Privacy & GDPR Policy

Last updated: July 2026

1. Introduction

MHY Studio ("we", "us", "our") is committed to protecting your personal data and respecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This policy explains how we collect, use, store, and protect your personal information when you use our website and services.

2. Data We Collect

  • Account data: Your name, email address, and role when you register.
  • Profile data: Bio, photo, phone number, and Reiki level — only if you choose to provide them.
  • Course data: Enrolment records, progress, and completion status.
  • Booking data: Session bookings for attunements, live sessions, and yoga classes.
  • Payment data: Processed securely via Stripe — we do not store your card details.
  • Community data: Posts, questions, event RSVPs, and buddy requests you create in the MHY Circle.
  • Communication data: Contact form submissions and email correspondence.

3. Legal Basis for Processing

We process your personal data under the following lawful bases:

  • Consent (Article 6(1)(a)): Marketing emails, community posts, and optional profile data.
  • Contract (Article 6(1)(b)): Course enrolments, bookings, and payments.
  • Legal obligation (Article 6(1)(c)): Records required for tax and accounting.
  • Legitimate interests (Article 6(1)(f)): Platform security and service improvement.

4. Profile Visibility & Your Control

Your member profile defaults to private. You can choose to make it visible to all Circle members or keep it private so only your friends can see it. Contact details (email and phone) are always private — they are only visible to friends you have added and to platform administrators, regardless of your profile visibility setting.

5. How We Use Your Data

  • To provide and manage your courses, bookings, and certificates.
  • To operate the MHY Circle community features.
  • To send you marketing emails (only if you have given consent — you can opt out at any time).
  • To respond to your enquiries and provide customer support.
  • To maintain platform security and prevent misuse.

6. Data Sharing

We do not sell your personal data. We share data only with:

  • Stripe — for secure payment processing.
  • Service providers — hosting and email delivery, under data processing agreements.
  • Authorities — where legally required.

Within the MHY Circle, the information you choose to share in posts, questions, or buddy requests is visible to other members according to your privacy settings.

7. Data Retention

We retain your personal data only for as long as necessary to provide our services and meet legal obligations. Course and payment records are kept for 7 years for tax purposes. You can request deletion of your account and associated data at any time.

8. Your Rights Under UK GDPR

  • Right of access — request a copy of your personal data.
  • Right to rectification — correct inaccurate data.
  • Right to erasure — request deletion of your data ("right to be forgotten").
  • Right to restrict processing — limit how we use your data.
  • Right to data portability — receive your data in a machine-readable format.
  • Right to object — object to processing based on legitimate interests.
  • Right to withdraw consent — at any time, without affecting prior processing.

To exercise any of these rights, contact us using the details below.

9. Data Security

We use appropriate technical and organisational measures to protect your data, including encrypted data storage, secure payment processing via Stripe, and role-based access controls. Access to personal data is restricted to authorised administrators only.

10. International Transfers

Your data may be processed by service providers outside the UK. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or UK GDPR adequacy decisions.

11. Children's Privacy

Our services are not directed to children under 16. We do not knowingly collect personal data from anyone under 16. If you believe we have done so, please contact us.

12. Contact & Complaints

If you have any questions about this policy or wish to exercise your data protection rights, please contact us via our Contact page or email therapeuticconsultationsltd@gmail.com.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.