Privacy Policy

At Root & Flow Coaching, privacy is part of how I practice.

I don’t believe that because information can be collected, it necessarily should be. I aim to collect only the information I reasonably need, use it for clear purposes, protect it appropriately, and give you meaningful choices about your information wherever possible.

This Privacy Policy explains how I collect, use, store, and protect personal information through the Root & Flow website and in connection with related administrative activities.

The privacy and confidentiality of the coaching relationship are also addressed in the Coaching Agreement, which should be read alongside this policy.

1. Who this policy applies to

Root & Flow Coaching is Suzanne’s independent coaching practice, based in Ontario, Canada.

This Privacy Policy applies to personal information collected through the Root & Flow website and through related online or administrative interactions with the practice, including inquiries, booking, payment, and other activities connected to Root & Flow services.

Root & Flow may work with people in Canada and internationally, including through virtual coaching.

This policy is primarily concerned with website, administrative, and business-related information practices. The handling of information shared within the coaching relationship is also governed by the Coaching Agreement.

2. What information I may collect

Depending on how you interact with Root & Flow, I may collect:

Information you provide directly

This may include:

• your name;
• email address;
• telephone number;
• information you provide when making an inquiry;
• information provided through a booking or intake process;
• information needed to arrange or administer coaching;
• billing and payment information; and
• other information you choose to provide.

Information collected through technology

When you visit the website or use online services, certain technical information may be collected automatically. This can include information such as:

• IP address;
• browser and device information;
• pages visited;
• approximate location based on technical information; and
• information about how you interact with the website.

The amount and type of technical information collected depends on the services and settings used on the website.

3. How I use personal information

I may use personal information to:

• respond to inquiries;
• communicate with you;
• schedule and administer coaching;
• provide and support coaching services;
• manage client and business records;
• process payments and maintain financial records;
• send administrative communications;
• maintain the security and functionality of the website and services;
• understand general website use and improve the website, where analytics are used;
• meet legal, accounting, or other professional obligations; and
• otherwise use information for purposes that are reasonably connected to the relationship or that you have agreed to.

I do not use personal information for unrelated purposes simply because it is available to me.

4. Coaching information and confidentiality

Information shared during coaching is treated as confidential within the terms described in the Coaching Agreement.

The Coaching Agreement sets out the confidentiality of the coaching relationship, including the limited circumstances in which information may need to be disclosed or discussed for professional supervision, legal obligations, or serious and immediate safety concerns.

This Privacy Policy does not replace those confidentiality provisions.

5. Third-party service providers

Like most small businesses, Root & Flow relies on a number of technology and service providers to operate the practice.

Depending on the services you use, these may include providers for:

• website hosting;
• scheduling and calendar management;
• email and communications;
• payment processing;
• cloud storage;
• video conferencing;
• transcription;
• analytics; and
• other technical or administrative functions.

These providers may process personal information on behalf of Root & Flow as part of providing their services.

Some providers may be located outside Canada or may process information in other countries, including the United States.

I make reasonable efforts to select providers that offer appropriate privacy and security protections and meaningful control over how information is handled.

6. Payments

Payments may be processed through a third-party payment provider.

Root & Flow does not ordinarily receive or store your full credit card number or other complete payment-card credentials. Payment information is handled by the relevant payment provider according to its own privacy and security practices.

The Payment, Cancellation & Rescheduling Policy explains how payment arrangements, cancellations, rescheduling, pauses, and refunds work within Root & Flow coaching engagements.

7. Recording, transcription, and artificial intelligence

Recording or transcription is not assumed to be part of coaching.

If I want to record an audio portion of a coaching session for the purpose of supporting my presence, reflection, or record-keeping, I will ask for your explicit permission first. You are free to decline.

Where transcription or other technology services are used, information may be processed by the relevant third-party provider.

I make every reasonable effort to choose technology providers that give me meaningful control over how client information is used, including whether client content is used for AI model training or improvement. Where appropriate controls are available, I will use them to support client privacy and confidentiality.

I also take reasonable steps to minimize unnecessary identifying information and to protect recordings, transcripts, and other client information from unauthorized access.

The specific practices of third-party technology providers may change over time. Their own privacy policies and terms may therefore also apply.

The Coaching Agreement contains additional information about recording, transcription, confidentiality, and technology within the coaching relationship.

8. Cookies and analytics

The website may use cookies or similar technologies to support basic functionality, security, preferences, or website analytics.

Where analytics are used, the purpose is generally to understand how people use the website and improve its usefulness rather than to identify individual visitors personally.

The specific cookies or analytics technologies used may change as the website develops.

9. How I protect information

I take reasonable administrative, technical, and organizational measures to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure.

