Privacy Policy
Genevieve Gray — Muscles & Mind Limited
Last Updated: 27 July 2026
Who I am
I am Genevieve Gray, an RTT® Practitioner and Nervous System Educator, trading as Muscles & Mind Limited, a New Zealand company. When this policy says "I" or "me", it means Muscles & Mind Limited. When it says "you", it means anyone who contacts me, books with me, downloads a guide, subscribes to my emails, or works with me as a client.
I take privacy seriously, and not only because the law requires it. People tell me things in this work that they have not told anyone else. This page sets out exactly what I collect, why I have it, who else can see it, and what you can ask me to do with it.
I handle personal information in line with the Privacy Act 2020 and, because much of what I hold is health information, the Health Information Privacy Code 2020.
The information I collect
When you enquire or book a consult. Your name, email address, phone number, and whatever you choose to tell me about what has been happening for you. Consults are booked through TidyCal, which collects your name, email and appointment time.
When you download a guide or join my email list. Your name and email address, and a record of which emails you have been sent, opened, or clicked. If you reached me by commenting on an Instagram post, that comment-to-message process is handled by ManyChat and Instagram under their own privacy terms.
When you enrol. A full intake and screening form, completed through Jotform. This includes your contact details, address, emergency contact, your GP's details, what you want to work on, your medical and mental health history, current medications, and answers to specific safety and suitability questions. Most of this is health information, and I treat all of it that way. Answering these questions is not optional. I cannot safely take you on without them, so if you would prefer not to answer, tell me and we will stop there rather than proceed on incomplete information.
During your package. My own notes from our sessions, your assessment scores from the start and end of the package, and the personalised transformation recording I make for you after your RTT session.
When you pay. Payments by card are processed by Stripe, and payments by bank transfer arrive through my bank. I can see that a payment was made and for how much. I never see or hold your full card number.
When you visit my website. My site runs on Squarespace and uses Squarespace's own analytics and Google Analytics. These use cookies to record things like which pages were visited, how long for, roughly where in the world the visitor was, and what brought them to the site. It tells me which of my writing is useful. It does not tell me who you are, and I do not try to connect it to you.
Why I collect it
To decide honestly whether I can help you, and to say so when I cannot. To work safely, which means knowing about medical conditions, medications and risk factors before we begin rather than discovering them halfway through. To deliver the package, including making your recording and measuring your assessment scores against your own starting point. To take payment. To send you the emails you asked for. And to keep the records a practitioner is expected to keep.
I do not sell your information, and I never will. I do not share it for advertising.
Health information, and why I ask such direct questions
The screening questions on the intake form are deliberately blunt. I ask about psychosis, suicidal thoughts, recent psychiatric hospitalisation and epilepsy because the answers change whether this work is appropriate and whether it is safe. Answering honestly is in your interest, and a yes to any of them does not automatically mean no. It means we talk about it properly before anything begins.
I also ask for your GP's details, and I ask you to have medical checks done before we start. Anxiety symptoms can have physical causes, and those belong to medicine. I will not do pattern work in place of a diagnosis.
Your transformation recording
Your RTT session itself is not recorded. After the session, I write and record a personalised transformation recording for you, built from what came up in your session and worded for you specifically. It is yours, it is stored securely, it is not shared with anyone, and it is never used for training, marketing, teaching or examples.
How I use AI, and what it does not do
I use an AI assistant called Claude, made by a company called Anthropic, in parts of my practice. I would rather tell you plainly how I use it than leave you to wonder, because you are trusting me with your information.
I use it to help draft and edit my written material, including my guides, emails and programme content. I use it to help me prepare, which can mean working with the notes and intake information you have given me so that I arrive at your session having thought properly about your situation. I use it to help me look at your assessment results alongside what you have told me. And I use it to help draft the wording of your transformation recording, which I then rewrite, approve and record myself.
Here is what it does not do. It is not used during your sessions, and it does not decide anything about your care. Where I use it to help me look at your assessment results, it is a second pair of eyes on information I have already read myself. The clinical judgement, what your results mean, whether I take you on, and what I recommend, is mine. Every word that reaches you has been read, edited and approved by me. The responsibility for your care is mine and stays mine, and no part of it is handed to software.
