Privacy Policy

1. Who we are

My Core Wound (mycorewound.com) provides personalised self-reflection reports and related digital services. For the purposes of UK and EU data protection law, we are the data controller for personal data processed through this website and your account.

Contact: enquiries@mycorewound.com

2. Personal data we collect

Depending on how you use the service, we may collect:

• Account details — name, email address, password (stored in hashed form), and account preferences.
• Birth and profile information — date, time, and place of birth, biographical notes you choose to add, and related profile data used to generate reports.
• Report content — generated readings, feedback you submit, and settings associated with your reports.
• Purchase records — reports or bundles you buy, transaction references, and entitlement history.
• Technical and usage data — IP address, browser type, device information, session cookies, theme preferences, and logs needed to operate and secure the service.
• Communications — messages you send us via email or the contact form.

We do not intentionally collect special category data (such as health records). Please do not submit medical diagnoses or crisis information through the service.

3. How we use your data and our legal bases

We process personal data only where we have a lawful basis under UK GDPR:

• Contract — to create and manage your account, generate and deliver reports you request or purchase, and provide customer support.
• Legitimate interests — to improve the service, prevent fraud and abuse, maintain security, and understand aggregated usage, balanced against your rights.
• Consent — where required for optional features, marketing communications, or non-essential cookies. You may withdraw consent at any time.
• Legal obligation — where we must retain or disclose information to comply with law, regulation, or valid legal requests.

4. AI-assisted report generation

Reports are generated using automated systems, including third-party AI services. To produce a report, relevant profile and birth information you provide may be transmitted to those providers solely for generation and delivery of your content. We configure providers to process data for our instructions and not for their own unrelated purposes, subject to their terms and safeguards.

AI-generated content is for self-reflection only and is not professional advice. See our Terms & Conditions.

5. Sharing your data

We do not sell your personal data. We may share it with:

• Service providers — hosting, email delivery, payment processors, analytics, and AI providers that help us run the service under contract.
• Professional advisers — lawyers, accountants, or insurers where reasonably necessary.
• Authorities — if required by law or to protect rights, safety, and security.

Where providers process data outside the UK/EEA, we rely on appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms.

6. Retention

We keep personal data only as long as needed for the purposes above:

• Account and report data — while your account is active and for a reasonable period afterwards if you delete your account, unless law requires longer retention.
• Purchase records — as required for tax, accounting, and consumer law (typically up to six years).
• Support and contact messages — long enough to resolve your inquiry and maintain an appropriate record.
• Security logs — for a limited period appropriate to security monitoring.

7. Your rights

If you are in the UK or EEA, you have the right to:

• Access a copy of your personal data.
• Rectify inaccurate data.
• Erase data in certain circumstances.
• Restrict or object to processing in certain circumstances.
• Data portability for data you provided, where processing is based on consent or contract and carried out by automated means.
• Withdraw consent at any time, without affecting prior lawful processing.
• Lodge a complaint with the Information Commissioner’s Office (ICO) in the UK, or your local supervisory authority.

To exercise your rights, email enquiries@mycorewound.com. We may need to verify your identity before responding.

8. Cookies and similar technologies

We use essential cookies to keep you signed in, protect forms, and remember preferences such as your chosen site theme. Non-essential cookies, if any, will be used only with your consent where required by law.

You can control cookies through your browser settings. Disabling essential cookies may limit account functionality.

9. Security

We implement appropriate technical and organisational measures to protect personal data, including access controls, encryption in transit where supported, and secure password storage. No online service can guarantee absolute security; please use a strong, unique password and keep it confidential.

10. Children

The service is intended for adults aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it promptly.

11. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top will change when we do. Material changes will be highlighted on the site or communicated where appropriate.