Straight answers
Privacy notice
Last updated 28 September 2026
Who we are
This website, The Resilience Protocol journal and Resilience Measure (the organisational service being developed under Resilience Protocol) are run by Mandeep Sandhu, the “data controller” responsible for your personal information.
- Contact: mandeep@resiliencemeasure.com
- Postal address: available on request via the email above
The short version. We collect only what we need to give you what you asked for. We never read your private journal pages. We never sell your data. The figures you type into the Pulse’s commercial lens never leave your browser. And you can ask us to delete everything at any time.
What we collect, and why
If you join the mailing list
What: your email address (and first name, if you give it). Why: to send you the free companion resources and our weekly email. Lawful basis: your consent (UK GDPR Article 6(1)(a)). Withdraw it any time with the unsubscribe link in any email.
If you use Scan Sunday
When you email a photo of your weekly review page to our scan address, we process: your email address; the numbers on that page (daily load scores, reps, review completed); and the short review lines you wrote (“a win”, “the pattern I can see”, “what I’m carrying less of”), plus a general theme tag.
What we do not process: we do not read or store your daily pages or your weekly 15-minute deep-writing pages. Those stay on paper, always. Only the weekly review page you choose to send is ever read.
Why: to generate and email you your personalised Protocol Report — your practice score, load trend, and your own words reflected back. Lawful basis: because these lines can reveal information about your health or wellbeing, we rely on your explicit consent (Articles 6(1)(a) and 9(2)(a)), given by a separate, specific opt-in. You can withdraw it at any time.
If you use the Resilience Pulse
The Pulse works out your basic result in your browser. Nothing is sent to us unless you choose to unlock the detailed report.
If you unlock the detailed report, we receive: your first name, work email and company; any optional details you add (job role, employee-count band, industry, main workforce issue); your answers to the ten statements and any concerns you ticked; a summary of your result; and whether you ticked the optional box to hear from us.
What we never receive: the headcount, salary and absence figures you type into “Put a commercial lens on this” — they stay in your browser. The Pulse doesn’t ask about individual employees or anyone’s health; please don’t include names or health details in the free-text box.
Why: to prepare and show your report, to reply if you contact us about it, and to learn — in aggregate — what leaders find useful while Resilience Measure is in private validation. Lawful basis: our legitimate interests in providing the report you asked for and developing the service (Article 6(1)(f)). We only email you about your results or early pilot opportunities if you tick the optional box — that is based on your consent (Article 6(1)(a)), which you can withdraw at any time.
If you take part in the leadership research, or email us
What: your name, role, organisation and contact details, and written notes of our conversation. Why: to arrange the conversation and to understand how organisations handle workplace pressure. Comments are never attributed to you or your organisation without your permission, and calls are not recorded unless you agree first. Lawful basis: legitimate interests (Article 6(1)(f)).
When you visit this site
Our hosting provider handles basic technical data (such as IP address and browser type) to keep the site secure and running. The site’s typefaces load from Google Fonts, so your browser connects to Google’s servers, which receive your IP address. We set no advertising or tracking cookies.
We never ask for payment details — the journal is bought on Amazon, under Amazon’s own terms and privacy policy.
Who we share it with
We don’t sell your data or share it for anyone else’s marketing. We use a small number of service providers (“processors”) purely to run the service:
| Provider | What they do |
|---|---|
| Zoho | Email and mailing lists — sends your emails and reports, and holds the optional Resilience Measure updates list |
| Airtable | Securely stores reader records, scan results and Pulse report requests |
| Make.com | Automates the Scan Sunday workflow |
| OpenAI | Reads (transcribes) the text on the review page you send |
| QuickChart | Generates your trend chart image (from numbers only — no name or email) |
| Cloudflare | Hosts and secures this website, and passes Pulse report requests to Airtable |
| Delivers the website’s typefaces (Google Fonts) |
We may also disclose information if the law requires it.
Sending data outside the UK
Some providers process data outside the UK (for example in the United States). Where that happens, the transfer is protected by a legally recognised safeguard — such as the UK Extension to the EU–US Data Privacy Framework, or the UK International Data Transfer Agreement (IDTA). Ask us which safeguard applies to a particular provider.
How long we keep it
- Mailing list and Resilience Measure updates: until you unsubscribe or ask us to delete you.
- Scan Sunday data: while you’re an active reader, then deleted after 24 months of inactivity — or sooner if you ask.
- Scan photos: processed to extract the figures and not retained afterwards where technically possible.
- Pulse report requests and research notes: 12 months from when we receive them or from our last contact, then deleted. Anonymised, aggregated learnings — with no names or organisations — may be kept.
- Emails you send us: kept for as long as needed to reply and follow up, and reviewed at least every 12 months.
Your rights
Under UK data protection law you can: access a copy of your data; rectify inaccurate data; have your data erased; restrict or object to processing (including processing based on our legitimate interests); receive your data in a portable format; and withdraw consent at any time (this won’t affect processing already carried out).
To exercise any right, email mandeep@resiliencemeasure.com. We’ll respond within one month; there’s normally no charge. We make no decision about you with legal or similarly significant effect by automated processing alone.
Children
This service is for adults. It isn’t intended for anyone under 18, and we don’t knowingly collect data from under-18s. If you believe a child has provided us data, contact us and we’ll delete it.
How to complain
If you’re unhappy with how we’ve handled your data, contact us first so we can put it right. You also have the right to complain to the UK regulator: the Information Commissioner’s Office (ICO) — ico.org.uk · 0303 123 1113.
Changes to this notice
We may update this notice from time to time. The date at the top shows the latest version; significant changes will be communicated by email where appropriate.