Privacy Policy

Genevieve Gray — Muscles & Mind Limited

Last Updated: 7 April 2026

Who we are

Genevieve Gray is an RTT® Practitioner & Nervous System Educator, trading as Muscles & Mind Limited, based in Hamilton, New Zealand. Services are delivered online to clients across New Zealand and Australia.

Contact:info@genevievegray.co.nz

What information we collect

Information you give us:

  • Contact details (name, email, phone, location)

  • Booking information (session preferences, scheduling details, responses to intake questions)

  • Health and wellbeing information relevant to nervous system work (symptoms, history, goals, assessment results)

  • RTT® session content (intake questionnaires, session notes, transformation recordings)

  • Payment information (processed securely by Stripe at the time of booking, we do not see or store your card details)

  • Communications with us (emails, messages, consultation notes)

  • Email subscription details if you opt in to our newsletter or download a free guide

Information collected automatically:

  • Website usage data (IP address, browser type, pages visited, time on site)

  • Cookies for basic website functionality and analytics

  • Ad performance data through Google Ads (if you arrived via a paid ad)

How we use your information

We use your information to:

  • Provide RTT® sessions, the EMBODY programme, and discovery calls

  • Create personalised nervous system regulation protocols

  • Produce your RTT® transformation recording

  • Schedule sessions and send reminders

  • Respond to your questions

  • Improve our services

  • Send you newsletters and educational content if you've opted in (you can unsubscribe anytime)

  • Measure ad performance and improve our marketing

  • Meet legal obligations (tax, accounting)

If you book a free discovery call but don't proceed to become a client, your discovery call information is deleted within 90 days unless you request otherwise.

We do not:

  • Sell your information to anyone

  • Share your health information without your consent (except as legally required)

  • Use your data for anything beyond providing our services and running this business

Use of AI tools

We use artificial intelligence tools to support service delivery and administration.

How we use AI:

  • Session note-taking and transcription

  • Administrative tasks (scheduling, drafting reminders)

  • Supporting creation of RTT® transformation recordings

  • Drafting marketing and educational content (which Genevieve reviews and edits before publishing)

Your data and AI:

  • We do not input identifiable health information into general AI systems like ChatGPT

  • Any AI tools used for health-related content have appropriate privacy safeguards

  • All AI-generated content is reviewed and edited by Genevieve before use

  • Non-AI alternatives are available on request

  • Gen retains professional responsibility for all work, regardless of AI assistance

Third-party AI providers we may use:

  • Are contractually required to protect your data

  • Cannot use your information for training their models

  • Must comply with privacy standards equivalent to New Zealand law

If you have concerns about AI use in your sessions or programme, please raise this before enrolment.

How we protect your information

Digital security:

  • Password-protected cloud storage (Google Workspace)

  • Encrypted email and file storage

  • Two-factor authentication on all key accounts

  • Secure video conferencing (Zoom with passwords and waiting rooms)

  • Regular backups and security updates

Physical security:

  • Any printed materials in locked storage

  • Private, secure home office

Access:

  • Only Genevieve Gray has access to client files

  • All devices are password-protected and encrypted

How long we keep information

  • EMBODY clients: Core records kept for 7 years (professional and legal requirements). Detailed session notes deleted after 2 years.

  • Standalone RTT® clients: Core records kept for 2 years after your last session. Detailed session notes deleted after 12 months. Financial records kept for 7 years (tax compliance).

  • Discovery call only: Deleted within 90 days if you don't proceed.

  • Email subscribers: Held while you remain subscribed and for 12 months after you unsubscribe, then deleted.

  • Financial records: 7 years (tax compliance).

  • RTT® transformation recordings: Your recording is created for you. We may retain a copy for our records but don't guarantee this. Treat your recording as your responsibility to save.

If you request deletion, we'll delete your information within 30 days, except for what we're legally required to keep.

When we share information

Service providers who help us run the business:

  • Squarespace (website hosting and analytics)

  • TidyCal (online booking and scheduling)

  • Zoom (video sessions)

  • Google Workspace (email, storage, calendar)

  • Google Forms (assessment delivery)

  • Stripe (payment processing)

  • Jotform (programme agreements and digital signatures)

  • Mailchimp (email newsletters and automated email sequences if you've opted in)

  • Google Ads (advertising and conversion tracking)

  • Canva (content design)

These providers can only use your information for the purposes we've contracted them for, and must protect it under their own privacy obligations.

Legal requirements:

  • Court orders or legal processes

  • Tax or regulatory obligations

  • Reporting child abuse or neglect (legal obligation)

  • Preventing serious harm to you or others

With your consent:

  • Coordinating with other health professionals (only if you agree in writing)

  • Testimonials (always anonymised unless you specifically agree otherwise)

Overseas data storage

Some of our service providers store data outside New Zealand. We only use providers with privacy protections comparable to New Zealand law, typically based in:

  • Australia

  • United States

  • European Union (GDPR compliant)

Your rights

You can:

  • Access your information (we'll provide it within 20 working days)

  • Correct inaccurate information

  • Delete your information (with some legal exceptions)

  • Object to marketing communications or specific uses

  • Complain to us or to the Privacy Commissioner

To exercise these rights: Email info@genevievegray.co.nz with "Privacy Request" in the subject line.

We'll respond within 20 working days, free of charge.

Privacy breaches

If a breach occurs that might cause you serious harm, we will:

  • Notify you within 72 hours

  • Notify the Privacy Commissioner if required

  • Explain what happened and what we're doing about it

  • Help you protect yourself

Cookies and tracking

We use essential cookies for website functionality and analytics (Google Analytics) to understand how people use our site. We also use Google Ads conversion tracking to measure how well our advertising is working.

You can control cookies through your browser settings or opt out of Google Analytics here: https://tools.google.com/dlpage/gaoptout

Children's privacy

Our services are for adults 18 and over. We don't knowingly collect information from minors.

Changes to this policy

We'll update this policy occasionally. When we make significant changes, we'll:

  • Update the date at the top

  • Email active clients

  • Post notice on our website

Continued use of our services after changes means you accept the updated policy.

Contact

Questions or concerns: Email: info@genevievegray.co.nz

Privacy Commissioner:www.privacy.org.nz | 0800 803 909 | enquiries@privacy.org.nz

By using our services, you acknowledge you've read and understood this policy.