Privacy Policy
Genevieve Gray - Muscles & Mind Limited
Last updated: 11 October 2026
Your privacy is important to me.
This Privacy Policy explains how I collect, use, store, protect and disclose personal information when you visit my website, enquire about services, complete an intake form or work with me.
My intention is to collect only information reasonably necessary to provide appropriate services and manage my business.
1. Who is responsible for your information?
Genevieve Gray is a New Zealand-based provider of coaching, hypnotherapy, stress and anxiety support, nervous system education and workplace wellbeing services.
I am responsible for managing personal information collected through my business in accordance with applicable New Zealand privacy legislation.
Privacy Officer: Genevieve Gray
Location: Hamilton, New Zealand
You can contact me about privacy matters using the contact details on my website.
2. Privacy legislation
My handling of personal information is governed by the Privacy Act 2020.
Because my services may involve collecting sensitive information about physical health, mental wellbeing and personal circumstances, I also take account of the Health Information Privacy Code 2020 where applicable.
These requirements influence how information is collected, used, disclosed, stored, accessed and corrected.
3. Information I collect
Depending on how you interact with my business, I may collect:
Contact and identification information
Name and preferred name
Email address
Phone number
Date of birth
General location
Emergency contact information
Enquiry and booking information
Reasons for contacting me
Services you are interested in
Appointment dates and booking history
Information provided during an initial consultation
Referral source
Health and wellbeing information
Where relevant to the service, I may collect information about:
Stress, anxiety and other concerns
Physical or mental health conditions
Relevant medication
Previous or current professional support
Personal history and circumstances
Goals and desired changes
Responses to intake questions
Session notes and progress
Some of this information may be sensitive.
You are encouraged to share information relevant to our work, but you do not need to provide unnecessary details.
Payment information
I may collect or access:
Services purchased
Amounts paid
Payment status
Transaction dates
Billing details
Relevant payment-plan information
Payments are processed through Stripe or another agreed payment provider.
I do not ordinarily receive or store your complete payment card details.
Website and communication information
My website and connected services may collect technical information such as:
IP address
Browser and device information
Website activity
Cookies or similar technologies
Email and form interactions
The information collected depends on the services and website features in use.
4. Why I collect information
I collect and use personal information to:
Respond to enquiries
Assess whether my services are suitable
Arrange consultations and appointments
Provide coaching and hypnotherapy services
Understand your goals and relevant circumstances
Prepare sessions and personalised resources
Maintain appropriate client records
Manage consent and payments
Communicate about appointments and services
Meet legal and professional obligations
Improve business administration and service delivery
I do not collect sensitive personal information for unrelated marketing purposes.
5. Is providing information compulsory?
Providing information is generally voluntary.
However, certain details may be necessary to assess suitability, obtain informed consent, arrange appointments or provide services responsibly.
If essential information is not provided, I may be unable to proceed with a particular service.
I will explain where information is required and why.
6. How information is collected
Information may be collected through:
Website contact forms
Booking systems
Initial consultations
Client intake and consent forms
Email and other direct communications
Online or in-person sessions
Payment systems
Information you voluntarily provide
Where appropriate and legally permitted, information may also be received from another person or professional with your knowledge or authorisation.
7. Confidentiality and disclosure
I do not sell client information.
Personal information is treated as confidential and is used primarily for the purposes for which it was collected.
Information may be shared where reasonably necessary with service providers supporting business operations, subject to appropriate safeguards.
I may also disclose information:
With your authorisation
Where required or permitted by law
Where necessary to respond to a serious threat to health or safety and the legal requirements for disclosure are met
Where another lawful basis for disclosure applies
I will limit disclosures to information reasonably necessary for the relevant purpose.
8. Digital service providers
I use third-party technology providers to support business operations.
These may include:
Jotform
Client intake forms, consent forms and information collection.
Stripe
Payment processing, transaction records and payment arrangements.
TidyCal
Appointment scheduling and booking administration.
Google Workspace
Email, documents, files and business administration.
Zoom
Online appointments and meetings.
Squarespace
Website hosting and website-related services.
OpenAI / ChatGPT
AI-assisted drafting, organisation, administrative support and resource preparation.
Other services may be used where necessary for business operations.
These providers have their own privacy and security practices.
