Privacy Policy

---

PRIVACY POLICY FOR EXERCISINGMINDFULNESS.ORG 

Last updated: [26.11.2025] 

1.ExercisingMindfulness.org (“we,” “our,” “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and safeguard your personal data when you use our website and mental-health coaching services. We comply with the EU General Data Protection Regulation (GDPR) and all applicable Finnish data-protection laws. 

1. Data Controller ExercisingMindfulness.org 

2. Email:  carthie.koivari@exercisemindfulness.org 

3. Website: https://exercisingmindfulness.org 

4. Address: Hiidenpolku 6, 60150, Seinäjoki Finland.

2. What Personal Data We Collect We may collect: - Automatically collected data (IP, browser, analytics) 

· Name

· Email address

· Phone number

· Preferred language

· Booking information (e.g., date/time of sessions)

· Payments or billing details (handled securely by third-party processors)

· Messages sent through contact forms or email

· Automatically collected data (IP, browser, analytics) 

· Voluntary information shared during coaching sessions

Note: Mental-health related information may be considered special category dataunder GDPR. We only process such data with your explicit consent and for the purpose of providing coaching services.

3. Why We Collect Your Data We process data to: 

- Provide coaching services 

· Booking and delivering coaching sessions

· Personalizing support based on your needs

- Communicate with you 

· Responding to your inquiries

· Sending service-related updates (e.g., schedule changes)

- Process payments 

· Processing and confirming payments

- Ensure legal compliance 

· Regulatory compliance under Finnish or EU laws

- Improve our website 

· Understanding how visitors use our services

4. Sensitive Data Mental health–related information is only processed with explicit consent, securely stored, and never shared without permission unless required by law. 

We handle this information with exceptional care:

· Only with your explicit consent

· Stored securely on encrypted systems

· Access limited strictly to authorized personnel

· Never used for marketing

· Never shared with third parties unless required by law or with your consent

We do notprovide clinical therapy, medical diagnosis, or healthcare services.

5. Data Sharing We only share with: - Service providers (payments, hosting, booking) - Legal authorities when required - Others only with explicit consent.

· Each provider processes data under GDPR-compliant agreements.

· We may disclose data if required by Finnish or EU law.

· With explicit consent, for example, if you request a referral or collaboration with another professional.

6. International Transfers If transferred outside the EU/EEA, appropriate safeguards are applied. We ensure adequate safeguards such as:

· Standard Contractual Clauses (SCCs)

· GDPR-compliant data-processing agreements

7. Data Retention 

- Client records: up to 2 years 

- Financial data: 6 years 

- Emails/messages: 12–24 months 

· Analytics and cookies: based on your cookie preferences

You may request deletion at any time (see Section 10).

8. Your GDPR Rights You may request access, correction, deletion, restriction, objection, portability, and withdrawal of consent. Complaints may be filed with the Finnish Data Protection Ombudsman. Finnish Data Protection Ombudsman (Tietosuojavaltuutettu)

Contact: https://tietosuoja.fi

You have the following rights:

· Right to access your personal data

· Right to correct inaccurate information

· Right to delete your data (“right to be forgotten”)

· Right to restrict processing

· Right to data portability

· Right to withdraw consent at any time

· Right to object to certain types of processing

· Right to lodge a complaint with the
 

9. Cookies Used for functionality and analytics; can be disabled. 

We use cookies for:

· Website functionality

· Analytics (e.g., Google Analytics)

· User experience improvement

You can manage or disable cookies in your browser settings.

10. Security Measures Encryption, SSL, access control, audits. 

· Encryption of stored data

· SSL/TLS secure connections

· Access control and authentication

· Regular security audits

· GDPR-compliant data-processing agreements

However, no system is 100% secure, and we cannot guarantee absolute protection.

11. Children’s Data Services for adults 18+. We do not knowingly collect data from minors.

12. Changes Updates posted at https://exercisingmindfulness.org/privacy 

13. For questions, concerns, or data-access requests:

Contact Email: carthie.koivari@exercisemindfulness.org 

Address: Hiidenpolku 6, 60150, Seinäjoki Finland.