Privacy Policy

Last updated: [date]

1. Scope

This Privacy Policy describes how personal data are processed through the website naturalhealthfellowship.com, operated by Assist – Natural Health Fellowship.

Natural Health Fellowship, also referred to as NHF, is the health, energy and embodied knowledge initiative of Assist – Natural Health Fellowship. References in this Policy to “NHF”, “Assist”, “we” or “us” refer to the same data controller.

The website is published in English and may include an automatic translation service. In the event of any inconsistency, the English version prevails.

This Policy applies to the public website and, when the relevant functions are enabled, to user accounts, restricted materials, contact and access requests, applications, courses, guided experiences, individual guidance, contributions, donations, purchases and digital downloads provided through the website.

External websites, retailers and services linked from NHF operate under their own privacy policies.

The principal data-protection framework applied by Assist is Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), as directly applicable in Italy, together with the Italian Personal Data Protection Code, Legislative Decree No. 196/2003 as subsequently amended. Any other mandatory data-protection law applicable in a particular case remains unaffected.

2. Data controller

The data controller is:

Assist – Natural Health Fellowship
Private Non-Profit Charitable Purpose Trust
Italian tax code: 90028590066
Trustee: Silvia Isaksen
Institutional and immaterial seat: This email address is being protected from spambots. You need JavaScript enabled to view it.

Assist has not appointed a Data Protection Officer.

3. Categories of personal data processed

Depending on how the website and its services are used, Assist may process:

  • identification data, such as name and surname;

  • contact data, such as email address, telephone number and postal address;

  • account data, such as username, access status and account activity;

  • the subject and content of enquiries;

  • information submitted with access, participation or collaboration requests;

  • information relating to courses, workshops, retreats, guided experiences or individual guidance;

  • health-related or other sensitive information submitted through a form specifically intended for that purpose;

  • order, delivery, payment-reference and transaction data;

  • information relating to donations or voluntary contributions;

  • preferences relating to communications or newsletters;

  • technical, usage and security data generated through access to the website;

  • any other information voluntarily provided by the user.

Public contact forms do not request special categories of personal data. Users are asked not to include health information, intimate details or other unnecessary sensitive information in general messages.

4. General enquiries and contact forms

Contact forms may collect the user’s name, email address, selected subject and message.

The data are processed to receive, assess, manage and, where appropriate, respond to enquiries concerning NHF, its activities, publications, access, collaborations and institutional matters.

Depending on the nature of the communication, the legal basis is:

  • the legitimate interest of Assist in managing communications and protecting its activities and rights, pursuant to Article 6(1)(f) GDPR;

  • taking steps at the request of the user before entering into an agreement, pursuant to Article 6(1)(b) GDPR;

  • compliance with a legal obligation, where applicable, pursuant to Article 6(1)(c) GDPR.

Submission of a form does not create a contractual relationship or an obligation for Assist to accept a proposal, grant access or provide a response.

General enquiries are normally deleted within twelve months, unless longer retention is reasonably necessary because of an ongoing relationship, collaboration, legal matter, security issue or evidentiary requirement.

5. Accounts and restricted access

Where account registration or restricted access is available, Assist may process:

  • name and email address;

  • username and encrypted password;

  • date of registration and last access;

  • requested and assigned access levels;

  • account status;

  • participation and access history;

  • communications concerning registration or access;

  • information provided to support an access request.

These data are processed to:

  • create and administer the account;

  • assess requests for restricted materials;

  • assign and revoke access;

  • protect confidential or context-dependent materials;

  • maintain the security and integrity of the website;

  • document acceptance of applicable access conditions.

The legal basis is the performance of an agreement or steps taken at the user’s request pursuant to Article 6(1)(b) GDPR, together with the legitimate interest of Assist in controlling and protecting access to its materials pursuant to Article 6(1)(f) GDPR.

Registration does not create an automatic right to restricted materials. Assist may approve, limit, suspend or refuse access according to the nature of the material, the purpose of the request and the user’s participation.

Applications that do not result in approved access are normally deleted within twelve months. Active account data are retained for as long as the account remains in use. Inactive accounts may be reviewed and deleted after twenty-four months of inactivity, subject to prior notice where reasonably possible.

Records necessary to document access, confidentiality obligations, misuse or the protection of rights may be retained for longer.