Some providers may process or store information outside New Zealand.
9. Use of ChatGPT and artificial intelligence
I use ChatGPT, provided by OpenAI, to assist with selected aspects of my work.
This may include:
Drafting educational materials
Developing general resources
Organising administrative information
Preparing outlines and working documents
Supporting the preparation of session resources
Reviewing or improving written communications
AI-generated material is reviewed by me before being used in my professional work.
AI is not used as a substitute for my professional judgement or as an autonomous decision-maker about client suitability, diagnosis or treatment.
Where practical, I minimise or remove identifying details before using information with AI tools.
However, depending on the task and the information supplied, AI-assisted processing may involve personal or sensitive information.
I will only use such information where there is an appropriate purpose and lawful basis, and with safeguards suitable to its sensitivity.
Information entered into ChatGPT is processed according to the applicable OpenAI service terms, privacy arrangements and account settings.
I do not assume that using an AI service automatically makes information anonymous or guarantees that it remains within New Zealand.
You may ask me about how AI tools are used in connection with your information.
10. Overseas storage and processing
Some technology providers operate internationally.
This means personal information may be stored, accessed or processed outside New Zealand.
Where an overseas disclosure is subject to the Privacy Act 2020 or applicable health privacy requirements, I will take appropriate steps to ensure the relevant legal conditions and safeguards are met.
Where required, I will seek informed authorisation before disclosing information to a recipient that does not provide comparable privacy protections.
I remain responsible for managing my use of these providers in accordance with applicable New Zealand law.
11. How information is protected
I take reasonable steps to protect personal information against unauthorised access, misuse, loss, disclosure or alteration.
Safeguards may include:
Password-protected accounts
Appropriate access controls
Secure digital services
Multi-factor authentication where available
Limiting access to information
Avoiding unnecessary collection or duplication
Reviewing information-sharing practices
Secure disposal when information is no longer required
No internet-based service can guarantee absolute security.
If a privacy breach occurs, I will assess it and take appropriate action, including notification where required by law.
12. How long information is kept
I retain personal information only for as long as there is a lawful and reasonable purpose for doing so, including any applicable record-retention requirements.
Where health-record retention requirements apply, relevant records may need to be retained for at least 10 years from the last provision of services, subject to applicable exceptions.
Other information, such as enquiries, booking details and administrative records, may be retained for different periods according to its purpose and legal requirements.
When information is no longer required, I will take reasonable steps to securely delete, destroy or de-identify it.
13. Accessing or correcting your information
You may request access to personal information I hold about you.
You may also request correction of information you believe is inaccurate or incomplete.
Please contact me using the details on my website.
I will respond in accordance with the Privacy Act 2020 and any applicable health information privacy requirements.
In some circumstances, access may be limited or refused where permitted by law. I will explain the relevant reason where required.
14. Marketing communications
If you subscribe to updates or otherwise agree to receive marketing communications, I may contact you about relevant services, resources or business news.
You may unsubscribe from marketing communications at any time.
Information collected through a confidential client consultation or intake process will not automatically be used to subscribe you to marketing communications.
Service-related communications, such as appointment reminders and payment confirmations, are separate from marketing.
15. Cookies and website analytics
My website may use cookies and similar technologies to support website functionality, understand visitor activity and measure the effectiveness of marketing.
Some cookies may be placed by third-party services connected to the website.
You can manage cookies through your browser settings and any consent controls provided on the website.
The precise cookies and analytics technologies used may change as website features are updated.
16. Information about other people
If you provide information about another person, such as an emergency contact, please provide only information reasonably necessary for the relevant purpose.
I will handle that information in accordance with applicable privacy requirements.
17. Privacy concerns or complaints
If you have a question or concern about how your information has been handled, please contact me first.
I will take your concern seriously and work towards a fair resolution.
If you remain dissatisfied, you may contact the New Zealand Office of the Privacy Commissioner.
18. Changes to this policy
I may update this Privacy Policy to reflect changes in services, technology, business practices or legal requirements.
The latest version will be available on my website.
Where a material change affects how existing client information is handled, I will take any additional steps required by law.
19. Contact
Genevieve Gray
Hamilton, New Zealand
Online services across New Zealand and Australia
For privacy enquiries, access requests or correction requests, please contact me through the contact details on my website.