Privacy Policy

The Autonomy Code is operated by The NoGraGra Practice (the "controller" of your personal data under UK data protection law, including the UK GDPR and the Data Protection Act 2018). Questions about this policy, or about your data, can be sent at any time to dk@dkjonah.com.

This policy is written the way the practice works: plainly, and without pressure. It applies to this website and to the services offered through it, including the Ownership Scan, SABI CORE, and Legacy.

• Contact details: your name and email address when you write to us, use a form, subscribe to the newsletter, or make a speaking enquiry.
• Scan responses: your answers to the Ownership Scan pre-assessment, and the notes and written map produced from your session. This is the most personal information we hold, and it is treated with corresponding care.
• Booking and payment information: the details needed to schedule sessions and take payment. Card details are handled by Stripe; we never see or store your full card number.
• Basic usage data: limited technical information about visits to the site, used only to keep it fast, reliable, and secure.

• To deliver the work: running your Scan, preparing your session, writing your Personal Autonomy Map, and delivering the programmes you have paid for.
• To respond to you: answering messages, enquiries, and speaking requests.
• To send the newsletter: only if you have subscribed, and you can unsubscribe at any time. One calm letter, when it is worth your time.
• To administer the practice: invoicing, scheduling, record keeping, and meeting legal obligations.

A human being reviews every Scan result. No decision about you is made by automated means alone.

We use a small number of trusted service providers to run the practice. Each processes your data only on our instructions and under its own data processing agreement:

• OpenAI: powers the conversational Scan pre-assessment.
• Google: Forms, Sheets, Gmail, and Calendar, used for collecting responses, correspondence, and scheduling.
• Our scheduling provider: handles session bookings.
• Stripe: processes payments.

We do not sell your personal data. To anyone, ever.

Some of the providers above store data outside the United Kingdom. Where that happens, transfers are protected by UK approved safeguards: UK adequacy regulations where they apply, or the UK International Data Transfer Agreement or Addendum alongside the providers' standard contractual clauses.

We keep personal data for around 12 months after your last engagement with the practice, then delete or anonymise it. Records we are legally required to keep, such as invoices and accounting records, are kept for the period the law requires.

Under the UK GDPR you have the right to:

• access a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased, in certain circumstances;
• restrict or object to how your data is used, in certain circumstances;
• receive your data in a portable format;
• withdraw consent at any time, where consent is the basis on which we hold it.

To exercise any of these rights, email dk@dkjonah.com. We respond within one month.

The services on this site are for adults. We do not knowingly collect personal data from anyone under 18.

If you are unhappy with how your data has been handled, please write to us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

If this policy changes, the new version will be posted on this page with a new effective date. This version is effective from July 2026.