This notice explains what personal information The Mindful Movement Club collects, why, who it is shared with, how long it is kept, and what you can ask us to do about it.
It is written to describe what this website and this coaching practice actually do, rather than what a coaching business might do in general. Where something is named — a company, a period of time, a piece of information — it is because that is the real answer.
1. Who is responsible for your information
The data controller is:
Mischa Kluyver, a sole trader, trading as The Mindful Movement Club
Address: 6 Westbourne Place, Farnham, Surrey, GU9 8EF
Email: hello@mindfulmovementclub.com
Website: www.mindfulmovementclub.com
"We", "us" and "our" in this notice mean that business. "You" means a member, an applicant, or someone who contacts us.
The data controller decides how and why your personal information is used, and is responsible for it.
2. When this notice applies
It applies when you:
- visit www.mindfulmovementclub.com;
- send an enquiry through the website;
- create an account or apply for membership;
- complete the PAR-Q health screening or the "tell me about you" form;
- pay for a membership;
- use the members' area, including training, habits, Food & Fuel and the community;
- receive coaching from us; or
- contact us for any other reason.
3. What we collect
3.1 When you enquire
The enquiry form on the front page asks for your name, email address, which membership interests you, and a message. The message box invites you to mention any injuries, so it may contain health information — see section 5.
3.2 When you register
Email address, a password (stored only as a one-way hash — we never see it), your name, telephone number, date of birth, postal address, the membership you have chosen, an emergency contact name and number, anything you write in the "anything I should know" box, and a record of the consents you gave, including the date, the wording version and the IP address you gave them from.
You must be 18 or over to join through the website. See section 15.
3.3 Your health screening (the PAR-Q)
Your answers to the seven PAR-Q questions, and anything you write about injuries, medications and other details. This is health information and is treated with the additional protection the law requires — see section 5.
3.4 The "tell me about you" form
Your goals, why now, training history, how many days a week and how long you can train, where you train and what equipment you have, your working pattern, your sleep, your stress, notes about your food, what you enjoy and what you dislike.
3.5 Coaching and training records
The sessions you log and the exercises, weights, reps, times and distances in them; how a session felt; your personal bests; your habit entries (steps, water, protein, fibre, sleep); your weekly reflections; badges you have earned; the programmes assigned to you; and notes exchanged between you and Mischa.
3.6 Food & Fuel
If you use it: what you ate and when, photographs of meals if you choose to take them, how hungry you were before and how full afterwards, how a meal made you feel, your water intake, your weekly focus and your reflections on it.
The site also works out patterns from this — for example, whether you are logging fewer eating occasions than usual over several weeks. Some of these patterns are marked for Mischa's attention. These notes are visible to Mischa and not shown to you on screen, but they are your personal information and you can ask to see them at any time (section 16).
3.7 The community
Anything you post, comment, react to or report; photographs you attach; and which challenges you have joined and ticked off.
3.8 Coaching notes about you
Mischa keeps private working notes against your record — the same as a paper notebook, but on the system. They are not shown to you on screen. They are still your personal information and you can ask for a copy (section 16).
3.9 Payment information
We never see or store your card or bank details. Those go directly to GoCardless (section 8).
We keep the membership you are on, the amounts agreed, the dates of payments, whether each payment succeeded or failed, refunds, and reference codes that let us look a payment up with GoCardless.
3.10 Technical and security information
Your IP address and browser description when you sign in or when something security-relevant happens; sign-in attempts, successful and failed; devices you have chosen to trust so that two-step sign-in does not ask you every time; two-step codes while they are valid; and records of pages that produced an error.
4. Our lawful bases
Data protection law requires a lawful reason for using your information.
Contract — to consider your application, create and run your account, take payment, provide the coaching you have paid for, answer you, and manage cancellations.
Legal obligation — accounting and tax records, consumer protection, and responding to lawful requests from a court or regulator.
