1. Our Commitment to Privacy

At Empowered Person, we understand that information about personal development, learning, family life, health, and individual differences deserves thoughtful and responsible handling.

We are committed to protecting the privacy, dignity, and personal information of everyone who participates in our programs, research, coaching, consultations, and professional collaborations.

This Privacy Policy explains how we collect, use, store, share, and protect personal information in accordance with applicable data protection laws, including the European Union's General Data Protection Regulation (GDPR).

2. Data Controller

Empowered Person OÜ
Registry code: 17280015
Registered address: Manufaktuuri tn 7/1-26, Tallinn, 10412, Estonia
Email: hello@empoweredperson.eu
Website: https://empoweredperson.eu

Empowered Person generally acts as a data controller for its own website, programs, and services.

For certain research or organizational projects, our role may differ. Where we act as a data processor or joint controller, responsibilities will be documented through appropriate agreements.

3. Information We Collect

Depending on the service or activity, we may collect:

Personal and contact information: Names, email addresses, country, organization, professional role, and contact preferences.

Registration and financial information: Program registrations, appointment information, purchases, invoices, payment status, and transaction records.

Educational and professional information: Learning goals, teaching roles, professional interests, training needs, and program feedback.

Coaching and consultation information: Personal goals, challenges, reflections, participation notes, and information relevant to providing agreed support.

Sensitive personal information: Where necessary and legally permitted, diagnoses, disability information, developmental histories, neurodivergence-related information, health-related details, demographic information, and individual support needs.

Research information: Participant responses, interviews, questionnaires, observations, assessments, recordings, transcripts, research notes, and demographic data relevant to approved projects.

Technical information: Website usage, device and browser information, security logs, and cookies or similar technologies.

We collect only information reasonably necessary for the specified purpose.

4. How We Use Personal Information

We process information to:

• Respond to inquiries and arrange appointments

• Deliver educational, coaching, and consultation services

• Register participants and manage program access

• Process payments and meet accounting obligations

• Communicate about purchased programs and services

• Provide appropriate accessibility and learning support

• Conduct authorized research and program evaluation

• Improve educational resources and program delivery

• Protect the security of our systems and information

• Fulfill applicable legal and contractual obligations

• Send optional marketing communications where legally permitted

We do not sell personal information.

We do not use sensitive health, disability, or research information for targeted advertising.

5. Legal Basis for Processing

Under GDPR, we process personal information only where an appropriate legal basis applies.

Depending on the circumstances, this may include:

• Performance of a contract or steps requested before entering into a contract

• Compliance with a legal obligation

• Legitimate interests, where these do not override individuals' rights and freedoms

• Consent, where required and appropriate

• Other lawful bases available for particular processing activities

Health, disability, and other special-category information receive additional protection.

Such information is processed only where both an Article 6 legal basis and an appropriate Article 9 condition are established.

This may include explicit consent or another legally permitted condition, depending on the activity.

Participation in a service does not constitute blanket consent for unrelated processing.

6. Sensitive Personal and Health-Related Information

Our educational, coaching, and research activities may involve information concerning:

• Autism, ADHD, dyslexia, and other neurodevelopmental conditions

• Diagnoses and developmental histories

• Disabilities and accessibility requirements

• Sensory, cognitive, emotional, and learning differences

• Family circumstances and individual support needs

• Health-related information voluntarily shared during consultations or research

We recognize that this information may be particularly sensitive.

We apply appropriate safeguards, including data minimization, confidentiality, restricted access, secure storage, and purpose-specific processing.

Sensitive records are not made publicly available or included in general educational resources in identifiable form.

We do not require detailed diagnoses or medical histories for ordinary website inquiries.

7. Research and Scientific Collaboration

Research and knowledge development form an important part of Empowered Person's activities.

Some projects may involve collaboration with universities, schools, research institutions, professional organizations, and other approved partners.

Research may include questionnaires, interviews, observations, demographic information, educational measures, participant feedback, and recordings.

For each research project, we establish appropriate procedures covering:

• Research purpose and participant information

• Lawful processing and, where required, informed consent

• Special-category data protections

• Parental or guardian authorization and child assent where applicable

• Confidentiality and access restrictions

• Pseudonymization or anonymization where appropriate

• Secure storage, sharing, and transfer arrangements

• Retention and deletion requirements

• Research ethics and institutional approvals where required

Where possible, research findings will be reported in aggregated or anonymized form.

Pseudonymized information remains personal data where individuals can be reidentified.

Research participation is not automatically required to receive unrelated educational or coaching services.

Separate project-specific privacy notices and consent documentation will be provided where necessary.

8. Children's Personal Information

Some Empowered Person activities involve children directly, including educational workshops, school-based initiatives, and research projects.

We take additional care when processing information about children.

Depending on the activity, we may require parental or guardian authorization, institutional agreements, age-appropriate information, and the child's assent.

We aim to collect the minimum information necessary and avoid identifying children in public materials.

We will handle children's diagnoses, developmental information, research responses, and educational records through appropriately secured processes.

Participation in an activity does not automatically authorize recording, research participation, or publication.

9. Secure Storage and Access

We use organizational and technical measures appropriate to the sensitivity of the information involved.

