Privacy Notice

1. Who we are

Hearing Safe Singers provides specialist vocal coaching for singers living with hearing loss or tinnitus, together with training and consultancy for organisations.

Hearing Safe Singers is a sole trader business. For data protection purposes the data controller — the person responsible for deciding how your information is used — is:

Lili is the vocal coach. Behind Lili is a small team of two unpaid volunteers — a personal assistant to Lili, and a technical manager who looks after this website and the systems behind it. Lili remains responsible for what they do with your information.

If you have any question about this notice or about how we handle your information, please email hello@hearingsafesingers.com. We are a small business and there is no separate data protection officer — your message comes straight to us.

2. What we collect

Most of what we hold is information you have chosen to give us. There are two exceptions. Our host, Cloudflare, receives limited technical information — including your IP address — every time you load a page, because that is how the page reaches you and how attacks are blocked; this happens on every visit and does not depend on your cookie choices. Separately, if you accept optional cookies, our analytics and marketing tools collect information about your visit. Both are explained below, and cookies more fully in section 3. A third route applies only to the workshops we run for organisations, where some information about a participant reaches us from the host organisation rather than from the participant — see section 6.

When you send an enquiry

Our contact form asks for your name, your email address, your singing experience level, your main goal, your preferred lesson format, and anything you choose to write in the message box.

When you book a lesson or a call online

Our booking calendar is provided by Cal.com and opens in a window on this site. When you book, Cal.com collects your name, email address, the time you have chosen, your time zone, and anything you write in the booking notes. Where a lesson is paid for at the time of booking, the payment is taken by Stripe in that same window — see "When you pay us" below.

When you email, call or message us

We keep the content of your message and our reply, together with your contact details, so that we have a record of the conversation. As well as email and telephone, we reply to people who reach us by text message or iMessage, on WhatsApp, and through Instagram and Facebook messages.

Emails sent to hello@hearingsafesingers.com arrive in an inbox that Lili and our personal assistant both read, so that enquiries are not left waiting. Nobody else has access to it. Telephone calls, text and iMessage, and messages on WhatsApp, Instagram and Facebook reach Lili alone.

When you have an online lesson

Online lessons take place on Zoom or Google Meet, whichever suits you better; we will tell you which one we are using when the lesson is arranged. To join, that platform needs your name and email address, and it handles the live audio and video of the lesson itself along with technical details such as your IP address and device type. Our lesson notes are written separately, as described under "When you become a client" below.

Lessons are not recorded unless you have specifically agreed to it. Sometimes a recording is genuinely useful — so you can hear a technique again in your own time — but we will always ask first, and ask each time rather than treating one yes as permanent. Because a recording of your lesson captures your voice and may capture discussion of your hearing, it counts as special category data, so your agreement is explicit consent under Article 9(2)(a).

You can say no without giving a reason and it changes nothing about the lesson. If you agree and then change your mind, tell us and we will delete the recording. Recordings are stored on our own devices rather than in Zoom's or Google's cloud, and are covered by the retention period in section 12.

When you become a client

We keep lesson notes, scheduling and attendance records, and payment records. Where you have told us about your hearing, our notes may refer to it so that we can teach you safely and well.

These records live on the devices we teach from, and are synced between them through Apple's iCloud service so they are available in lessons. Your appointments also appear in our calendar, which is synced from our booking system.

When you pay us

All card payments are handled by Stripe. We never see, enter or store your full card number.

In person, which is how most lessons are paid for, we use Stripe Tap to Pay. You tap your contactless card, phone or watch against our phone, exactly as you would against a card machine. Your card details are encrypted by Stripe at the moment of the tap. They are not shown to us and are not kept on the phone.

Online, payment is taken as part of booking. Our booking calendar is run by Cal.com and is connected to our Stripe account, so when a lesson is paid for at the time of booking, the payment step happens inside the booking window and your card details go to Stripe. Cal.com passes the booking and the amount to Stripe; it does not receive or hold your card number, and neither do we.