Legitimate interests — keeping the site secure and free of abuse, keeping proper business records, investigating complaints, defending legal claims, and improving what we offer. We only rely on this where your rights do not override it, and you can object (section 16).
Consent — for meal photographs and typed meal descriptions being sent to an AI service, for any public use of your photographs or words, for marketing emails, and for the health information described in section 5. You can withdraw consent at any time; that does not make what happened before unlawful.
5. Health information
Health information is "special category" data under UK GDPR and needs a second condition on top of a lawful basis. We rely on your explicit consent (Article 9(2)(a)), which you give by ticking the health box at registration and again on the PAR-Q.
Health information here means: your PAR-Q answers, injuries, medications, anything health-related you tell Mischa or write in a form or a session note, how sessions felt, your food records and the patterns worked out from them, and anything health-related you choose to put in a community post.
We use it to decide whether coaching is safe and suitable for you, to adapt or pause your programme, to recommend you see a doctor where that seems right, and to keep a record of what our coaching decisions were based on.
If you withdraw consent, email hello@mindfulmovementclub.com and we will stop using it and delete it, unless we need to keep a limited record to defend a legal claim — and we will tell you if so. Coaching cannot safely continue without it, so withdrawing consent will normally end the coaching relationship. It will never be held against you.
6. Automated checks, and where a machine decides something
Three things on this site happen automatically. We describe them because you have a right to know, and to ask a human to look instead.
Community posts. Every post and comment written by a member is checked by an automated service before it appears, looking for abuse, discrimination, threats, sexual content, spam and scams. If it is unsure, your post is held back and Mischa reads it herself and releases it if all is well. Nothing is deleted by the machine. If you think a post was held wrongly, email us and it will be looked at by a person.
Health screening and payment. If you answer "yes" to any PAR-Q question, the site stops before taking any payment and puts your application in front of Mischa. That hold is automatic; the decision that follows is always hers.
Blocking abusive traffic. Repeated failed sign-ins or automated probing temporarily block an IP address, for between 15 minutes and 72 hours. This is about addresses, not people. If you are ever locked out, email us and we will clear it.
Food & Fuel patterns. The notes described in section 3.6 are worked out by a set of fixed rules, not by AI, and they are only ever a prompt for Mischa to have a conversation with you. Nothing happens to your membership because of one.
We do not make decisions about your membership or your money by automated means alone.
7. Artificial intelligence
Two features use an AI service provided by Anthropic PBC (United States). We tell you exactly what is sent, because "we may use AI" is not an answer.
7.1 Naming the food in a meal
If you send a photograph of a meal, or type what you ate, that photograph or those words are sent to Anthropic purely to list the foods. Your name, your email address, your account and everything else about you stays here — the request carries the picture or the text and nothing that identifies you.
The result is a suggested list which you then correct and confirm before anything is saved. Quick add and search do not send anything anywhere.
This happens only if you have turned it on, and you can turn it off in Food & Fuel at any time.
7.2 Checking community posts
The text of every member post and comment is sent to the same service to be checked as described in section 6. No name or account information is sent with it. Photographs are not sent.
Please bear this in mind when writing: if you put health details in a public post, that text is checked by the service in the same way as anything else. Anything you would rather keep between you and Mischa is better sent to her directly.
7.3 The weekly Food & Fuel note
Once a week the site sends figures only — how many days you logged, dot counts, plant variety — to generate a couple of encouraging sentences. No meal descriptions, no photographs, no name.
7.4 What Anthropic does with it
Anthropic processes this on our behalf under their commercial terms. It is not used to train their models. Because they are in the United States, this is an international transfer — see section 10.
If we ever change AI provider, this section will be updated before the change is made.
8. Payments and Direct Debit
Payments are handled by GoCardless Ltd, Sutton Yard, 65 Goswell Road, London, EC1V 7EN — a payment institution authorised by the Financial Conduct Authority.
