Privacy Policy

---

How we collect, use, protect and share personal information

Effective / last updated: September 2026

This Privacy Policy is for the Don’t Sit Up Community operated by Dont-sit-up, company number. Before publication, insert the final legal entity, address and contact email and confirm the actual technology/payment providers used.

1. Who we are

For UK data-protection purposes, Dont-sit-up is the controller of personal information described in this policy unless another organisation is identified as the controller for a particular service.

2. Information we may collect

·       identity and contact information, such as name, email address and telephone number;

·       account and membership information, subscription status and preferences;

·       transaction information and payment status (full card details are normally handled by the payment provider rather than Don’t Sit Up);

·       communications with us, including enquiries, complaints and cancellation requests;

·       event, Zoom, WhatsApp or other community participation information;

·       technical information such as IP address, device/browser information, security logs and cookie identifiers where applicable;

·       marketing preferences and newsletter engagement information; and

·       information you voluntarily share in the Community, which may include information about health, symptoms, diagnoses, treatment or disability.

3. Health information and other special-category data

Health information is special-category personal data. We aim to collect and retain only what is reasonably necessary. Much health information within the Community is volunteered by members in support discussions rather than requested as a condition of membership.

Before launch, Don’t Sit Up must document the appropriate Article 6 lawful basis and Article 9 condition for each way in which it intentionally processes health information. Where explicit consent is relied upon, consent must be specific, informed, freely given and capable of being withdrawn. Withdrawal does not make earlier lawful processing unlawful.

Members should avoid sharing more health information than is necessary, particularly in group environments.

4. Why we use personal information and lawful bases

Depending on the activity, we may use personal information to:

·       create and administer memberships and provide paid services – generally necessary to perform the membership contract;

·       process and reconcile payments – generally necessary to perform the contract and meet accounting/legal obligations;

·       respond to enquiries, cancellations and complaints – contract, legal obligation and/or legitimate interests as applicable;

·       operate, moderate and secure the Community – legitimate interests in providing a safe, functional service, balanced against members’ rights;

·       send essential service communications – contract and/or legitimate interests;

·       send optional marketing – consent where required, or another lawful basis where legally permitted;

·       comply with tax, accounting, fraud-prevention, safeguarding or other legal requirements – legal obligation and/or legitimate interests as applicable; and

·       improve the service using appropriately minimised information – legitimate interests where appropriate.

Where we intentionally process special-category health information, we will also identify and document an appropriate Article 9 condition before that processing takes place.

5. Who we may share information with

We may share the minimum necessary information with service providers that help us operate the Community, such as website/membership hosting, payment processing, email/newsletter services, Zoom or other video-conferencing services, WhatsApp/Meta services where used, cloud storage, IT/security support, accountants and professional advisers.

We may also disclose information where required by law, to establish or defend legal claims, to protect rights or safety where legally justified, or in connection with a lawful business reorganisation.

We do not sell members’ personal information.

6. International transfers

The Community is international and some suppliers or collaborators may be located outside the UK, including in the United States. If personal information is transferred outside the UK in a way restricted by UK data-protection law, we will use an applicable lawful transfer mechanism, such as UK adequacy regulations or appropriate safeguards, and carry out any required assessment.

Before launch, the actual providers and transfer mechanisms should be documented and reflected in this policy where appropriate.

7. WhatsApp and group privacy

If you join a WhatsApp group, other group members may be able to see your telephone number, profile name, photograph and other profile information depending on WhatsApp functionality and your settings. Information you post is also visible to other participants. Do not post information you do not want other group members to receive.

8. Recordings

Where a Zoom meeting or event is recorded, we will endeavour to give clear notice beforehand. We will identify an appropriate lawful basis for the recording and any subsequent use. Identifiable health disclosures will not be intentionally used for promotional purposes without appropriate permission.

9. Retention

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, tax, fraud-prevention and dispute requirements.

A cancelled membership account may remain dormant for up to 60 days for possible reactivation. This does not mean every item of data will be deleted automatically on day 60; information that must or may lawfully be retained for another justified purpose can be retained for the appropriate period. We will periodically review retention periods and securely delete or anonymise information that is no longer needed.

10. Security

We use reasonable organisational and technical measures appropriate to the nature and sensitivity of the information we process. No internet service can guarantee absolute security, so members should also protect their account credentials and be cautious about what they disclose in group environments.

11. Your data-protection rights

Depending on the circumstances, UK data-protection law may give you rights to be informed; access your personal information; have inaccurate information corrected; request erasure; restrict processing; object to certain processing; receive certain information in a portable format; and rights relating to solely automated decision-making.

To exercise a right, contact [PRIVACY / CONTACT EMAIL TO BE INSERTED]. We may need to verify your identity. You also have the right to complain to the UK Information Commissioner’s Office (ICO) if you are unhappy with how your information is handled.

12. Marketing preferences

You can unsubscribe from optional marketing at any time using the unsubscribe mechanism provided or by contacting us. Essential membership/service messages may still be sent while needed to provide or administer the service.

13. Children

The paid Community is intended for adults aged 18 or over. We do not knowingly invite children to create paid membership accounts under these Terms.

14. Cookies

Our website may use cookies and similar technologies. Essential cookies may be used where necessary to operate the site. Non-essential cookies, such as analytics or advertising cookies, should not be set until any consent required by law has been obtained. See our Cookie Policy for more information.

15. Changes to this policy

We may update this policy when our services, providers or legal obligations change. Material changes will be communicated where appropriate. The current version will show its effective date.

Back to: Before You Join