6. Courses, programmes, workshops and retreats

When a person requests or participates in a course, programme, practical workshop, retreat or other structured experience, Assist may process:

  • identity and contact details;

  • application and participation information;

  • organisational preferences and availability;

  • payment and attendance records;

  • emergency contact information, where appropriate;

  • communications and observations necessary to organise the activity;

  • information required to evaluate whether the activity is suitable for the participant.

The legal basis is taking steps at the participant’s request and performing the resulting agreement pursuant to Article 6(1)(b) GDPR, compliance with applicable legal obligations pursuant to Article 6(1)(c) GDPR and, where relevant, the legitimate interest of Assist in organising and documenting its activities pursuant to Article 6(1)(f) GDPR.

Participation records are normally retained for up to five years after the conclusion of the activity, unless a shorter period is sufficient or longer retention is required for accounting, legal, insurance, safeguarding or evidentiary purposes.

7. Health-related and other special-category data

Some activities, including fasting experiences, individual guidance or other carefully structured physical practices, may require the participant to provide information concerning health, medication, previous experiences, physical condition or other matters relevant to evaluating participation.

Such information will be requested only through a form or procedure specifically intended for that purpose. It must not be submitted through the General Enquiry Form.

Where health-related information is processed:

  • the ordinary legal basis is taking steps at the participant’s request or performing the agreed activity pursuant to Article 6(1)(b) GDPR;

  • the additional condition required for special-category data is the participant’s explicit consent pursuant to Article 9(2)(a) GDPR.

Consent will be requested separately, through a clear affirmative action. It will not be inferred from silence or from submission of a general form.

Consent may be withdrawn at any time. Withdrawal does not affect processing already lawfully carried out, but it may make it impossible to assess or continue participation where the information is necessary for safety or suitability.

Health-related information is not used for advertising, profiling or unrelated purposes and is not disclosed publicly.

It is retained only for as long as reasonably necessary for the relevant assessment, experience or continuing relationship. Unless circumstances require otherwise, such records will be reviewed after the activity and deleted or anonymised no later than five years after the last relevant participation.

The website and its forms are not emergency communication channels. Users should not submit urgent medical information through the website.

8. First-hand accounts, contributions and collaborative projects

A person may voluntarily submit an experience, observation, research contribution, translation, image, recording or other material for possible use within NHF.

Assist may process the contributor’s:

  • identity and contact details;

  • professional or biographical information;

  • submitted material and related communications;

  • authorship and source information;

  • permissions, licences and publication preferences;

  • decision whether the contribution is attributed, anonymised or kept private.

Submission does not guarantee publication or acceptance.

The legal basis is taking steps at the contributor’s request or performing an agreed collaboration pursuant to Article 6(1)(b) GDPR, consent where publication or attribution requires it pursuant to Article 6(1)(a) GDPR and the legitimate interest of Assist in maintaining accurate editorial and rights records pursuant to Article 6(1)(f) GDPR.

Where a contribution contains health information or other special-category data relating to an identifiable person, separate explicit consent and additional safeguards may be required before it can be used or published.

Editorial, authorship, permission and rights records may be retained for as long as the relevant material remains in use and for a reasonable period afterwards.

9. Shop, orders and direct sales

Where direct purchasing is enabled, Assist may process:

  • name and contact details;

  • billing and delivery address;

  • products ordered;

  • price, currency and tax information;

  • payment status and transaction reference;

  • delivery or download information;

  • communications concerning the order;

  • information required for invoices, receipts, refunds or customer support.

The data are processed to:

  • manage the cart and checkout;

  • accept and fulfil orders;

  • provide physical products or digital content;

  • issue invoices or other required records;

  • manage delivery, downloads, refunds and complaints;

  • prevent fraud, misuse and unauthorised access to digital files;

  • comply with accounting, tax and consumer-protection obligations.

The legal bases are performance of the purchase agreement pursuant to Article 6(1)(b) GDPR, compliance with legal obligations pursuant to Article 6(1)(c) GDPR and the legitimate interest of Assist in preventing fraud and protecting its rights pursuant to Article 6(1)(f) GDPR.

Accounting, invoice and transaction records are normally retained for ten years or for any longer period required by applicable law. Order-support communications are normally retained for the time necessary to complete the order and manage any subsequent legal or contractual issue.