In both cases what reaches us is only a record of the payment: the amount, the date, the type of card, and its last four digits. That is what our accounts need and nothing more. If you would like a receipt by email, Stripe sends it and we pass on your email address only for that purpose.

When you browse the site

Whether or not you accept cookies, our host Cloudflare handles the technical request that delivers each page to you — your IP address, the page you asked for, and your browser type. It uses this to serve the site and to tell real visitors apart from automated attacks. We rely on our legitimate interest in keeping the site available and secure for this, not on your consent, because without it we could not serve you the page at all.

Beyond that, and only if you accept optional cookies, Google Analytics and the Meta Pixel collect information about the pages you visit, roughly where in the world you are, and the type of device and browser you use.

3. Cookies

We set only strictly necessary cookies unless you tell us otherwise. Analytics and marketing cookies are never loaded until you accept them, and if you do not accept them they set nothing on your device. You can change your mind at any time.

Read our full cookie policy, or change your cookie settings.

4. Information about your hearing

Because of what we do, you may tell us about your hearing when you first get in touch. If you use our enquiry form, we ask you to tick a box confirming you are happy for us to hold that information before you send it. That tick is your explicit consent, which is the condition we rely on under Article 9(2)(a) — see section 7.

You may also tell us about your hearing another way — in an email, on the telephone, or in the notes attached to a booking. Where you choose to tell us in your own words like that, we treat your telling us as your explicit consent for us to hold it, and we keep it on the same basis as information given through the form. We will not do anything with it beyond what this notice describes. If you would rather we did not keep it, tell us and we will delete it.

What this means in practice:

• You never have to tell us anything about your hearing in order to contact us. Share only what you want to share.
• We use it for one purpose only — to teach you safely and appropriately, and to answer your enquiry.
• We never pass it to advertising platforms. Our website deliberately sends no name, email address or health information to Meta or to Google. The one thing outside our control is a message you choose to send us on a Meta platform — WhatsApp, Instagram or Facebook — which reaches Meta before it reaches us. We will never repurpose it, but for anything about your hearing we would rather you emailed us.
• Inside Hearing Safe Singers, only two people ever see it — Lili and our personal assistant. Nobody else, at any point. See section 11.
• You can withdraw your consent at any time by emailing us, and we will delete that information. Withdrawing consent does not affect anything we did before you withdrew it.

5. Photographs, video and testimonials

Some of what appears on this website and on our social media comes from the people we teach — a few words about how lessons have gone, or a photograph from a workshop. All of it is used with permission, and permission can be taken back.

Testimonials

We ask before we publish anything you have said about your lessons, and we ask specifically, rather than treating a kind word in an email as agreement. You decide how you are credited: your full name, your first name only, something descriptive such as "pop singer", or nothing at all. Several of the reviews on our home page are published anonymously for exactly that reason.

Photographs and video

We do not photograph or film lessons unless you have agreed to it, and one yes is never taken as standing permission — we ask again every time. Recordings made as a teaching aid are a separate matter, covered in section 2.

At workshops, we agree in advance with the host organisation whether photographs will be taken, and we ask them to establish who is happy to appear before the session begins. If you have said no, we will not photograph you; if you change your mind on the day, tell us, and nobody has to explain why.

An image can carry health information too. A visible hearing aid or cochlear implant tells a viewer something about you, so where a photograph shows one we rely on your explicit consent under Article 9(2)(a), not merely on your having agreed to be photographed.

Changing your mind

Tell us, and we will take it down. We will remove it from this website and delete our own social media posts containing it, normally within a few days.

What we cannot do is undo the fact that it was once public. Someone may have screenshotted a post, a search engine may hold a cached copy for a while, and a shared post lives on the account that shared it. We will do everything within our control, and be honest with you about what is outside it.

We never use photographs, video or testimonials to build advertising audiences, and we never pass them to an advertising platform as data about you — see section 9.

6. Workshops we run for organisations

This section is for you if you took part in a workshop or community session we ran at a care home, day centre, charity, school or health service. You may never have been in touch with us at all — the organisation booked us — so it is worth setting out what reaches us about you, and where it came from.

