Privacy Policy
Last updated: July 2026
1. Who we are
My HS Journey is an independent peer-support and educational project for people affected by hidradenitis suppurativa. For data-protection purposes, the person or organisation responsible for deciding how your personal information is used is:
- Data controller: Lashaan Wray
- Trading/project name: My HS Journey
- Email: shaanwbusiness@gmail.com
In this policy, “we”, “us” and “our” refer to the data controller named above.
2. What this policy covers
This policy explains how we collect, use, store and protect personal information when you:
- Visit the My HS Journey website.
- Submit a form.
- Apply to join our WhatsApp community.
- Contact us by email, WhatsApp or social media.
- Download or request a resource.
- Subscribe separately to updates or marketing.
- Participate in a survey, event or community activity.
WhatsApp and Wix also process information under their own privacy policies. We do not control all processing undertaken independently by those platforms.
3. Information we may collect
Depending on how you interact with us, we may collect:
Information you provide directly
Your first and last name.
Your email address.
Your telephone number.
Your age confirmation.
Your form responses.
Messages and enquiries you send to us.
Your community application and membership status.
Reports, complaints or safeguarding concerns.
Any information you voluntarily share about your experience of HS, treatment, disability, mental health or other health matters. Information relating to health is particularly sensitive and is treated as special-category personal data. Please only provide information that is necessary and that you are comfortable sharing.
Information collected automatically
When you use the website, Wix and connected services may collect technical information such as:
- IP address.
- Device and browser information.
- Pages visited.
- Approximate location derived from IP address.
- Cookie identifiers.
- Website usage and security information.
The precise information collected depends on the Wix features, cookies and integrations enabled on the website.
Information visible through WhatsApp
If you join the WhatsApp community, certain information may be visible to administrators or other participants depending on the community structure and your WhatsApp privacy settings. This may include:
- Your telephone number.
- Your WhatsApp display name.
- Your profile photograph.
- Information you post.
- Images, audio, video or documents you share.
- Reactions and participation in discussions.
Please review your WhatsApp privacy settings before joining.
4. Why we use your information
We may use personal information to:
- Review and manage applications to the WhatsApp community.
- Send applicants a joining link or message.
-Administer and moderate the community.
- Respond to questions, complaints or reports.
- Enforce the Community Guidelines.
- Protect members from abuse, spam, scams, misinformation or unsafe conduct.
- Maintain basic records of consent and policy acceptance.
- Operate, secure and improve the website.
- Provide requested resources.
- Comply with legal obligations.
- Establish, exercise or defend legal claims.
- Send newsletters or promotional updates only where we have a lawful basis and, where required, your separate consent.
We will not use a WhatsApp community application as automatic permission to send marketing.
5. Our lawful bases
Under UK data-protection law, we must have a lawful basis for using personal information.
Depending on the situation, we may rely on:
Consent
- We may rely on your consent where you actively choose to:
- Apply to join the community.
- Provide optional information.
- Receive marketing or newsletters.
- Accept non-essential cookies.
You may withdraw consent at any time. Withdrawal does not make earlier lawful processing unlawful.
Legitimate interests
- We may rely on our legitimate interests where necessary to:
- Operate and secure the website.
- Manage the community.
- Prevent spam, abuse or harmful behaviour.
- Keep proportionate administrative records.
- Respond to enquiries.
- Establish or defend legal claims.
Before relying on legitimate interests, we consider whether our interests are overridden by your rights and reasonable expectations.
Legal obligation
We may process information where necessary to comply with a legal requirement.
Vital interests
In a genuine emergency involving an immediate risk to life or serious harm, information may be used or shared where necessary to protect somebody’s vital interests.
6. Special-category information
Health information and certain other sensitive information are classed as special-category data.
Where we process special-category information, we will identify both:
- A lawful basis under Article 6 of the UK GDPR; and
- An additional condition under Article 9 of the UK GDPR.