When you join, you are taken to GoCardless's own secure page to authorise your first payment and set up your Direct Debit. Your name and email address are passed across to save you typing them; your bank details are given to GoCardless directly and never pass through this website.
GoCardless tells us whether a payment succeeded, when it will be collected, and whether a Direct Debit is active. Their own privacy notice is at gocardless.com.
Your Direct Debit is covered by the Direct Debit Guarantee.
9. Who we share your information with
We do not sell your personal information, and we do not share it for anyone else's marketing.
| Who | What they get | Where |
|---|---|---|
| Fasthosts Internet Limited | Hosting — everything on the site sits on their servers. They also carry our email. | United Kingdom |
| GoCardless Ltd | Your name, email and payment arrangements (section 8) | United Kingdom |
| Anthropic PBC | Meal photographs, typed meal descriptions, community post text (section 7) | United States |
| Microsoft (OneDrive) | The nightly backup copy of the site's database, and the monthly accounts spreadsheet | Data centre location depends on the account; see section 10 |
| Google (YouTube) and Vimeo | Your IP address and browser, only if you play an exercise or challenge video. Nothing else, and nothing until you press play. | United States |
| cron-job.org | Nothing about you. It only asks our site to run its nightly tidy-up. | Germany |
| An accountant, insurer or solicitor | Only if genuinely needed, and only what is needed | United Kingdom |
We may also disclose information where the law requires it — a court order, a regulator's lawful request, preventing fraud, protecting someone's safety, or establishing or defending a legal claim.
What we deliberately do not use: no analytics, no advertising, no tracking pixels, no social-media trackers, and no fonts or scripts loaded from anyone else's servers. When you read a page here, no third party is contacted at all.
Healthcare professionals
We do not routinely tell your GP or any other healthcare professional anything. If we think medical clearance is sensible, we will normally ask you to speak to them. If you ask us to write to someone on your behalf, we will ask your permission first.
10. Information leaving the UK
Two of the organisations above are outside the UK:
- Anthropic PBC (United States) — section 7.
- Microsoft (OneDrive backups) — the country depends on the account settings.
Where information goes to a country without UK "adequacy" status, we rely on the safeguards permitted by UK data protection law — in practice the International Data Transfer Addendum to the EU Standard Contractual Clauses, which both providers offer as part of their standard terms.
You can ask us for more detail about these safeguards.
11. Cookies
This site sets three cookies and no others. It does not use analytics or advertising cookies, and it does not set any cookie belonging to another company.
Full detail, including names and lifetimes, is in the separate Cookie Policy at www.mindfulmovementclub.com/cookies.php.
12. How long we keep things
| Information | Kept for |
|---|---|
| Sign-in attempts (email and IP) | 30 days |
| Routine security records | 30 days |
| Notable security records — including that an account was deleted | 180 days |
| Two-step sign-in codes | 7 days |
| Devices you asked us to trust | 30 days |
| Your activity feed | 120 days |
| Website error records | 90 days |
| Meal photographs | 90 days, then the picture is deleted automatically. The meal record itself stays. |
| A meal photo you started and never saved | 24 hours |
| Backup copies of the database | 14 nightly copies on the server; up to 30 days in OneDrive |
| Enquiries that do not become memberships | Deleted when no longer needed, normally within 12 months |
| Your account, health screening, coaching, training and food records | For as long as you are a member, then reviewed — see below |
| Payment and accounting records | 6 years after the end of the tax year they relate to, because HMRC requires it |
After your membership ends. We keep your health screening and coaching records for as long as they may reasonably be needed to answer a question about coaching you were given, to deal with a complaint, or to defend a legal claim, and no longer. In practice this is normally up to six years, matching the usual limitation period in England and Wales. This is reviewed by hand rather than deleted automatically, so if you would like it gone sooner, ask — see section 16.
13. Security
- Passwords are stored only as a one-way hash. Nobody, including Mischa, can read your password.
- Two-step sign-in is available using an authenticator app or an emailed code, with single-use recovery codes.