Where your information comes from

Before a session we hold a short consultation with the organisation hosting it, so that what we deliver works for the people in the room. In that conversation they may tell us about access and communication needs: that someone uses British Sign Language or lip-reads, that someone wears hearing aids or has a cochlear implant, that someone has a condition affecting how they take part. Some of that is health information, and it reaches us from the organisation rather than from you.

Because of that, we ask every host organisation to do two things:

• Tell us what the room needs, not who needs what. Group-level information — how many people lip-read, whether an interpreter is booked — is very often all we require, and it names nobody.
• Get explicit consent first where an individual's needs genuinely have to be shared with us, from that person or from someone acting for them — and make this notice available to participants beforehand, so that you know we exist and can object.

If you would rather we knew nothing about you in advance, that is entirely fine. Tell the organisation, or tell us on the day, and we will work with what we have.

What we do with it, and what we do not

We use it to plan and adapt the session, and for nothing else. It does not become a client record, it is never used for marketing, and it is never passed to anyone outside the session. We delete information about named participants within 3 months of the workshop, or of the end of a series where sessions are ongoing.

The host organisation stays responsible for its own records, as a data controller in its own right; we are responsible for ours. If you want a copy of what we hold about you, or want it deleted, you can come to either of us — see section 13.

If you are the person who booked us

Where you are the staff contact at a commissioning organisation, we hold your name, work email address and telephone number, together with our correspondence with you, so that we can quote for the work, arrange it and invoice for it. We rely on Article 6(1)(b) — steps taken before and under a contract — and on our legitimate interest in keeping an accurate record of what was agreed.

Everything else in this notice — your rights, how long we keep things, how to complain — applies to workshop participants exactly as it does to anyone else. Safeguarding is dealt with separately, in section 15.

7. Why we use it, and our lawful basis

Data protection law requires us to have a valid reason — a "lawful basis" — for using your information. Ours are set out below.

Where we rely on legitimate interests, we have weighed our interest against your rights and are satisfied it does not override them. You can object at any time — see your rights below.

We do not use your information to make any automated decision about you, and we do not profile you.

We will not add you to a mailing list from a lesson enquiry. If we ever offer a newsletter, it will be a separate, optional sign-up that you can leave at any time.

8. Who we share it with

We never sell your personal information, and we never share it for anyone else's advertising. We do use a small number of service providers who process information on our behalf. We use each of them on their own standard published terms.

Several of these providers are based outside the UK; where your information goes, and the safeguards that cover it, are set out in section 10.

We also hold a business bank account with Starling Bank, which receives payments made to us. Starling is a separate data controller in its own right, not a processor acting for us, and handles your information under its own privacy policy.

The social media platforms we have pages on are a different case again — for the audience statistics they produce we are joint controllers alongside them, which we explain in section 9.

Our own team does not appear in that table. Our volunteers act under Lili's authority, and are not separate companies processing information on our behalf, so in data protection terms they are not third parties at all — see section 11.

We may also disclose information if the law requires it, or to establish or defend a legal claim. Separately, and rarely, we may share information without consent where we believe someone is at risk of harm — that is set out in section 15.

9. Our social media pages

We have pages on Instagram, Facebook and LinkedIn. The links to them in the footer of this website are ordinary links — they set no cookies and tell those companies nothing about you unless you click.

Once you are on one of those platforms, the platform itself decides how your information is used, under its own privacy policy rather than this one. Following us, liking a post or reading our page is a relationship between you and them.

Where we share responsibility

There is one part we are jointly responsible for. Each platform gives page owners aggregate statistics about their audience — how many people saw a post, roughly what age range they fall into, roughly where in the world they are. Under a 2018 ruling of the Court of Justice, running a page makes us a joint controller with the platform for that statistical processing, even though we never chose how it works and cannot switch it off.

Meta takes primary responsibility for it under their Page Insights addendum, and LinkedIn does the same for their page analytics. What reaches us is only ever counts and bands — never a list of who you are. If you want to exercise your rights over that particular processing, the platform is best placed to act on it, but you are welcome to come to us and we will help.

