Who we are

The Concussion Journey (“we”, “us”, “TCJ”) provides post concussion syndrome recovery guidance and education. The Concussion Journey is the trading name of Barney Davies, a sole trader based in the United Kingdom, who is the data controller for the personal information described in this policy.

Business address: available on request by Contact for privacy matters: Barney Davies, [email protected]

We are based in the United Kingdom and work with clients around the world. UK data protection law (the UK GDPR and the Data Protection Act 2018) applies to how we handle your information wherever you are.

The short version

We collect what we need to send you what you asked for, to run your programme if you become a client, and to keep our business running. We never sell your information. Because our work involves your health, some of what you tell us is sensitive, and we only use it with your explicit consent. You can ask us to delete it at any time.

What we collect and why

When you download a guide or take a quiz on our website

What: your name, email address, country, phone number (if you give it), whether you are 18 or over, and any answers you give in a quiz. We also record how you found us (for example, which advert or post you clicked).

Why: to send you the guide or quiz result you asked for, to follow up by email with related information and an offer of a free Discovery Call, and to understand which of our marketing works.

Lawful basis: consent (you tick the box), and our legitimate interest in understanding our marketing. You can unsubscribe from emails at any time with one click.

When you book a Discovery Call

What: your name, email, phone number, country, a short summary you write about where you are with your recovery, and whether you are 18 or over.

Why: to hold the call, prepare for it, and follow up afterwards.

Lawful basis: taking steps at your request before entering into a contract. Your recovery summary may include health information, which we process on the basis of your explicit consent, given when you submit the booking form.

When you become a client

What: everything above, plus your client agreement, payment details (handled by our payment processor, we never see your full card number), the information you share on calls and in the client portal (symptoms, symptom scores, history, progress, exercise and heart rate data, messages), and recordings or transcripts of calls where you have agreed to them.

Why: to deliver your programme, track your progress, keep records of the guidance we give you, and handle billing.

Lawful basis: performing our contract with you. Health information is processed on the basis of your explicit consent, which you give in the client agreement and can withdraw at any time (though we may then be unable to continue working with you).

When you visit our website

What: standard technical information (IP address, browser, device, pages visited) and cookie data, including advertising cookies from Meta, TikTok and Google if you accept them.

Why: to make the site work, to understand how it is used, and to show relevant adverts to people who have visited.

Lawful basis: consent for non-essential cookies (see Cookies below), legitimate interest for essential ones.

Under-18s

We work with people of all ages. If you are under 18, a parent or legal guardian must be present on your first call with us and must agree to the client agreement on your behalf. We collect your age at the first point of contact so we can make sure this happens. If we learn we have collected information from someone under 18 without a parent or guardian’s involvement, we will delete it.

Who we share your information with

We do not sell or rent your information to anyone. We share it only with the service providers we use to run the business, each of which is bound by contract to protect it and use it only on our instructions:

•           GoHighLevel (customer records, email, SMS, booking, forms and payments processing), United States

•           Stripe (card and subscription payments), United States and Ireland

•           Supabase (client portal database, hosted in the EU) and Vercel (client portal hosting), EU and United States

•           Otter.ai (call transcription, only where you have agreed to a call being recorded), United States

•           Google Workspace (email and documents), United States and EU

•           Zoom or Google Meet (video calls)

•           Meta, TikTok and Google (advertising and analytics cookies, only with your consent)

We may also share information where the law requires it, or where it is necessary to protect someone’s safety.

International transfers

Some of these providers are outside the UK. Where information leaves the UK we rely on the UK’s adequacy regulations, the UK Extension to the EU-US Data Privacy Framework, or the UK International Data Transfer Agreement or Addendum, which give your information the same legal protection as it has here.

How long we keep it

•           Guide and quiz leads who never become clients: 24 months from your last interaction with us, then deleted.

•           Discovery Call bookings who do not become clients: 24 months from the call, then deleted.

•           Clients: for the length of our work together and for six years afterwards, which is the period we need to keep records for legal, insurance and accounting purposes. Call recordings and transcripts are deleted 12 months after our work together ends unless you ask us to delete them sooner.

•           You can ask us to delete your information earlier at any time (see Your rights).

Your rights

You have the right to:

•           ask for a copy of the information we hold about you

•           ask us to correct anything that is wrong

•           ask us to delete your information

•           ask us to stop or restrict how we use it

•           object to us using it for marketing (you can also just unsubscribe)

•           ask for your information in a portable format

•           withdraw consent at any time where consent is our lawful basis

To use any of these rights, email [email protected]. We will respond within one month. There is no charge.

If you are unhappy with how we have handled your information, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to sort it out first.

Cookies

Our website uses essential cookies to work, and, with your consent, analytics and advertising cookies from Google, Meta and TikTok. You can accept or decline non-essential cookies when you first visit, and change your mind at any time using the cookie settings link in the footer or your browser settings.

Security

Your information is stored on encrypted systems with access limited to the people who need it. Payment card details are handled entirely by Stripe and never touch our systems. No system is completely secure, and if we ever discover a breach that puts your information at risk we will tell you and the ICO as the law requires.

A note on what we are not

The Concussion Journey provides recovery guidance and education. We are not a medical provider and nothing we do replaces care from a doctor or other clinician. Please do not send us information you would only share with a medical professional unless you are comfortable with it being handled as described in this policy.

Changes to this policy

We will update this policy when our practices change and put the date at the top. If a change is significant we will email you about it.