Privacy Notice
This notice explains how Eric Maina (“I”, “me”), based in Nairobi, Kenya, collects and uses personal information through ericmaina.com and in connection with my coaching, including the Room for Health programme. I am the data controller for the information described here.
Privacy contact: eric@ericmaina.com
Who this applies to
This notice applies to website visitors, people who book an introductory conversation and coaching clients. Kenya’s Data Protection Act, 2019 applies to my processing. Other privacy laws may also apply depending on where you are located.
Information I collect
- Booking information: when you book an introductory conversation, your name, email address, the time you choose, your time zone and, only if you choose to share it, your WhatsApp number.
- Correspondence: emails and, if you use it, WhatsApp messages you send me, including anything you choose to include in them.
- Coaching information (clients only): your coaching agreement, written check-ins, session notes and any plans we create together. Because Room for Health concerns health habits, this may include health or wellbeing information that you choose to share. Please share only what is relevant to your coaching.
- Payment information (clients only): the amount, date and reference of each payment, and the details shown on the M-Pesa, bank or Stripe confirmation, such as the payer’s name, phone number, account name or email. Card payments are processed by Stripe; I do not receive or store your full card number. I never receive your M-Pesa PIN, card PIN or online banking credentials.
- Technical information: basic server logs needed to deliver and protect the website, such as IP address, browser type, timestamps and requested pages. If you separately allow it, Google Analytics may also collect device and usage data.
The booking form does not ask for health information. Please don’t include medical details when you book or email me before we have spoken.
Why I use information and the lawful basis
| Purpose | Lawful basis |
|---|---|
| Arrange and hold an introductory conversation, and reply to enquiries. | Steps taken at your request before entering a contract. |
| Provide coaching, reply to check-ins, keep session notes and administer the programme. | Performance of the coaching contract. For health information you choose to share, your explicit consent, which is requested in the coaching agreement. |
| Receive payments, issue electronic receipts and keep business records. | Performance of the contract and compliance with legal obligations, including tax and accounting rules. |
| Protect someone’s vital interests or comply with a lawful disclosure requirement. | Vital interests or legal obligation, as applicable. |
| Measure website use with Google Analytics. | Your optional analytics consent. |
You may withdraw consent at any time. Withdrawal does not affect processing that was lawful before you withdrew. If you withdraw consent to health information being used in coaching, I may not be able to continue the programme in a useful way, and we will discuss what that means.
Who receives information
I do not sell personal information. I share only what is reasonably necessary with the services I use to run my work:
- Hostinger for website hosting and for my email account (eric@ericmaina.com);
- Calendly for booking introductory conversations and sessions;
- Google for Google Calendar, which holds my schedule, and Google Analytics if you allow it;
- Zoom for video calls, or another video service named in your coaching agreement;
- WhatsApp (Meta), only if you share your number, for scheduling messages;
- Safaricom (M-Pesa), my bank and Stripe for receiving payments.
Some of these providers act on my instructions; others, such as payment providers and WhatsApp, also process information under their own terms and privacy policies. Information may also be disclosed to a professional adviser or authority where reasonably necessary to comply with law, respond to valid legal process, protect someone from imminent danger, or establish or defend legal rights.
International transfers
Several of these providers, including Calendly, Google, Meta, Zoom, Stripe and Hostinger, may store or process information outside Kenya. I choose established providers with published security and privacy commitments, and I keep what I store with them to a minimum. Where Kenyan law requires specific safeguards or consent for a transfer, I will rely on them. Coaching notes containing health information are not placed in these services beyond what is needed to deliver the programme.
Security and confidentiality
I use proportionate measures to protect information, including two-factor authentication on accounts that hold client or booking information, limited collection and regular deletion. Coaching information is kept confidential within the limits set out in the coaching agreement and the Coaching Scope.
No internet, email, messaging or storage system is completely secure. Please use a private device and location where practical, and avoid sending highly sensitive details through ordinary messaging.
Sessions are not recorded. Coaching content is not put into a generative-AI tool unless you are told in advance and agree.
If a personal-data incident occurs, I will investigate, limit further exposure and notify the regulator and affected people where and within the time required by law.
How long I keep information
| Record | Standard retention |
|---|---|
| Booking details and messages from people who do not become clients | Up to 90 days after the last contact. |
| Coaching agreement, check-ins, session notes and programme correspondence | Up to 24 months after the programme ends, unless a complaint or legal claim requires longer. |
| WhatsApp scheduling messages | Deleted within 90 days after the programme ends or the conversation closes. |
| Payment records and receipts | For the period required by Kenyan tax, accounting and legal rules. |
| Privacy-choice record in your browser | 180 days, after which the site asks again. |
Records are then securely deleted or anonymised where reasonably possible. Limited backup copies may remain until they are overwritten in the provider’s ordinary backup cycle.
Your privacy rights
Subject to the law and any lawful exception, you may ask to be informed about how your information is used; access it; correct inaccurate or misleading information; ask for it to be deleted; object to or restrict its use; and withdraw consent.
To make a request, email eric@ericmaina.com. I may ask for information needed to confirm your identity, and I will respond within the period the law requires.
If you are unhappy with how I have handled your information, please contact me first so I can try to put it right. You may also complain to Kenya’s Office of the Data Protection Commissioner.
Cookies and browser storage
The site stores an essential privacy-choice record in your browser for 180 days. Google Analytics remains off unless you allow analytics. You can reopen Privacy choices in the footer and withdraw your choice at any time. Withdrawal stops analytics collection from this site and attempts to remove related first-party cookies. If browser storage is unavailable, optional analytics stays off.
The site’s analytics configuration removes query strings, URL fragments and external referrer details, and disables Google advertising personalisation signals. Meta advertising measurement is not enabled on this site.
Children
The website and coaching are for adults aged 18 or over. If you believe a child has provided information, please contact me so it can be deleted.
Marketing
I do not send marketing emails, and booking a conversation does not add you to a mailing list. If I start a newsletter, joining it will be a separate choice with a way to unsubscribe. I do not use automated decision-making to accept or decline clients.
Changes to this notice
I will update this notice when my services, providers or the law change. The date at the top shows the latest revision. I will tell active clients about changes that affect them.