Privacy & Data Protection Policy

At Side by Side Cancer Support, your privacy is of the utmost importance. As a Specialist Nurse, I am committed to protecting your personal and health information with the highest level of professional integrity. This policy outlines how Mugnai Oncology Services Ltd collects, uses, and protects your data in accordance with the UK General Data Protection Regulation (GDPR) and the Data Protection Act 2018.

Side by Side Cancer Support is a trading name of Mugnai Oncology Services Ltd, registered in England and Wales, company no. 17103978. Registered office: 32 Gardiner Square, NE11 0XS. ICO registration: ZC129300. Data protection contact: Rachel Mugnai, Director, hello@sidebysidecancersupport.co.uk.

To provide you with specialist nursing support, I process data under the following legal bases:

• Contract: To fulfill the services you have requested and purchased.
• Health and Social Care (Article 9(2)(h)): This allows me to process "Special Category Data" (health records) as part of providing healthcare consultancy and management.

• Personal Information: Name, address, date of birth, and contact details.
• Clinical Information: Medical history, diagnosis, treatment plans, medication details, and clinical session notes.
• Technical Information: Cookies and usage data via our website to improve your user experience.
• Free guide sign-ups (Start Here guide, Cancer Anxiety Toolkit): Name and email, to send the guide and follow-up emails. Because signing up may show you've been affected by cancer, we ask for your explicit consent (UK GDPR Article 9(2)(a)).
• Free event bookings (for example, the Hexham morning for women after cancer treatment, or the Sunderland family and friends circle): we collect your name and email address to manage your booking. Because booking one of these events may show that you, or someone close to you, has been affected by cancer, we ask for your explicit consent (UK GDPR Article 9(2)(a)). We only send you other news if you tick the box to receive it.
• Free chat and session bookings via Google Calendar.
• Client onboarding form: before your first paid session, we ask you to complete a short form about you, your situation and what you would like support with. We use this to provide your care.

• Halaxy (clinical records): All health-related notes are stored in Halaxy, a secure practice management system that uses high-level encryption.
• MailerLite (emails, guide sign-ups and event bookings): If you opt in, your name and email are stored here. We don’t store details of your diagnosis, treatment or sessions in MailerLite. Signing up to a guide or event may show a connection to cancer, so we ask for your explicit consent.
• Google Workspace and Google Calendar (email, documents and bookings): Professional correspondence is managed via a secure business account with two-factor authentication (2FA).
• Netlify (website hosting).
• Meta (Facebook/Instagram advertising), only if you accept marketing cookies.
• Tally: our client onboarding form is provided by Tally. Your answers are transferred to Halaxy and then deleted from Tally.
• WhatsApp Business: used for short messages between sessions, for seven days after each session. WhatsApp messages are end-to-end encrypted. Anything important for your care is added to your record in Halaxy.
• Google Meet: sessions by video take place on Google Meet. With your agreement, I may use Google Meet’s transcription to help me write accurate session notes. Transcription is optional, you can say no or ask me to stop it at any time, and it makes no difference to your support. Sessions are never video or audio recorded. Transcripts are stored in my secure Google Workspace business account, used only to write your notes in Halaxy, and then permanently deleted. Google does not use this information to train its AI.

Everything you share with me is confidential. I will only contact your GP or hospital team with your permission, and I will usually talk this through with you first. The only exceptions are if I believe there is a serious risk of harm to you or someone else, if I am required to by law, or in an emergency.

In line with UK medical record-keeping standards and nursing professional guidelines, clinical records are typically retained for 8 years following the conclusion of our service. After this period, records are securely destroyed.

• Event bookings: Deleted 12 months after the event, unless you've asked to hear about future sessions.
• Guide sign-ups and newsletter: Until you unsubscribe.
• Free chat and session bookings: deleted after 12 months if you don't go on to become a client.
• Onboarding form answers in Tally: deleted once they have been transferred to Halaxy.
• WhatsApp messages: deleted after 6 months. Anything relevant to your care is kept in your Halaxy record.
• Session transcripts: permanently deleted within 7 days of your session, once your notes are written.

You have the right to:

• Request a copy of the data I hold about you.
• Ask for inaccuracies to be corrected.
• Request that your data be deleted (subject to legal/medical retention requirements).
• Restrict the processing of your data.
• Receive a copy of your data in a portable format (data portability).
• Object to the processing of your data.
• Withdraw consent for marketing at any time.

Some providers may process data outside the UK. Where they do, we rely on appropriate safeguards such as UK adequacy regulations or the UK International Data Transfer Agreement to keep your information safe.

If you have concerns about your data, please contact me at the email address above. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at www.ico.org.uk.