Apply Today

Privacy Policy

Website, Services & Mobile Application

Version

2.0

Effective Date

June 2026

Review Date

June 2027

Policy Owner

Data Protection Officer

This policy applies to:  chehomeopathy.com, cheonline.co.uk, the CHE mobile application, and all related services operated by CHE Health and Wellbeing Ltd.

Data Controller: CHE Health and Wellbeing Ltd  |  ICO Registration: ZB035578

Data Protection Officer: Marcus Fernandez  |  [email protected]

1. Introduction & Who We Are

CHE Health and Wellbeing Ltd (“CHE”, “we”, “us” or “our”) is committed to protecting the privacy of all individuals whose personal data we hold. This Privacy Policy explains how we collect, use, share and protect your personal data when you visit our websites, use our mobile application (“the App”), enrol on our courses, or otherwise interact with our services.

We are registered as a data controller with the UK Information Commissioner’s Office (ICO) under registration number ZB035578. This policy complies with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

In this policy, “we”, “us” and “our” refer to CHE Health and Wellbeing Ltd (the data controller, registered in England and Wales No. 10722903), which is the group holding company for CHE Online Ltd, CHE London Ltd and CHE Pro Ltd. Where you interact with a specific CHE entity, that entity may act as data controller for your personal data in conjunction with CHE Health and Wellbeing Ltd.

2. Personal Data We Collect

2.1 Website & Online Services

When you visit our websites, we may collect:

  • Usage data: IP address, browser type, operating system, pages visited, referral source, session duration and navigation paths.
  • Account data: name, email address, and login credentials when you register for an account.
  • Profile data: name, address, telephone number, gender, date of birth, educational history, employment details and profile picture.
  • Enquiry data: information submitted through contact or enquiry forms.
  • Transaction data: contact details, payment card details (processed via Stripe or PayPal) and purchase history.
  • Correspondence data: content and metadata of communications you send us.
    Marketing data: email and communication preferences, and responses to newsletters.

2.2 Mobile Application

When you use the CHE App, in addition to the data categories above, we may also collect:

  • Device identifiers: device ID, operating system version, and push notification tokens.
  • App usage data: screens viewed, features used, session length and crash/error reports.
  • In-app communications: messages sent through any in-app messaging feature.
  • Learning progress data: course completion status, assessment results, and engagement metrics recorded within the App.
  • Location data: approximate location (country/region level only) derived from IP address. We do not collect precise GPS location unless you explicitly grant permission for a specific feature.

We will always tell you at the point of collection exactly what data the App collects and why, and will request appropriate permissions before accessing any device features (such as camera, microphone or notifications).

2.2 Mobile Application

We may receive personal data about you from third-party platforms including Kajabi and Thinkific (our learning platforms), ActiveCampaign (our CRM), ConvertFlow, and accreditation bodies where relevant to your enrolment.

3. How We Use Your Personal Data

We process your personal data on the following legal bases:

Purpose
Legal Basis (UK GDPR)

Providing our educational services and the App

Contract performance

Processing enrolments, fees and transactions

Contract performance

Account management and security

Contract / Legitimate interests

Sending course updates and notifications

Contract performance

Sending marketing communications

Consent (withdrawable at any time)
Analytics and improving our website and App

Legitimate interests
Compliance with legal obligations (e.g. HMRC, accreditation bodies)

Legal obligation

Protecting vital interests in an emergency

Vital interests

Establishing, exercising or defending legal claims

Legitimate interests

4. Sharing Your Personal Data

We do not sell your personal data. We may share it with:

  • Group companies: CHE Health and Wellbeing Ltd (holding company), CHE Online Ltd, CHE London Ltd and CHE Pro Ltd, where necessary for the purposes described in this policy.
  • Payment processors: Stripe and PayPal process card payments on our behalf. Their privacy policies are available at stripe.com/gb/privacy and paypal.com.
  • Learning platforms: Kajabi and Thinkific host our online course content and hold student progress data.
  • CRM and marketing: ActiveCampaign and ConvertFlow support student communications. ConvertFlow uses Amazon Web Services and FullContact for data enrichment, both of which operate appropriate safeguards.
  • Teaching staff and lecturers: academic performance data is shared with lecturers and staff as necessary for educational administration.
  • Accreditation and regulatory bodies: we may share relevant data with the Society of Homeopaths, Middlesex University or other accrediting bodies.
  • Professional advisers and insurers: solicitors, accountants and insurers where necessary.
  • Law enforcement or regulators: where required by law or to protect rights and safety.