These measures may include:

• limiting access to information;
• using reputable service providers;
• using password and account protections;
• keeping software and systems reasonably maintained;
• minimizing the information collected where practical; and
• securely deleting or destroying information when it is no longer reasonably needed.

No method of electronic storage or transmission is completely secure. I cannot guarantee absolute security, but I take privacy and information security seriously.

10. How long I keep information

I keep personal information only for as long as it is reasonably necessary for the purpose for which it was collected, or as required by law.

Coaching and client records are generally retained for a limited period after an engagement ends so that I can maintain appropriate professional records, respond to questions or concerns, and meet applicable legal or professional obligations. I periodically review records and securely delete or destroy information that is no longer reasonably needed.

Financial and tax records are retained for the periods required by applicable law. In Canada, this generally means at least six years from the end of the relevant tax year.

Some information may need to be retained for longer where there is an ongoing legal, accounting, regulatory, or other legitimate requirement.

11. Your information and your choices

Depending on the circumstances and applicable law, you may have the right to:

• ask what personal information I hold about you;
• request correction of inaccurate information;
• ask questions about how your information is being used;
• withdraw consent where processing is based on consent;
• request deletion of information where appropriate; and
• raise a concern about how your information has been handled.

Some requests may be subject to legal or professional requirements that require information to be retained.

If you would like to make a request or ask a privacy question, please contact me at hello@groundworkcentre.ca.

12. Privacy concerns and complaints

If you have a question, concern, or complaint about how your personal information has been handled, please contact me first at hello@groundworkcentre.ca.

I will take your concern seriously and make reasonable efforts to understand and address it.

If you are not satisfied with the response, you may also have the right to contact the appropriate privacy oversight authority.

For Canadian privacy matters, this may include the Office of the Privacy Commissioner of Canada.

For information about privacy rights and oversight in other jurisdictions, including the European Union, see the relevant authorities listed under Further Information below.

13. For clients in the European Union

If you are located in the European Union and engage Root & Flow for coaching or other services in circumstances where the General Data Protection Regulation (GDPR) applies, I aim to handle your personal information in accordance with applicable GDPR requirements.

Lawful bases for processing

Depending on the purpose, personal information may be processed on the following lawful bases:

• Contract: to provide coaching services, manage your engagement, schedule sessions, communicate with you, and process payments.
• Consent: where you have specifically given consent, such as for recording or transcription, or where consent is otherwise required.
• Legitimate interests: for limited administrative, security, fraud-prevention, website, and business-management purposes where permitted by applicable law.
• Legal obligation: where processing is necessary to meet a legal or regulatory requirement.

International transfers

Root & Flow uses third-party service providers to support the practice, and some of these providers may process personal information outside Canada or the European Economic Area, including in the United States.

Where GDPR applies, I take reasonable steps to ensure that international transfers are supported by an appropriate legal safeguard, such as Standard Contractual Clauses or another mechanism recognized under applicable data-protection law.

Your rights

Where the GDPR applies, you may have rights including the right to:

• access your personal information;
• have inaccurate information corrected (rectification);
• request deletion (erasure) in certain circumstances;
• request restriction of processing in certain circumstances;
• receive certain personal information in a portable format;
• object to certain processing; and
• withdraw consent where processing is based on consent.

These rights are subject to certain exceptions and limitations under applicable law.

If you have a privacy concern, please contact me first at hello@groundworkcentre.ca.

You may also have the right to make a complaint to the data-protection supervisory authority in the country where you live or work, or where you believe a violation has occurred.

14. Changes to this policy

As Root & Flow grows and the technology supporting the practice changes, this Privacy Policy may be updated from time to time.

The date at the top of this page indicates when it was most recently updated.

I will aim to keep the policy clear and reasonably current rather than allowing it to become a static document that no longer reflects how the practice actually operates.

15. Contact

Related Root & Flow documents

This Privacy Policy should be read alongside:

Further information

The following resources may be useful for understanding professional coaching and privacy principles:

• International Coaching Federation (ICF) Code of Ethics
• Office of the Privacy Commissioner of Canada
• Personal Information Protection and Electronic Documents Act (PIPEDA)
• European Data Protection Board
• General Data Protection Regulation (GDPR)

The Groundwork ecosystem

Root & Flow Coaching is Suzanne’s independent coaching practice and is part of the broader Groundwork ecosystem.

Groundwork brings together complementary practices, projects, and initiatives, including Headwaters Advisory Services, Groundwork Centre, Root & Flow Coaching, and The Quiet Knowledge.

These practices and initiatives may operate independently and may have their own services, collaborators, and information practices.

Being part of the same ecosystem does not mean that personal information is automatically shared between them.