On training, which is the question people actually want answered: I have turned off the setting that would allow this material to be used to train AI models. Nothing from your file is contributing to a model that anyone else can draw on.
I also keep what I share to the minimum the task needs. Consent to this use is part of acknowledging you have read and understood this privacy policy in your enrolment form, and if you would prefer that I do not use AI assistance in preparing your material, say so and I will work without it. It changes nothing about the care you receive.
Who else handles your information
I run a small practice on established software rather than building my own, which means a handful of providers process information on my behalf:
Jotform, for the intake and screening form and the signed agreement
Anthropic, whose AI assistant Claude I use as described below
Mailchimp, for guides, email sequences and my weekly letters
Stripe, for card payments
TidyCal, for consult bookings
Zoom, for sessions, which are delivered online
Google Workspace, for email, documents and secure file storage
These providers act on my behalf under their terms of service, and I remain responsible for your information throughout. Several store it on servers outside New Zealand, including in the United States, where the law may not require protection comparable to New Zealand privacy law. By enrolling, you authorise that. If it concerns you, tell me before you enrol and we will talk about what can be handled differently.
When I would share your information
Rarely, and in narrow circumstances:
With your consent. For example, if you asked me to write to your GP, psychologist or counsellor, or to coordinate with someone else in your care.
Where there is serious risk of harm to you or to someone else. If I believe you are in immediate danger, I may contact your emergency contact, your GP, or emergency services. I will tell you I am doing it wherever it is safe to do so.
Where the law requires it, such as a court order.
Outside those situations, what you tell me stays with me.
How long I keep it
I keep client records, including intake forms, session notes and assessment results, for ten years after our work together ends, which is the retention period for health information in New Zealand. Your transformation recording is yours to keep, and I hold a copy with your record for a short period only. Marketing contacts are kept until you unsubscribe, and I remove unsubscribed contacts from my list periodically rather than holding them indefinitely.
Where the law requires me to keep a health record, I will tell you that rather than delete it.
Security
Intake forms, notes, recordings and assessments are stored in access-controlled systems protected by strong unique passwords and two-factor authentication. I do not store client health information on paper, on unencrypted devices, or in messaging apps. No system is perfect, and if a breach ever occurred that posed a risk of serious harm, I would notify you and the Office of the Privacy Commissioner as the Privacy Act requires.
Your rights
You can ask me what information I hold about you, and I will tell you. You can ask for a copy of it. If something is wrong, you can ask me to correct it, and if I disagree with the correction I will record that you asked. You can withdraw consent for marketing emails at any time, by clicking unsubscribe or by replying and telling me. You can ask me to delete information, and I will unless I am required to keep it as part of a health record.
Email me at info@genevievegray.co.nz and I will respond within 20 working days, which is the timeframe the Privacy Act sets.
Emails from me
I only send emails to people who have asked for them, and every one carries an unsubscribe link and says who it is from, as the Unsolicited Electronic Messages Act 2007 requires. If you download a guide or subscribe, you go onto my email list, and you can leave it at any time using that link. Leaving the list does not affect your care, and it does not affect anything if you are already a client. Client communication about your own package is separate from marketing and continues either way.
If you are in Australia
I work with clients in Australia as well as New Zealand. I am a New Zealand business, your information is held and handled under New Zealand law, and the standards described on this page are the ones that apply to it.
If you are not happy with how I have handled your information
Tell me first, at info@genevievegray.co.nz, and I will do my best to sort it out. If you are not satisfied with my response, you can complain to the Office of the Privacy Commissioner at privacy.org.nz or 0800 803 909.
Changes to this policy
If I change how I handle information, I will update this page and change the date at the top. If a change is significant and affects current clients, I will tell you directly.
Contact
Genevieve Gray
RTT® Practitioner and Nervous System Educator
Muscles & Mind Limited
Email: info@genevievegray.co.nz
Website: genevievegray.co.nz
Business hours: Monday to Friday, 9am to 9pm NZST