Privacy Notice

JELM Consulting Limited, trading as Breakthrough That
Effective date: 10 October 2026
Version: 1.1

1. Who we are

JELM Consulting Limited is the controller of the personal information described in this notice. Breakthrough That is our trading name.

• Company number: 08294047
• Registered office: 17–19 Station Road West, Oxted, Surrey, RH8 9EE, United Kingdom
• Privacy contact: privacy@breakthroughthat.com

This notice applies when you visit our websites, contact us, subscribe to our emails, create an account, buy or use one of our courses or programmes, join a community or event, attend coaching or a retreat, or otherwise interact with us.

2. Information we collect

Depending on how you interact with us, we may collect:

• your name, email address, telephone number, address and communication preferences;
• account, enrolment, purchase and payment-status information;
• course progress, attendance, assignments, reflections and community activity;
• enquiries, emails, support messages, feedback and testimonials;
• recordings, transcripts, images or chat contributions where recording has been disclosed or specifically agreed;
• technical information such as your IP address, device, browser, login activity and website or email engagement; and
• health, wellbeing or other personal information that you choose to share with us.

Payments are processed through payment providers such as Stripe or PayPal. We do not ordinarily receive or store your complete card number or card security code.

Please do not include detailed medical records or unnecessary sensitive information in a general website enquiry. If we need health or wellbeing information to assess or deliver a service, we will explain why it is needed and how it will be used.

3. How and why we use information

We use personal information to:

• respond to enquiries and discuss services you have asked about;
• create and administer accounts, purchases and enrolments;
• deliver courses, coaching, programmes, calls, communities, events and retreats;
• provide support and send important service or security messages;
• process payments, refunds, invoices, tax and accounting records;
• operate, secure and improve our websites and services;
• manage complaints, safeguarding concerns and legal claims; and
• send marketing where you have agreed to receive it or where another lawful electronic-marketing rule properly applies.

Our lawful bases may include:

• contract, where processing is needed to take steps you request or to provide something you have bought;
• consent, including for email marketing and some uses of health information, recordings, testimonials or case studies;
• legitimate interests, such as responding to enquiries, supporting customers, keeping our systems secure and administering our business, where those interests are not overridden by your rights; and
• legal obligation, including tax, accounting and regulatory requirements.

If information is genuinely necessary to provide a service, we may be unable to provide that part of the service without it. Optional information will be identified where appropriate.

4. Health and wellbeing information

Information about physical or mental health is special-category data and receives additional protection.

Where we intentionally ask for health or wellbeing information to assess suitability or tailor our non-clinical work, we will identify both a lawful basis and an additional legal condition. This will often include asking for your explicit consent. You may withdraw consent for future processing, although this does not make earlier lawful processing invalid and may affect our ability to provide a service that genuinely requires the information.

We use a proportionate approach:

• general courses and webinars do not require a health-data consent where we do not ask for or infer health information;
• enrolment in a condition-specific course may itself reveal or suggest health information, so we may use a short, separate explicit-consent statement to administer that course and related support;
• personalised coaching, suitability screening or work with a minor may use a fuller intake consent where health information is genuinely needed; and
• identifiable health discussions that will be retained in a recording require clear recording information and any additional agreement appropriate to that use.

We do not assume that purchasing a condition-specific course means that the purchaser personally has that condition. We do not use an inferred health condition to target unrelated marketing without the separate permission and legal basis required.

We do not provide medical diagnosis or emergency healthcare. Our services are not a substitute for advice, diagnosis or treatment from an appropriately qualified healthcare professional.

If you participate in a group or community, please consider carefully how much personal or health information you share with other participants.

Group calls are normally recorded unless we state otherwise. Joining information will explain the purpose of the recording, who can access it and how long it is intended to remain available. One-to-one calls are recorded only where requested and agreed or otherwise specifically agreed in advance. If a programme recording is intended to be included in another product, we will disclose that intended use and obtain any additional permission needed for identifiable participant contributions.