Depending on the circumstances, the relevant condition may include explicit consent, information made manifestly public by the individual, protection of vital interests, or the establishment, exercise or defence of legal claims.
We do not ask applicants to provide a diagnosis, medical history, photographs or treatment details merely to join the community.
Members decide what they wish to share within the group, subject to the Community Guidelines. Sharing something in the community does not give us permission to reuse it outside the community.
7. Who receives or processes information
We may use trusted service providers to operate the website and community. These may include:
- Wix, which hosts the website and its forms.
- WhatsApp and Meta, which provide the messaging platform.
- Email and domain service providers.
- Website-security, analytics or cookie providers that we have enabled.
- Professional advisers where reasonably necessary.
- Law-enforcement bodies, regulators or emergency services where legally required or necessary to address a serious and immediate risk.
These organisations may act as processors or as independent controllers, depending on their role.
We do not sell members’ personal information.
We will not give community information to brands, advertisers, researchers or other organisations for their own purposes without an appropriate lawful basis and clear information to the people affected.
8. International processing
Wix, WhatsApp, Meta and other technology providers may process information outside the United Kingdom.
Where UK data-protection law requires safeguards for international transfers, the relevant service provider may use recognised transfer mechanisms. Please consult the provider’s own privacy information for details of its processing.
9. How long we keep information
Unless a longer period is legally necessary:
- Unsuccessful, incomplete or withdrawn community applications will normally be deleted within [30/60/90] days.
- Details used solely to send a joining invitation will normally be deleted within [30] days after the invitation has been accepted, unless needed for ongoing community administration.
- Basic records showing acceptance of the rules and privacy information may be kept while the person remains a member and for up to [12] months afterwards.
- General enquiries will normally be retained for up to [12] months after the matter is closed.
- Complaints, serious rule breaches, safeguarding concerns and legal disputes may be retained for longer where reasonably necessary.
- Marketing records will be kept until consent is withdrawn or the information is no longer required, with a minimal suppression record retained where necessary to honour an opt-out.
WhatsApp messages may remain on members’ devices or in backups outside our control, even after a person leaves or deletes a message.
10. Security
We take proportionate steps to protect information, including:
- Restricting administrator access.
- Using strong passwords and two-step verification.
- Keeping devices updated and protected.
- Avoiding unnecessary downloads or exports of chats.
- Limiting the information collected.
- Removing former administrators promptly.
- Reviewing group invitations and access links.
- Investigating suspected privacy or security incidents.
No website or messaging platform can be guaranteed completely secure.
11. Your choices and rights
Depending on the circumstances, you may have the right to:
- Ask what personal information we hold about you.
- Request a copy.
- Correct inaccurate information.
- Ask for deletion.
- Restrict certain processing.
- Object to certain processing.
- Withdraw consent.
- Ask for portable information where applicable.
- Complain about how your information has been handled.
Some rights are subject to legal limitations and may not apply in every situation.
To make a request, email shaanwbusiness@gmail.com with the subject line Data Protection Request.
We may need to verify your identity. We will respond within the period required by law.
12. Data-protection complaints
Please contact us first so that we have an opportunity to investigate:
Email: shaanwbusiness@gmail.com
Subject: Data Protection Complaint
We will acknowledge a data-protection complaint within 30 days and respond without undue delay.
13. Children
The WhatsApp community is currently intended for people aged 18 or over.
We do not knowingly accept children into the community. If we learn that a person under 18 has joined or submitted an application, we may remove them and delete their application information, subject to any legal or safeguarding need to retain it.
General website information may still be viewed by younger visitors, but it is not designed to provide individual medical advice.
14. Third-party links
The website links to external organisations and services. Their privacy practices are governed by their own policies. We are not responsible for how independent third parties use information.
15. Changes to this policy
We may update this policy when our services, technology or legal obligations change. The latest version will be published on this page with the revised date.
Material changes affecting community members will be communicated through an appropriate channel.