needed before collecting information for an individual consultation or mentoring programme.

When a page is requested, the hosting and delivery infrastructure processes technical information such as IP address, request time, requested resource, browser information, response and security events. The site is hosted using OpenAI Sites and Cloudflare infrastructure. A private review version also requires sign-in managed by the platform; this is separate from a coaching account. The website application has no registration form, contact form, newsletter form, upload area, checkout or payment-card fields. It contains no application analytics scripts, advertising pixels, embedded social feeds or automated profiling tools.

If you choose email or WhatsApp, we receive the information you send, which may include your name, contact details and the content of your enquiry. These services process data under their own terms and notices as well. Please send only what is necessary for an initial enquiry. Do not send laboratory results, diagnoses, medical records or other sensitive documents before receiving the specific service privacy information and instructions for an appropriate submission channel. Simply opening a page does not send a message or subscribe you to marketing.

Purpose	GDPR basis where applicable
Deliver pages, maintain availability, prevent abuse and investigate technical incidents	Article 6(1)(f): legitimate interests in operating and protecting the website, balanced against visitors’ rights
Respond to a request about a service or purchase	Article 6(1)(b): steps requested before entering a contract; Article 6(1)(f) for other ordinary correspondence
Handle requests about privacy and comply with applicable duties	Article 6(1)(c), where a relevant legal obligation applies
Establish, exercise or defend legal claims	Article 6(1)(f): legitimate interest in protecting legal rights

No marketing consent is inferred from browsing, contacting us or purchasing a product. No newsletter collection or marketing tracking is implemented on this website. Any future optional tracking or marketing must be separately explained and, where required, activated only after valid consent.

The public website does not ask visitors to submit health data. A consultation may involve special categories of personal data under Article 9 GDPR; the cookie banner is not consent for that processing. Before such intake, the controller must provide service-specific information and identify both an Article 6 basis and a valid Article 9 condition, including separate explicit consent where relied on. This notice alone does not authorise a health-data intake or the reuse of health information for advertising.

Courses, guides and menus are purchased on Stan Store, outside this website. No payment is taken by priestley.health. Stan and any payment provider apply their own notices to their processing. As seller, VitalCore may receive the order and customer details needed to provide the purchase, answer related enquiries and meet applicable obligations; hosting the checkout elsewhere does not remove the seller’s responsibilities. Product and checkout notices govern the particular purchase. Other external links, including WhatsApp and Notion services pages, open only when selected; their operators’ privacy and cookie rules apply on those services.

Data may be handled by authorised people and providers supporting website hosting, security, email and communications, and by professional advisers or competent authorities where necessary. A provider acting on our instructions requires the appropriate data-processing arrangements; some providers also act independently for their own service purposes. The controller is based in the United States, and the hosting, communications and purchase services may process information outside the EEA. Where GDPR Chapter V applies, transfers require an applicable adequacy decision or appropriate safeguards, such as standard contractual clauses with any necessary supplementary measures. A provider’s US address is not proof of an adequacy certification, and using a service does not by itself establish safeguards. Contact the controller for the countries, recipients and safeguards applicable to your processing and a copy or description of relevant safeguards, with confidential information protected.

Ordinary pre-contract enquiries are retained only for handling the request and follow-up, with a review no later than 12 months after the last interaction; unnecessary information should be deleted earlier. If an enquiry becomes a contract, the relevant service notice and applicable recordkeeping obligations govern the resulting records. Transaction or tax records are retained for the period required by the law actually applicable to the seller and the transaction; this website does not impose a universal ten-year period on every record. Information needed for a dispute is limited to what is necessary for the applicable limitation period and any legal hold. Technical log and platform-account retention is controlled by the relevant infrastructure arrangements and provider notices; this application does not maintain its own visitor database. The cookie notice describes the application’s temporary choice state.

Where GDPR applies, you may request access, rectification, erasure, restriction and, where its conditions are met, portability. You may object to processing based on legitimate interests on grounds relating to your situation; objection to direct marketing is unconditional. Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing. These rights are subject to their statutory conditions and exceptions. Write to the privacy contact above. Identity information will be requested only where reasonably needed to verify the request. GDPR requests are answered without undue delay and normally within one month; an extension of up to two additional months is possible where justified, with reasons notified within the first month. Requests are generally free, subject to the narrow statutory exceptions. You may complain to your competent supervisory authority, including the Italian Garante or the authority in the EEA country of your habitual residence, workplace or alleged infringement. You do not have to contact us first.

Providing an initial enquiry is voluntary. Without enough contact information, we may be unable to reply or take requested contractual steps. Refusing optional cookies does not prevent access to website content. This website does not implement decisions based solely on automated processing that produce legal or similarly significant effects. The general website is intended for adults; it offers no child registration or direct online collection for children. Any service concerning a minor requires a separate intake process and the relevant legal checks.

The site is served over HTTPS when its certificate is active. Access restrictions and provider security features support protection, but no online channel is risk-free. Avoid sending sensitive material in an initial message. We review this notice when the website, providers or processing change. New purposes requiring consent will not be enabled merely by updating this text. If you are outside the EEA, any mandatory local rights applicable to your circumstances remain unaffected; a translation does not certify compliance with every country’s legislation.