- Every page is served over an encrypted connection, and browsers are told never to use an unencrypted one.
- The site limits repeated failed sign-ins and temporarily blocks addresses that behave like automated attacks.
- Forms are protected against cross-site request forgery, and the database is accessed only through parameterised queries.
- Your session is tied to the browser it started in and ends after two hours of inactivity.
- Meal photographs, community photographs and uploaded documents are not served directly by the web server — the site checks who you are before handing one over.
- Security-relevant events are logged, and every administrative action Mischa takes on an account is recorded in an audit trail.
- Backups are taken nightly, permission-restricted, and stored outside the public part of the website.
No system can be promised to be completely secure. Please keep your own password to yourself and do not reuse it elsewhere.
14. What other members can see
The community is visible only to signed-in members.
Other members can see: your first name only (never your surname), your profile picture if you have one, your short bio, the month you joined, how many challenges you have completed, and anything you have posted, commented or reacted to, including photographs you attach.
Other members cannot see your surname, email address, telephone number, address, date of birth, health screening, injuries, medications, weight, measurements, training records, habits, food records or reflections. There is no leaderboard and no ranking.
Mischa, as your coach, can see everything you have given the site.
15. Under-18s
Membership through this website is for adults. The site refuses registration if the date of birth given is under 18, and that is checked on the server, not just in the browser.
If you are under 18 and would like to train with Mischa, please email hello@mindfulmovementclub.com. Any arrangement would be made directly with your parent or guardian, with their consent, and outside the standard online membership.
16. Your rights
You can ask us to:
- give you a copy of the personal information we hold about you — including your coaching notes, your health screening and the Food & Fuel patterns described in section 3.6;
- correct anything that is wrong or incomplete;
- delete your information;
- restrict what we do with it;
- transfer what you gave us to you or someone else in a machine-readable form;
- object to anything we do on the basis of legitimate interests, and to direct marketing at any time and absolutely; or
- withdraw consent where we relied on it.
Email hello@mindfulmovementclub.com. We will reply within one month. We may need to check who you are first. It is free unless a request is clearly unfounded or excessive.
Deleting your account. Ask us and we will do it. That removes your account, your health screening, your training, habit and food records — including the private eating-pattern notes — your community posts and comments, your photographs, and the image files from the server. Two things survive on purpose: our security log keeps a note that a deletion happened, for 180 days; and nightly backups still contain a copy until they age out, which takes about a month. Where we must keep an accounting record of a payment, we keep the minimum for that alone.
Not every right applies in every situation, and where one does not we will explain why.
17. Marketing
We will only email you about programmes, offers or events if you have agreed, or where electronic marketing law otherwise allows it because you are an existing customer of something similar.
Every marketing email has an unsubscribe link, or you can email us. Stopping marketing does not stop essential emails about your membership, payments, account security or coaching.
18. Keeping your information accurate
Please tell us if your contact details change, and — importantly — if anything about your health changes: a new illness, injury, diagnosis, medication, pregnancy, operation, or a food allergy or intolerance. You can update most things yourself under Account & details, or email us.
19. Complaints
Please tell us first, so that we can put it right:
The Mindful Movement Club, 6 Westbourne Place, Farnham, Surrey, GU9 8EF
hello@mindfulmovementclub.com
You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator:
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire, SK9 5AF
Helpline 0303 123 1113 · ico.org.uk
You do not have to come to us first, and doing so does not affect your right to complain to them.
20. Changes to this notice
We will update this notice when what we do changes — a new service provider, a new feature, or a change in the law. The current version is always at www.mindfulmovementclub.com/privacy.php, with the date it was last changed at the top. If a change materially affects you, we will tell members directly.
21. Contact
The Mindful Movement Club
Mischa Kluyver
6 Westbourne Place, Farnham, Surrey, GU9 8EF
hello@mindfulmovementclub.com
www.mindfulmovementclub.com