Privacy Policy | Mindful Life Community

Effective Date: January 1, 2025 | Last Updated: September 15, 2026

1. Information We Collect

Mindful Life Community collects personal information that you voluntarily provide when enrolling in programs, submitting contact forms, making donations, or otherwise communicating with our organization. The categories of information we may collect include:

Identity Information: Full name, date of birth (for age-appropriate program placement), and preferred pronouns.
Contact Information: Email address, phone number, and mailing address.
Financial Information: Payment card details processed securely through our third-party payment processor (Stripe). Mindful Life Community does not store credit card numbers on our systems. Sliding-scale and scholarship applications may collect general financial situation information.
Health & Wellness Information: Health intake questionnaire responses, including information about physical conditions, mobility limitations, mental health history, medications, and wellness goals. This information is provided voluntarily to help our instructors accommodate individual needs and ensure participant safety.
Program Participation Data: Attendance records, program completion status, outcome assessment questionnaire responses (PSS-10, FFMQ, PHQ-9, GAD-7, PSQI), and feedback survey responses.
Communication Records: Emails, phone call notes, and contact form submissions related to program inquiries, scheduling, or support requests.

2. How We Use Your Information

We use your personal information exclusively for the following purposes:

Processing program enrollment, scheduling, and tuition transactions.
Providing safe, individualized instruction by sharing relevant health information with your assigned instructor(s) on a need-to-know basis.
Tracking participant outcomes using validated psychometric instruments to evaluate and improve program quality. Outcome data is aggregated and de-identified before inclusion in any reports.
Communicating with you regarding program logistics, scheduling changes, enrollment confirmations, and organizational updates.
Processing sliding-scale applications, scholarship requests, and financial assistance inquiries.
Responding to your inquiries and providing requested information.
Meeting legal, regulatory, and tax reporting obligations applicable to 501(c)(3) non-profit organizations.

3. Data Sharing & Third Parties

Mindful Life Community does not sell, rent, trade, or share your personal information with any third parties for marketing purposes. Ever. We may share limited information only in the following circumstances:

Payment Processing: Financial transaction data is processed by Stripe, Inc., which maintains PCI-DSS Level 1 compliance. Mindful Life Community does not have access to full payment card numbers.
Legal Requirements: We may disclose information if required by law, court order, or governmental regulation, or if necessary to protect the safety of participants, staff, or the public.
De-identified Research Data: Aggregated, de-identified participant outcome data may be included in published research, grant reports, or organizational impact assessments. No individual participant can be identified from this data.
Healthcare Provider Coordination: With your explicit written consent, we may share attendance records or program participation summaries with your referring healthcare provider to support integrated care coordination.

4. Health Information Confidentiality

While Mindful Life Community is not a HIPAA-covered entity (we are an educational non-profit, not a healthcare provider or health plan), we voluntarily adopt HIPAA-aligned data handling practices for all health and wellness information collected through our intake questionnaires and outcome assessments. Health information is stored in encrypted digital systems with role-based access controls, shared only with instructors on a need-to-know basis, and never disclosed to third parties without explicit participant consent. Paper intake forms are stored in locked filing cabinets accessible only to authorized administrative staff.

5. Data Security

We implement reasonable administrative, technical, and physical safeguards to protect your personal information against unauthorized access, disclosure, alteration, or destruction. These measures include:

SSL/TLS encryption for all data transmitted through our website.
Encrypted storage for digital records containing personal and health information.
Role-based access controls limiting data access to authorized personnel only.
Regular security assessments and software updates.
Staff training on data privacy and confidentiality procedures.
Locked physical storage for paper records.

While we strive to protect your information using industry-standard measures, no method of electronic transmission or storage is 100% secure. In the unlikely event of a data breach affecting your personal information, we will notify affected individuals and relevant authorities in accordance with North Carolina data breach notification laws (N.C.G.S. 75-65).

6. Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this policy, comply with legal obligations, and support organizational record-keeping requirements. Specific retention periods include:

Program records: 7 years from the date of last program participation.
Financial records: 7 years, as required by IRS regulations for 501(c)(3) organizations.
Health intake information: 3 years from the date of last program participation, then securely destroyed.
Outcome assessment data: Retained indefinitely in de-identified, aggregated form for research and program improvement purposes.
Contact form submissions: 2 years from the date of submission.

7. Your Rights (CCPA / GDPR)

Mindful Life Community respects the data privacy rights of all individuals, regardless of jurisdiction. In accordance with the California Consumer Privacy Act (CCPA), the General Data Protection Regulation (GDPR), and applicable state privacy laws, you have the right to:

Access: Request a copy of the personal information we hold about you.
Correction: Request correction of inaccurate or incomplete personal information.
Deletion: Request deletion of your personal information, subject to legal retention requirements.
Portability: Request your personal information in a structured, commonly used, machine-readable format.
Opt-Out: Opt out of non-essential communications at any time using the unsubscribe link in our emails or by contacting us directly.
Restriction: Request that we limit the processing of your personal information under certain circumstances.

To exercise any of these rights, please contact our Privacy Officer at [email protected] or write to: Privacy Officer, Mindful Life Community, 1284 Harmony Lane, Suite 305, Asheville, NC 28801. We will respond to verified requests within 30 calendar days.

8. Cookies & Website Analytics

Our website uses essential cookies required for basic site functionality (e.g., session management, security). We do not use third-party advertising cookies, social media tracking pixels, or behavioral retargeting technologies. We may use privacy-respecting website analytics (such as Plausible Analytics) to understand aggregate website traffic patterns; this data does not include personally identifiable information and is not shared with any third party. You can manage cookie preferences through your browser settings.

9. Children's Privacy

Mindful Life Community does not knowingly collect personal information from children under the age of 13 without verifiable parental or guardian consent. Programs enrolling minors (ages 13 to 17) require a parent or guardian to complete enrollment forms and provide consent for participation and data collection. If we become aware that we have collected personal information from a child under 13 without proper consent, we will take steps to promptly delete that information.

10. Changes to This Policy

We may update this privacy policy periodically to reflect changes in our practices, technology, or legal requirements. Material changes will be communicated to enrolled participants via email and prominently posted on this page with the revised effective date. We encourage you to review this policy periodically.

Questions or concerns about this privacy policy may be directed to our Privacy Officer at [email protected] or by calling (828) 555-0147.