Comments, messages and your hearing

We can see and may keep individual comments, replies and direct messages, in the same way we keep other correspondence. Messages are covered in section 2 — the short version is that anything sent on WhatsApp, Instagram or Facebook reaches Meta before it reaches us.

We will never screenshot, repost or quote a comment that refers to your hearing — as a testimonial or anything else — without asking you first and getting a clear yes. If we have already shared something and you would rather we had not, tell us and we will take it down. The same applies to testimonials and photographs generally — see section 5.

What we do not do

• We do not upload contact lists, email addresses or client details to Meta, to LinkedIn or to any other platform to build advertising audiences. No Custom Audiences, no Lookalike audiences, nothing of that kind. Our enquiry list and our client records never leave our own systems for advertising purposes.
• We do not add people to a client record, a mailing list or anything else because they followed or messaged us on social media.
• We do not use anything you post to target advertising at you.

10. Where your information is stored

Several of the providers listed in section 8 are based outside the UK:

• Cloudflare — a United States company operating a global network. Pages are served from whichever location is nearest to you.
• Stripe — a United States company; card payments for UK and European customers are handled by Stripe Payments Europe Ltd in Ireland.
• Zoho — our mailbox is hosted in Zoho's European data centre, inside the European Economic Area. The UK Government recognises the EEA as providing an adequate level of data protection, so no further safeguards are needed for your correspondence with us.
• Apple — iCloud for customers in the United Kingdom is provided by Apple Distribution International Limited in Ireland. Apple may store the data in its data centres elsewhere, including the United States, under the safeguards in its data processing terms.
• Zoom — Zoom Communications, Inc. is a United States company. Zoom routes the live audio and video of a lesson through its global network, so it may pass through servers outside the UK while the lesson is happening.
• Google — Google LLC is a United States company; for users in the United Kingdom its services are provided by Google Ireland Limited. Like Zoom, Google Meet routes the live audio and video of a lesson through a global network, so it may pass through servers outside the UK while the lesson is happening. The same applies to Google Analytics, if you have accepted analytics cookies.
• Meta — a United States company. This covers both the Pixel, if you have accepted marketing cookies, and any message you send us on WhatsApp, Instagram or Facebook.
• Web3Forms and Cal.com — both United States companies.
• Starling Bank holds our business account in the United Kingdom.

Every transfer of your information outside the UK relies on a route recognised by UK data protection law. For the European Economic Area, that is the UK's adequacy regulations, which mean no additional safeguards are required. For the United States, it is either the UK extension to the EU–US Data Privacy Framework or the International Data Transfer Addendum to the European Commission's Standard Contractual Clauses, as each provider sets out in its own published terms.

If you would like more detail about the safeguards for a particular provider, email us and we will explain.

11. How we keep it secure

Some of what we hold — a note that refers to your hearing, a recording of a lesson — is information you would not want anyone else reading. These are the practical measures that protect it.

• Access is limited to what each person needs. Each of us can reach only what our own part of the work actually requires — set out in full under "Who has access" below.
• Our devices are locked and encrypted. The devices we teach from are each protected by a passcode or password, are encrypted so that their contents cannot be read if a device is taken apart, and can be erased remotely if one is lost or stolen.
• Our payment and device accounts use two-factor authentication. A password on its own is not enough to reach our Stripe account, or the iCloud account that syncs our notes between devices.
• This website is served over an encrypted connection. Everything you type into the enquiry form travels to us over HTTPS, and Cloudflare sits in front of the site to absorb attacks.
• We never hold card details. They go straight to Stripe and are encrypted at the moment of payment — see section 2.
• We choose providers who publish proper data protection terms. We have not negotiated an individual contract with any of the companies listed in section 8 — we use each of them on their standard terms, as any small business does. Where a provider publishes data processing terms for customers like us, those terms apply to our use of the service and commit them to keeping information secure; where one does not, we limit what we put into it. If you want to know what a particular provider commits to, ask us and we will point you to it.

Who has access

Three of us work on Hearing Safe Singers: Lili, who is the vocal coach and the data controller; Angus Mitchell, our personal assistant; and Ryan Pegoraro, our technical manager.