Biofeedback and EEG

At some retreats and sessions we offer optional biofeedback, such as EEG (brainwave) readings using a Muse headband and the Mind Monitor app, or heart-rhythm readings using HeartMath. Taking part is always your choice. If you do:

• we explain what will be recorded and ask for your explicit consent before recording anything;
• we record the readings and the graphs made from them, and use them only to help you see and understand your own state during the retreat or session;
• we treat this as sensitive, health-related information. Results are usually stored in our Dropbox account, and only John and Linda have access to the stored files;
• we never publish your readings, for example in a Substack article, without your separate written permission, and anything we publish is anonymised unless you agree otherwise;
• we keep the readings only for the retreat or session and delete them soon afterwards, unless you ask us to keep them; and
• you can withdraw your consent at any time. We will stop recording and delete what we hold, apart from anything already published with your permission.

5. Email marketing and Substack

Where we rely on your consent for marketing, you can withdraw it at any time by using the unsubscribe link or emailing privacy@breakthroughthat.com.

Unsubscribing from marketing does not prevent us sending necessary messages about an account, purchase, programme, security issue or support request. We may keep a minimal suppression record so that we can respect your decision not to receive marketing.

Our Breakthrough That email list and our Substack publication are separate subscription choices. Joining one does not automatically subscribe you to the other. Substack also provides its own privacy information for the processing it controls.

6. How we use artificial intelligence

We use selected artificial-intelligence, transcription and editing tools primarily with our own teaching, research, business, website and content-development material. These tools may help us transcribe recordings, organise teaching material, identify themes, draft resources and support internal administration.

We do not routinely place client or participant information into AI tools. On limited occasions, a carefully selected extract may be useful—for example, to transcribe an agreed recording, organise feedback or identify a teaching theme. When this happens:

• we use only the minimum information reasonably necessary;
• we normally remove or replace names and other direct identifiers first;
• we prefer a short, purpose-specific summary over a complete transcript or case history;
• we continue treating pseudonymised material as personal information where somebody could still be identified; and
• a person reviews the output and remains responsible for its use.

We do not intentionally submit full names, contact details or other direct identifiers with client material. Identifiable or special-category information will not be submitted unless there is a separately documented need, suitable provider safeguards, clear prior information and any consent or other legal condition required for that use.

We do not use AI to diagnose a condition, determine treatment or recovery, or make solely automated decisions that produce legal or similarly significant effects.

7. Children and young people

Some of our services may be provided to people under 18. We require prior written involvement and consent from a parent or person with parental responsibility before accepting an under-18 participant for unsupervised work. The parent or guardian must tell us about relevant special needs, accessibility requirements or safety information needed to support the young person. People under 18 are not admitted to our online communities.

We aim to explain relevant information use in a way appropriate to the young person's age and understanding, collect only what is reasonably needed, and treat the young person's best interests as an important consideration. We do not add an under-18 participant to general marketing simply because they receive a service.

Data-protection rights belong to the child or young person, although a parent or guardian may exercise or support those rights where legally appropriate.

8. Who we share information with

We use reputable service providers to operate and deliver our work. Depending on the service, these may include:

• Kajabi for our website, accounts, courses, videos, communities, emails and app;
• Stripe and PayPal for payments;
• Substack for publication subscriptions and interactions;
• Wistia, Vimeo and YouTube for video hosting or embedded media;
• Zoom for calls, events and agreed recordings;
• Calendly for appointment scheduling;
• Dropbox and Google Workspace for authorised storage, documents and communications;
• Squarespace, our previous website and email platform, and Zenler, our previous course platform, which still hold some contact, order and course records while we complete our move to Kajabi;
• approved AI, transcription and editing providers, such as OpenAI, Kajabi AI features and Descript; and
• authorised contractors, accountants, lawyers, insurers and other professional advisers.

We may also disclose information where required by law, to protect somebody's safety or legal rights, or in connection with a genuine sale or reorganisation of the business subject to appropriate safeguards.

Providers may act as our processors or, for some activities, as separate controllers. We do not sell personal information or share it for another organisation's own marketing without the permission or other lawful basis required.

