How I handle your data

Privacy Policy

OCD: Conditions for Allowing · Last updated: 10 July 2026

---

This page explains what personal information I collect when you buy the book, use the portal, book a call, or work with me — and what I do with it. I've written it in plain English on purpose. If anything is unclear, email me and I'll give you a straight answer.

1. Who I am

I'm David Laing, and I run OCD: Conditions for Allowing as a sole trader, based in Eastbourne, East Sussex, United Kingdom. For data protection law, I'm the "controller" of your information — meaning I'm the one responsible for looking after it.

• Email: david@conditionsforallowing.com
• Postal address: Heathcote, Eastbourne BN21 1BZ, United Kingdom
• ICO registration: ZC157467

2. What I collect, and when

When you buy something (the book, the Starter Kit, the Recovery Circle, or a programme): your name, email address, what you bought, and payment confirmation. Payments are processed by Stripe — your card details go directly to Stripe and never touch my systems.

When you book a call with me: your name, email, phone number, and your answers to the booking questions. Some of those questions ask about your experience of OCD and how you're doing — that's sensitive health information, and it gets special treatment (see section 3).

When you create a portal account (portal.ocdisbeliefsbook.com): your email and login, your course progress, and — if you're in a programme — the things you choose to log there: daily practices, reflections, check-ins. Much of that is also sensitive health information (section 3 again).

When you're on my email list: which emails you open and which links you click (this is how email platforms work; I use it to stop sending things you clearly don't want).

When you visit the website: see section 6 (cookies and analytics).

When we're working together (Recovery Circle or a programme): what you share on calls, in the community, in check-ins, and — for Implementation Programme clients — in our WhatsApp thread.

I don't collect anything I haven't listed here, and I never buy data about you from anyone.

3. Sensitive information — the important bit

Because of what this work is, some of what you share with me is information about your mental health. The law calls this "special category data" and requires explicit consent to use it. Here's how that works honestly:

• Booking and request forms: your answers about your wellbeing are used for one thing — preparing for our call. Submitting the form is how you consent to that. If you don't become a client, those answers are deleted within 12 months.
• Portal logs, reflections and programme notes: by choosing to write them, you're consenting to me (and only me) reading them to coach you. That's their only use.
• Never used for marketing. Never sold. Never shared, except with the service providers that physically store it (section 5) — who are contractually barred from doing anything else with it.

You can withdraw consent at any time by emailing me — I'll delete the information (unless a legal duty, like tax records, requires keeping the purchase itself).

4. Calls, recordings, and messages

• Weekly Recovery Circle session (Zoom): runs in Focus Mode — you only see me; other participants can't see you. These sessions are recorded for my own reference only and are never shared; recordings are deleted within 90 days.
• Implementation Programme group call (Zoom): only the short opening teaching segment is recorded (it goes in the portal for people who can't attend live). Hot-seat coaching is never recorded — what comes up there stays in the call.
• 1:1 calls (Implementation Programme and assessment calls): these are recorded, with your knowledge, and used only to improve how I support you. They're stored privately, deleted on request, and in any case within 12 months of our work together ending.
• AI notetaker: On coaching and assessment calls I use Fathom, an AI notetaker, so I can be fully present instead of scribbling. You'll see it join the call. It produces a transcript and summary that only I can see, used solely to prepare and follow up on our work. If you'd rather it wasn't there, say so at the start of the call — or tell me beforehand — and I'll turn it off, no explanation needed.
• WhatsApp (Implementation Programme): our coaching thread lives on WhatsApp, which is end-to-end encrypted in transit. Be aware WhatsApp is a Meta product with its own privacy policy.
• SMS: if you book a call, I may send you booking-related texts (confirmations, reminders, rescheduling). I'll only ever send marketing texts if you've ticked a box saying yes — and you can reply STOP to anything.

5. Who else touches your data (my service providers)

I'm a small business; these companies store or move data on my behalf. Each is bound by a contract limiting them to exactly that:

I never sell your data. Nobody gets it for their own marketing.

6. Cookies and analytics

The website (conditionsforallowing.com) currently uses:

• Meta Pixel — tells me which ads brought people to the book page, so I'm not wasting money showing ads to the wrong people. Meta also receives this data under its own policy.
• Microsoft Clarity — anonymised session recordings (where people scroll and click) so I can see what's confusing on the page.
• A "variant" cookie (30 days) — remembers which version of the page you saw so it doesn't change under you.
• A session-only attribution note — remembers which ad you arrived from until you close the tab, so the right campaign gets credit if you buy.

You'll be asked before any of the advertising/analytics ones load, and "no" is a one-click answer. You can also block cookies in your browser settings at any time; the site works fine without them.

The checkout pages (checkout.conditionsforallowing.com, run through my checkout provider) also use the Meta Pixel. The consent prompt above covers this website; on the checkout pages the Pixel currently loads without a prompt — I'm extending the same consent control there.

7. How long I keep things

• Purchase records: 6 years (UK tax law requires it).
• Booking answers from people who don't become clients: deleted within 12 months.
• Email list: until you unsubscribe.
• Portal accounts: for as long as you have access; deleted on request.
• Call recordings and transcripts: 1:1 recordings deleted on request and, in any case, within 12 months of our work together ending; weekly Recovery Circle session recordings within 90 days (see section 4).

8. Where your data lives

Some of the providers above (HighLevel, Stripe, Meta, Microsoft, Zoom, Google, and Supabase) store data in the United States. Those transfers are covered by the UK's approved safeguards — the UK–US Data Bridge where the provider is certified, or the UK's standard contractual terms (IDTA/Addendum) where not.

9. The legal bases (the formal bit)

• Delivering what you bought (the book, portal access, coaching): contract.
• Emailing customers about my work and similar offers: legitimate interests — you gave me your email when buying, and every email has an unsubscribe link that works instantly.
• Your booking answers and coaching content (health information): explicit consent (section 3).
• Marketing SMS: consent (the tick-box).
• Tax records: legal obligation.
• Analytics and advertising measurement: consent (via the cookie banner).

10. Your rights

You can ask me, at any time, to: see what I hold about you; correct it; delete it; restrict what I do with it; hand it over in a portable format; or stop using it for marketing (that last one, I must and will do, no questions). Email david@conditionsforallowing.com — I'll respond within a month, usually much faster.

If you're unhappy with how I've handled your data, you can complain to the UK regulator: the Information Commissioner's Office — ico.org.uk / 0303 123 1113. (I'd appreciate the chance to fix it first, but that's your right regardless.)

11. Age

My products and programmes are for adults — 18 and over. If you're a parent, guardian or carer of a young person with OCD, you're welcome here — but the account, the purchase and the data are yours, as the adult. I don't knowingly collect information from anyone under 18; if that's happened, email me and I'll delete it.

12. Changes

If I change this policy in any way that matters, I'll update the date at the top and — for anything significant — tell the email list. The current version always lives at this address.