Privacy · Draft for legal review
Consent, privacy and your rights
This is a working draft. It has not been reviewed by legal counsel and must not be relied on as a privacy notice. We make no claim of GDPR compliance at this stage.
Privacy philosophy
- Collect the minimum. Every demographic question is optional.
- Separate who you are from what you answer. Contact details sit in an isolated identity store; research data is keyed by a pseudonymous study code.
- Researchers see aggregates only, with groups under 10 suppressed.
- Longitudinal data linked by a study code is pseudonymised, not anonymous. Only aggregated published reports are intended to be anonymous, and we do not promise that re-identification is mathematically impossible.
Consent
Taking part is voluntary and entirely separate from purchasing or attending a Journey programme. Declining or withdrawing has no effect on your programme, pricing or relationship with The Journey. Consent is recorded with a timestamp and consent-text version.
Your rights
Access, rectification, erasure, restriction, objection, portability, and withdrawal at any time. Data already included in published aggregates cannot be removed from those aggregates. See the portal for the demonstration rights flow.
Items to be confirmed
| Data controller and contact | TBC |
| Data Protection Officer | Appointment pending |
| Lawful basis (Art. 6) | TBC — under legal review |
| Special-category data condition (Art. 9) — health/wellbeing data | TBC — likely explicit consent or scientific research condition; requires legal advice |
| Data Protection Impact Assessment | Required — not yet started |
| Retention period | TBC |
| Processors and sub-processors | TBC |
| International transfers and safeguards | TBC |
| Incident and breach response | Procedure to be drafted; 72-hour regulator notification where applicable |