5. International Transfers

Some of our service providers are based in the United States, including Stripe, PayPal, ActiveCampaign, ConvertFlow, Kajabi and Thinkific. Transfers to the USA are protected by Standard Contractual Clauses approved by the UK ICO (or equivalent UK adequacy mechanisms). You may obtain a copy of the relevant safeguards by contacting our Data Protection Officer.

The UK ICO’s guidance on international transfers is available at ico.org.uk.

6. Data Retention

We retain personal data only for as long as necessary. Our standard retention periods are:

  • Student academic records (grades, attendance, assessments): minimum 3 years after graduation or leaving, maximum 5 years.
  • Application forms: minimum 3 years after graduation or leaving, maximum 5 years.
  • Transaction data: minimum 6 years (to comply with HMRC requirements).
  • Enquiry data: minimum 12 months, maximum 24 months.
  • Marketing email addresses: minimum 1 year, maximum 4 years (or until consent withdrawn).
  • App usage logs and device data: maximum 12 months unless needed for ongoing dispute resolution.

We may retain data longer where required by a legal obligation or to defend legal claims.

7. Security

We implement appropriate technical and organisational measures to protect your personal data, including:

  • Encryption of personal data in transit (TLS) and at rest.
  • Access controls and role-based permissions to limit who can access your data.
  • Regular security reviews and staff training.
  • Secure hosting within the United Kingdom.

Despite our precautions, transmission of data over the internet carries inherent risk. Please protect your account password and notify us immediately if you suspect unauthorised access.

8. Cookies & Tracking Technologies

Our websites and App use cookies and similar technologies. We use: 

  • Strictly necessary cookies: essential for the website and App to function (no consent required).
  • Analytics cookies: Google Analytics, Hotjar — to understand how users interact with our services. These require your consent.
  • Marketing/advertising cookies: Google AdSense, Facebook, LinkedIn, Pinterest — to deliver relevant advertisements. These require your consent.
  • Functional cookies: ConvertFlow, Tawk.to (live chat) — to personalise your experience.

You can manage cookie preferences at any time via our cookie consent banner or your browser settings. Detailed cookie information is provided in our Cookie Notice, available on our website.

9. Your Rights Under UK GDPR

You have the following rights in relation to your personal data:

  • Right of access: to receive a copy of the personal data we hold about you (Subject Access Request).
  • Right to rectification: to have inaccurate or incomplete data corrected.
  • Right to erasure (“right to be forgotten”): to request deletion of your data in certain circumstances.
  • Right to restrict processing: to request that we limit how we use your data.
  • Right to object: to object to processing based on legitimate interests or for direct marketing.
  • Right to data portability: to receive your data in a structured, machine-readable format.
  • Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting prior processing.
  • Right to complain: you have the right to lodge a complaint with the ICO (ico.org.uk, 0303 123 1113).

To exercise any of these rights, contact our Data Protection Officer at [email protected], or write to us at the address below. We will respond within one calendar month.

10. Children

Our services are directed at persons aged 18 and over. We do not knowingly collect personal data from individuals under 18. If we become aware that we hold personal data of a person under 18, we will delete it promptly.

11. Third-Party Links

Our websites and App may contain links to third-party websites. We are not responsible for the privacy practices of those sites and recommend you review their privacy policies before providing any personal data.

12. How to Delete Your Data

You have the right to request deletion of your personal data at any time, subject to our legal retention obligations.

  • By email: send a deletion request to [email protected] with the subject line ‘Data Deletion Request’.
  • In-App: go to Settings > Account > Delete My Account to request deletion of your App account and associated data.
  • By post: write to the Data Protection Officer at the address in Section 14.

We will delete or anonymise your data within 30 days and confirm this to you by email. Some data must be retained to comply with legal obligations (e.g. financial records for 6 years under HMRC requirements, academic records for up to 5 years for accreditation purposes). We will inform you of any such retention at the time of your request.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will publish any changes on our website and, where changes are significant, notify you by email. The version date at the top of this document indicates when it was last updated.

14. Contact Us

If you have any questions about this policy or wish to exercise your rights, please contact:

Data Protection Officer: Marcus Fernandez

Email: [email protected]

Post: CHE Health and Wellbeing Ltd, 4th Floor, 100 Fenchurch Street, London EC3M 5JD

Tel: 020 3405 4580

ICO Registration: ZB035578