Data protection and GDPR

Law that applies

MYND AT ONE operates in the Bailiwick of Guernsey and follows the Data Protection (Bailiwick of Guernsey) Law, 2017. Where we handle data belonging to people in the United Kingdom or the European Union, we also apply the UK GDPR and the EU GDPR. Guernsey holds an adequacy decision, so data can move between the Bailiwick and the EU without additional safeguards.

Who is the controller

MYND AT ONE is the controller for enquiry data, practitioner account data, website data and employment data. Independent practitioners working from the space are separate controllers for their own client records. Where a practitioner holds clinical notes about you, those notes are theirs, and a request about them should be made to that practitioner. We will pass any such request on.

Lawful bases

We do not rely on a single basis for everything. Each purpose has its own.

• Consent, for enquiry messages, marketing contact and anything you volunteer.
• Contract, for room licences, bookings and practitioner arrangements.
• Legal obligation, for tax, insurance and safeguarding records.
• Legitimate interests, for site security, error logs and fraud prevention, balanced against your rights.
• Substantial public interest or health care, for the limited special category data a practitioner needs in order to treat safely.

Special category data

Health data, and any data revealing a diagnosis, medication, neurodivergence or substance use, is special category data. It is collected only where the person providing care needs it, it is stored with access limited to that person, and it is never used for marketing, profiling or any secondary purpose. We do not ask for health information through the public enquiry form and we ask that you do not send it there.

Retention

Nothing is kept indefinitely. Each category has a set life.

• Enquiries, two years from last contact, or sooner on request.
• Data requests and the audit trail behind them, six years, as evidence of compliance.
• Practitioner qualifications, insurance and room licences, the length of the licence plus seven years.
• Financial and tax records, seven years.
• Incident, complaint and safeguarding records, the period required by the relevant authority, and in the case of safeguarding concerning a child, until that person's twenty fifth birthday at the earliest.
• Website technical logs, thirty days.
• CCTV, if installed at the entrance for security, thirty one days, then overwritten.

Your rights

You can ask for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict or stop processing it, object to processing, and ask for it in a portable format. You can withdraw consent at any time, and withdrawal does not affect what was lawful before it. We respond within one month and will tell you if we need longer for a complex request. Use the data request form on this site, or write to us.

Processors and transfers

We use a small number of service providers to host the site, hold the database, deliver email and provide the on-site assistant. Each is bound by a written processing agreement and may only act on our instructions. Where data is processed outside the Bailiwick, it is covered by adequacy or by standard contractual clauses. We do not sell data and we do not share it with advertisers.

Breaches

If a breach is likely to risk your rights and freedoms, we notify the Office of the Data Protection Authority within seventy two hours of becoming aware of it, and we tell affected people directly where the risk is high. Every breach, reportable or not, is logged, investigated and used to change practice.

Complaints

Please raise it with us first. If you are not satisfied, you can complain to the Office of the Data Protection Authority, Bailiwick of Guernsey, or to the Information Commissioner's Office if you are in the United Kingdom.