These may include:

• Password-protected systems and encrypted connections

• Multi-factor authentication

• Access limited to authorized personnel

• Secure file storage and controlled sharing

• Confidentiality obligations for team members and collaborators

• Separate management of research identifiers and identifiable records

• Secure backups and appropriate recovery procedures

• Regular review of access permissions

• Secure deletion or anonymization when retention is no longer justified

Where particularly sensitive research or participant information is involved, we will establish additional project-specific protections.

We do not rely on password protection alone to safeguard sensitive records.

10. Recordings and AI-Assisted Transcription

Some workshops, consultations, interviews, research sessions, and professional meetings may involve audio or video recording or AI-assisted transcription.

Participants will be informed in advance when these technologies are proposed.

The purpose of recording, relevant data processing, access arrangements, and retention will be explained as appropriate.

We will establish the required lawful basis and permissions before recording.

Where participation without recording is feasible, appropriate alternatives will be considered.

Identifiable recordings and transcripts will be treated as personal information.

We will not intentionally include identifiable participant information in recordings distributed for general training or educational purposes.

Where recordings capture identifiable contributions, we will remove or appropriately anonymize those contributions before broader distribution, unless a separate lawful authorization permits their use.

We assess AI transcription providers for confidentiality, data security, retention, and international transfer requirements.

Sensitive research or coaching information will not be uploaded to unapproved AI systems.

11. Data Retention

We retain personal information only for as long as necessary for the relevant purpose or as required by law.

Financial and accounting records: Generally seven years, subject to applicable legal requirements.

Coaching and consultation records: Retained for a period justified by the service, applicable legal obligations, and legitimate operational needs, with a maximum standard period of seven years where appropriate.

Research records: Retention periods are set for each project based on its scientific purpose, legal basis, ethics requirements, funding conditions, and applicable law. Some records may require shorter or longer periods.

Recordings and transcripts: Retained only for the documented purpose and period established for the relevant activity.

General inquiries and marketing information: Retained only as necessary for communication, administration, or applicable legal requirements.

Information will be securely deleted or anonymized when no longer required, unless lawful retention remains necessary.

12. Third-Party Service Providers

We may use trusted external providers for website operations, scheduling, payments, communications, online learning, video meetings, secure storage, and administrative support.

Current providers may include Calendly for scheduling and Stripe for payment processing.

Other providers may be used for online courses, hosting, email, research, and digital collaboration.

Where required, we establish appropriate data processing agreements and verify relevant security arrangements.

Service providers are not authorized to use personal information for unrelated purposes.

13. International Data Transfers

Empowered Person works internationally, and authorized service providers or collaborators may operate outside the European Economic Area.

Where personal information is transferred outside the EEA, we use a lawful transfer mechanism and appropriate safeguards as required by GDPR.

These may include adequacy decisions, Standard Contractual Clauses, and supplementary protections where necessary.

Research-related transfers may require additional agreements and project-specific safeguards.

14. Confidentiality in Groups and Collaborative Activities

Group workshops and coaching programs may involve personal discussions.

We ask participants to respect the privacy of others and refrain from sharing identifiable information without permission.

Although we establish confidentiality expectations, we cannot guarantee that other participants will comply.

Research and professional collaborators may be subject to additional confidentiality agreements.

15. Your Privacy Rights

Subject to applicable law, you may have the right to:

• Request access to your personal information

• Correct inaccurate or incomplete information

• Request deletion where applicable

• Restrict or object to certain processing

• Request data portability where applicable

• Withdraw consent where processing relies on consent

• Object to direct marketing

• Receive information about qualifying automated decision-making

To exercise your rights, contact hello@empoweredperson.eu.

We will respond within the time limits required by applicable law.

You may also lodge a complaint with a competent data protection authority, including the Estonian Data Protection Inspectorate.

16. Marketing Communications

We may share newsletters, educational resources, program information, and invitations where legally permitted.

Where required, we will obtain marketing consent separately.

You may unsubscribe from marketing communications at any time.

17. Cookies and Website Technologies

Our website may use cookies for essential functionality, security, preferences, and optional analytics.

Where consent is required, non-essential cookies will not be activated before permission is given.

Further information is available in our Cookie Policy.

18. U.S. Privacy Considerations

Empowered Person operates primarily as an educational, coaching, consulting, and research organization rather than a clinical healthcare provider.

HIPAA does not automatically apply to all information collected by such organizations.

Where a particular activity or contractual relationship creates HIPAA obligations, we will establish the necessary safeguards and agreements before undertaking that processing.

Additional U.S. federal or state privacy laws may apply to particular activities or individuals. Relevant requirements will be assessed and implemented where applicable.

19. Data Security Incidents

We maintain procedures for identifying, assessing, documenting, and responding to personal data security incidents.

Where required, we will notify the appropriate supervisory authority and affected individuals within applicable legal timeframes.

20. Changes to This Policy

We may update this Privacy Policy as our services, research activities, technology, or legal obligations evolve.

The current version will be available on our website.

21. Contact

For questions about privacy or personal information:

Empowered Person OÜ

Manufaktuuri tn 7/1-26
Tallinn, 10412, Estonia
Registry code: 17280015

hello@empoweredperson.eu