9. International processing

Some providers or their subprocessors may process information outside the United Kingdom. Where the law treats this as a restricted international transfer, we use an available legal safeguard, such as UK adequacy regulations, approved contractual clauses or another permitted mechanism. You may contact us for more information.

10. How long we keep information

We keep information only for as long as reasonably necessary for its purpose and for relevant legal, accounting, safeguarding or dispute requirements. Our normal approach is:

• Enquiries: usually up to 24 months after the last meaningful contact, unless a continuing relationship or legal reason applies.
• Purchases, contracts, invoices and tax records: normally up to six years after the relevant relationship or transaction.
• Course accounts, progress and assignments: for the access period and a reasonable administration period, taking account of any longer access promise.
• Health or suitability forms and coaching notes: normally for up to two years after the relevant service ends, and deleted sooner where no longer needed. We may retain particular information longer where reasonably required for an ongoing relationship, complaint, legal claim, insurance requirement or safeguarding concern.
• Biofeedback and EEG readings: only for the retreat or session, then deleted soon afterwards, unless you ask us to keep them.
• Marketing records: while you are subscribed; a minimal suppression or consent record may be retained after you unsubscribe.
• Group-call recordings containing participants: normally available to participants for the programme-access period and retained internally for up to 12 months after the programme ends. We may retain a recording longer where it has been properly incorporated into another product with the necessary disclosure or permission, has been genuinely de-identified, or a legal or safeguarding reason requires it.
• One-to-one recordings: normally for up to 12 months, unless the client requests earlier deletion or there is a justified reason to retain them longer.
• Teaching-only master recordings featuring John or Linda without participant contributions: may be retained as part of the company’s teaching and intellectual-property library.
• AI or transcription working material: only for the approved task and in accordance with the provider's configured retention and deletion controls. Any resulting business record is then kept under the relevant category above.

Information that has been genuinely anonymised may be retained because it no longer identifies anyone. Temporary backup copies may remain until they are securely overwritten.

11. Security

We use proportionate safeguards intended to protect personal information, including access controls, account security, restricted access, reputable providers, confidentiality arrangements and incident procedures. No online or storage system can be guaranteed completely secure.

Please keep your account credentials confidential and contact us promptly if you believe your account or information may have been compromised.

12. Cookies and similar technologies

Our websites and services use cookies and similar technologies. Some are necessary for functions such as login, security, checkout and remembering preferences. Other technologies, such as analytics or marketing tools, require consent in some circumstances.

Where consent is legally required, non-essential technologies should not be used until you choose to allow them. You can find more information and available choices in our Cookie Notice.

13. Your rights

Depending on the circumstances, you may have rights to:

• access your personal information;
• correct inaccurate or incomplete information;
• ask us to erase or restrict information;
• object to certain processing;
• receive certain information in a portable format;
• withdraw consent; and
• complain to a data-protection authority.

These rights are not absolute and do not apply identically in every situation. We may need to verify your identity before acting on a request. We normally respond within one month, subject to any lawful extension.

You have an absolute right to object to direct marketing.

To exercise a right, email privacy@breakthroughthat.com.

14. Complaints

Please contact us first if you have a privacy concern so that we can try to resolve it.

You may also complain to the UK Information Commissioner's Office:

• Make a complaint to the ICO
• Telephone: 0303 123 1113

If you live or work outside the UK, you may also be entitled to contact the data-protection authority where you are located.

15. Other websites and changes to this notice

Our websites and courses may link to or embed services operated by other organisations. Their own privacy notices explain the processing they control.

We may update this notice when our services, providers or legal duties change. The current version and effective date will be published on this page. If a change materially affects how we use information already collected, we will take reasonable steps to tell affected people before the new use begins and obtain consent where required.

Contact us

JELM Consulting Limited, trading as Breakthrough That
Registered office: 17–19 Station Road West, Oxted, Surrey, RH8 9EE, United Kingdom
Company number: 08294047
Email: privacy@breakthroughthat.com