Angus and Ryan are unpaid volunteers — not employees, and not outside contractors. In data protection terms they act under Lili's authority: they are not separate businesses, they never use your information for their own purposes, they are each bound to keep confidential anything they see, and Lili remains responsible for everything they do with it.

Your lesson notes, any recording you have agreed to, and your payment records are reached by Lili alone. Each of us has our own login rather than a shared password, and access is removed as soon as someone stops working with us.

Nobody else — no other volunteer, no contractor, no family member — has access to any of it.

We also try to hold less in the first place. We do not ask for information we do not need, and we delete records at the end of the periods set out in section 12.

If something goes wrong

No system is completely secure, and it would be wrong to tell you otherwise. If there were ever a breach that put your information at risk, we would report it to the Information Commissioner's Office within 72 hours where the law requires that, and — where the risk to you was high — we would tell you directly, in plain terms, and explain what we were doing about it.

12. How long we keep it

You can ask us to delete your information sooner than this at any time — see your rights below. There are two exceptions: accounting records, which we are legally required to keep, and safeguarding records, which we cannot delete on request because someone else may need them.

13. Your rights

Under the UK GDPR you have the right to:

• Be told how your information is used — that is what this notice is for.
• Get a copy of the information we hold about you.
• Have it corrected if it is wrong or incomplete.
• Have it deleted, where we have no continuing reason to keep it — see section 12.
• Restrict how we use it while a concern is being resolved.
• Object to us using it in a particular way.
• Receive it in a portable format, or have it sent to someone else.
• Withdraw consent at any time, where consent is what we rely on — including consent to hold information about your hearing, and consent to cookies.

To exercise any of these, email hello@hearingsafesingers.com. We will respond within one month. There is no charge. We may ask you to confirm your identity first, so that we do not disclose your information to someone else. If you are unhappy with how we deal with your request, you can complain — see section 17.

If you would prefer to make your request in an accessible format, or by phone, tell us and we will accommodate it.

14. Children and young people

We teach children and young people, and we welcome enquiries about them. The enquiry form on this website is intended to be completed by an adult — a parent or guardian if the student is under 18.

If you are under 18, please ask a parent or guardian to contact us on your behalf. Where we teach a child, we hold the parent or guardian's contact details and only such information about the child as is needed to teach them safely.

Our safeguarding responsibilities towards children and young people, and the circumstances in which we would share information about them without consent, are set out in section 15.

15. Safeguarding

As well as teaching children and young people, we run workshops in care homes, day centres and community settings where some of the people taking part are adults at risk.

Our lawful basis is Article 6(1)(d) — protecting someone's vital interests — or Article 6(1)(c) where a legal obligation applies. Where what we share concerns someone's health, we rely on Article 9(2)(b) or 9(2)(c), or on Article 9(2)(g) together with the safeguarding condition at paragraph 18 of Schedule 1 to the Data Protection Act 2018, which exists for precisely this situation.

How we would handle it

• We share the minimum necessary — enough for the concern to be understood and acted on, and nothing beyond it.
• We would normally tell you first. We would not do so only where telling you might put someone at greater risk, prejudice an investigation, or where the authority handling it has asked us not to.
• Where we are working on an organisation's premises, we follow their safeguarding policy and raise the concern with their designated safeguarding lead, alongside taking our own advice where we need it.
• We keep a written record of what we shared, with whom, and why. It is stored separately from lesson notes and is never used for any other purpose.

Safeguarding records are kept for longer than anything else we hold; the periods are in section 12.

None of this is something we would do lightly, and it is not the same as passing on what you have told us in confidence about your own hearing or health. That we would never do — see section 4.

16. Changes to this notice

If we change how we use your information we will update this page and change the "last updated" date at the top. If the change is significant, we will tell affected clients directly.

17. How to complain

If you are unhappy with how we have handled your information, please tell us first — email hello@hearingsafesingers.com and we will do our best to put it right.

You also have the right to complain to the UK's data protection regulator: