Who we are
This website and The Resilience Protocol journal are run by Mandeep Sandhu, the “data controller” responsible for your personal information.
- Contact: mandeep@resiliencemeasure.com
- Postal address: available on request via the email above
- ICO registration: registered with the UK Information Commissioner’s Office (registration number available on request)
The short version. We collect your email so we can send you what you asked for. If you use Scan Sunday, we read only the metrics and short review lines on the one page you choose to send. We never read your private “deep” journal pages, we never sell your data, and you can ask us to delete everything at any time.
What we collect, and why
If you join the mailing list
What: your email address (and first name, if you give it). Why: to send you the free companion resources and our weekly email. Lawful basis: your consent (UK GDPR Article 6(1)(a)). Withdraw it any time with the unsubscribe link in any email.
If you use Scan Sunday
When you email a photo of your weekly review page to our scan address, we process: your email address; the numbers on that page (daily load scores, reps, review completed); and the short review lines you wrote (“a win”, “the pattern I can see”, “what I’m carrying less of”), plus a general theme tag.
What we do not process: we do not read or store your daily pages or your weekly 15-minute deep-writing pages. Those stay on paper, always. Only the weekly review page you choose to send is ever read.
Why: to generate and email you your personalised Protocol Report — your practice score, load trend, and your own words reflected back. Lawful basis: because these lines can reveal information about your health or wellbeing, we rely on your explicit consent (Articles 6(1)(a) and 9(2)(a)), given by a separate, specific opt-in. You can withdraw it at any time.
When you visit this site
Our hosting provider handles basic technical data (such as IP address and browser type) to keep the site secure and running. This is a static site: we set no analytics, advertising or other non-essential cookies.
We never ask for payment details — purchases of the journal happen on Amazon under Amazon’s own terms and privacy policy.
Who we share it with
We don’t sell your data or share it for anyone else’s marketing. We use a small number of service providers (“processors”) purely to run the service, each under a data-processing agreement:
| Provider | What they do |
|---|---|
| Zoho | Email and mailing-list platform (sends your emails and reports) |
| Make.com | Automates the Scan Sunday workflow |
| OpenAI | Reads (transcribes) the text on the review page you send |
| Airtable | Securely stores your reader record and scan results |
| QuickChart | Generates your trend chart image (from numbers only — no name or email) |
| Cloudflare | Hosts and secures this website |
We may also disclose information if the law requires it.
Sending data outside the UK
Some providers process data outside the UK (for example in the United States). Where that happens, the transfer is protected by a legally recognised safeguard — such as the UK Extension to the EU–US Data Privacy Framework, or the UK International Data Transfer Agreement (IDTA). Ask us which safeguard applies to a particular provider.
How long we keep it
- Mailing list: until you unsubscribe or ask us to delete you.
- Scan Sunday data: while you’re an active reader, then deleted after 24 months of inactivity — or sooner if you ask.
- Scan photos: processed to extract the figures and not retained afterwards where technically possible.
Your rights
Under UK data protection law you can: access a copy of your data; rectify inaccurate data; have your data erased; restrict or object to processing; receive your data in a portable format; and withdraw consent at any time (this won’t affect processing already carried out).
To exercise any right, email mandeep@resiliencemeasure.com. We’ll respond within one month; there’s normally no charge. We make no decision about you with legal or similarly significant effect by automated processing alone.
Children
This service is for adults. It isn’t intended for anyone under 18, and we don’t knowingly collect data from under-18s. If you believe a child has provided us data, contact us and we’ll delete it.
How to complain
If you’re unhappy with how we’ve handled your data, contact us first so we can put it right. You also have the right to complain to the UK regulator: the Information Commissioner’s Office (ICO) — ico.org.uk · 0303 123 1113.
Changes to this notice
We may update this notice from time to time. The date at the top shows the latest version; significant changes will be communicated by email where appropriate.