TFC
Coach

Legal

Privacy Policy

Last updated: 26 September 2026

1. Who we are

This site is operated by Compass Technologies Ltd, trading as TFC Health (“TFC”, “we”, “us”), a company registered in England and Wales with company number 16573761, registered office 45 Lavender Sweep, London SW11 1DY, United Kingdom. We are the data controller for the personal data described below.

If you have any questions about this policy or how we handle your data, email tfchealthmedia@gmail.com.

2. What we collect

  • Analytics data — pages you visit, how long you stay, what you click, your country, your device type, your browser. Collected via Vercel Analytics (always on, anonymised, cookieless), Google Analytics 4, and Microsoft Clarity session recordings & heatmaps (the last two only with your consent). Clarity recordings mask all text and form input, and we do not record our checkout pages.
  • Purchase data — if you buy our guide, Stripe collects your name, email, billing address, and card details. Stripe processes these on our behalf. We never see or store your card details.
  • Email — if you buy something, we send transactional emails (receipt, download link) and a short onboarding series for that product. We also send an occasional marketing email (new guides, new editions, changes in the evidence) to buyers, Duncan members and people who sign up for a free chapter or our emails. You can refuse these when you give us your address (at checkout or on the Duncan sign-in card), and every marketing email has a one-click unsubscribe. We record which page you signed up on so we only send you relevant things.
  • Support correspondence — if you email us, we keep a record of the conversation so we can help you and learn from common questions.

3. Duncan, our AI health coach (health data)

If you use Duncan, our AI coaching chat at tfchealth.io/coach, we process additional data. Some of what you tell Duncan (your goals, diet, supplements, how you sleep and feel) is health information: special category data under UK and EU GDPR and sensitive personal information under the California CPRA. We treat it accordingly.

  • Account and chat data — your email address (sign-in), your conversations with Duncan, and per-message usage records. Stored in our database (Supabase) with per-user access controls.
  • Coach memory (members only, with your explicit consent) — if you are a paying member and choose to set up a profile, we store a short set of details you give us (sex, age band, activity level, diet style, goal, supplements and any notes) plus a rolling summary of your conversations, so coaching gets personal over time. This is optional and members-only: free accounts are stateless and Duncan does not remember them between sessions. You can view, edit, switch off or delete this in Account at any time, and switching it off immediately deletes the stored profile and summary.
  • AI processing — your messages are sent to Anthropic (the maker of Claude, the AI model Duncan runs on) to generate replies, and to OpenAI to power search over TFC's own content library. Both process this data as our processors, under data processing agreements, and do not train their models on it.
  • Safety records — if a conversation triggers our crisis-safety protocol (for example mentions of self-harm), we keep a minimal internal safety log so we can review that the protocol worked. We never use your health data for advertising, and we never sell it.

The legal basis for coach memory is your explicit consent (UK GDPR Article 9(2)(a)), collected separately at onboarding and withdrawable at any time. Chat delivery itself is processed under contract. Duncan is for adults (18+) and provides general wellness education, not medical advice; see the Terms for the full description.

You can export everything Duncan holds about you as JSON, or delete your account entirely, from the Account page. Deletion removes your profile, memory, conversations and account immediately, with backups purged within 30 days. Conversations older than 12 months are deleted on a rolling basis.

4. Legal basis

We rely on the following lawful bases under UK GDPR:

  • Contract — processing your purchase and delivering the guide you bought.
  • Consent — the Google Analytics 4 cookies and tracking only fire after you click “Accept” on the cookie banner. You can withdraw consent at any time using “Privacy settings” in the footer.
  • Legitimate interest — running cookieless analytics (Vercel Analytics) to understand site performance, and responding to your support emails.
  • Marketing emails — for buyers and Duncan members, the “soft opt-in” under the Privacy and Electronic Communications Regulations (similar products only, with a chance to refuse when we collect your address and in every email); for free-chapter and newsletter sign-ups, your consent, which you can withdraw at any time.
  • Legal obligation — keeping records of purchases for tax and accounting law.

5. Third parties we use

We use a small set of trusted services to run the site. Each has its own privacy policy:

Some of these providers are based in the United States. Transfers happen under the UK extension to the EU-US Data Privacy Framework or the UK International Data Transfer Agreement, with standard contractual clauses where applicable.

6. Cookies and analytics

We use as few cookies as possible. None for advertising. None for tracking you across other websites.

  • Strictly necessary — small data points needed to make the site work (e.g. your cookie-banner choice). Always on.
  • Analytics (consent required) — Google Analytics 4 and Microsoft Clarity. Off by default. They only fire after you click “Accept” on the banner. We use Google Consent Mode v2 for GA4, and the Clarity recording script is not even loaded until you say yes — so decliners are never recorded.
  • Cookieless analytics — Vercel Analytics. No cookies, no fingerprinting, no cross-site identifiers. Always on.

Change your mind any time using “Privacy settings” at the bottom of any page.

7. How long we keep your data

  • Purchase records: 7 years (UK tax law).
  • Email correspondence: until it is no longer relevant, typically 2 years.
  • Analytics data in Google Analytics 4: 14 months (the GA4 default; user-level data deleted after that).
  • Session recordings in Microsoft Clarity: 30 days (Clarity’s default; aggregated heatmaps may persist longer in anonymised form).
  • Analytics data in Vercel Analytics: 90 days.
  • Marketing email list: until you unsubscribe. After that we keep only your address on a suppression list, so we never email you again by mistake.

8. Your rights

Under UK GDPR you have the right to:

  • Ask what data we hold about you
  • Ask us to correct inaccurate data
  • Ask us to delete your data (subject to legal retention)
  • Ask for your data in a portable format
  • Object to or restrict our processing
  • Withdraw consent for analytics any time
  • Complain to the ICO if you think we have got it wrong

Email tfchealthmedia@gmail.com to exercise any of these rights. We will reply within 30 days.

9. Children

This site is not directed at children, and Duncan (the AI coach) is strictly 18+: you confirm you are 18 or over at sign-in, and we record that confirmation. We do not knowingly collect data from anyone under 18; if you believe we have, contact us and we will delete it.

10. Changes to this policy

If we make a material change we will update the “Last updated” date at the top of this page and, where appropriate, re-prompt you for cookie consent.