10. Payments

Online payments may be processed by external payment providers such as PayPal or another provider identified at checkout.

Payment providers process payment credentials under their own terms and privacy policies. Assist does not normally receive or store complete payment-card details or account credentials.

Assist may receive information necessary to confirm and document the transaction, including the payer’s name, email address, billing or delivery information, payment status, amount, currency and transaction identifier.

The payment method actually used and the relevant provider’s privacy information will be shown before or during checkout.

11. Digital downloads

For e-books, patterns and other digital products, Assist or its technical provider may record:

  • the purchased file;

  • the account or email associated with the purchase;

  • the creation and use of secure download links;

  • download dates, number of attempts and associated technical data;

  • expiry, access restrictions and security events.

These data are processed to deliver the purchased content, prevent unauthorised redistribution, provide support and protect the rights of Assist and its authors.

The legal bases are performance of the purchase agreement pursuant to Article 6(1)(b) GDPR and the legitimate interest of Assist in securing digital products and preventing abuse pursuant to Article 6(1)(f) GDPR.

Download and access logs are retained only for the period reasonably necessary to provide the purchase, address technical problems and protect against misuse.

12. Donations and voluntary contributions

Where the website allows a donation or voluntary contribution, Assist may process the donor’s:

  • name and contact details;

  • amount and date of the contribution;

  • payment status and transaction reference;

  • message or stated purpose;

  • information required for accounting or acknowledgement.

The data are processed to receive and document the contribution, communicate with the donor, comply with legal and accounting obligations and prevent abuse.

The legal bases are performance of the donor’s request pursuant to Article 6(1)(b) GDPR, compliance with legal obligations pursuant to Article 6(1)(c) GDPR and the legitimate interest of Assist in maintaining accurate financial and institutional records pursuant to Article 6(1)(f) GDPR.

A donation does not determine access, participation or editorial influence.

13. Newsletter and requested communications

If a newsletter or similar update service is offered, the user’s name, email address, subscription status and related technical records may be processed to send the communications requested.

The legal basis is consent pursuant to Article 6(1)(a) GDPR.

Consent may be withdrawn at any time through the unsubscribe function or by contacting Assist. Withdrawal does not affect the lawfulness of communications sent before withdrawal.

Subscription data are retained until consent is withdrawn. Limited information may subsequently be retained in a suppression list to ensure that the person is not contacted again against their expressed preference.

Transactional, security or service communications relating to an account, purchase, programme or request are not promotional newsletters and may be sent where necessary to provide the service.

14. Affiliate links and external retailers

Some pages contain affiliate links to books, materials or products available from external retailers.

When a user follows an affiliate link, the external retailer or affiliate network may process technical data and use cookies or similar identifiers under its own privacy policy. The link may contain a referral code enabling the retailer to attribute a qualifying purchase to NHF.

Assist does not control the retailer’s website, checkout or independent processing activities. Unless expressly stated otherwise, Assist does not receive the retailer’s complete customer or payment data and may receive only commission reports or limited transaction information.

Use of an external retailer is voluntary. Further information should be obtained from the privacy and cookie policies of the retailer concerned.

15. Technical and security data

The hosting system, Joomla, security extensions and other website software may automatically process technical data necessary for operation and security, including:

  • IP address;

  • browser, operating-system and device information;

  • date and time of access;

  • requested resources and referring pages;

  • session and account events;

  • error, access and security logs;

  • information associated with suspected abuse or malicious activity.

These data are processed to provide the website, maintain sessions, prevent abuse, identify technical problems, protect accounts and secure the website and its infrastructure.

The legal basis is the legitimate interest of Assist in maintaining a secure and functioning website pursuant to Article 6(1)(f) GDPR.

Technical logs are retained according to their purpose, security relevance and the settings of the hosting and website systems. They may be retained for longer where necessary to investigate an incident or protect legal rights.

16. Cookies and similar technologies

The website may use technical cookies required for operation, security, account access, session management, forms, cart and checkout functionality.

Assist does not intend to use advertising, behavioural-profiling or cross-site tracking cookies for its own purposes.

Optional third-party functionality will be activated subject to the information and consent controls required by applicable law. Refusing optional cookies will not prevent access to the public contents of NHF, although some external or optional functions may be unavailable.

Further information is provided in the Cookie Policy.

17. Google Translate

The website may provide access to Google Translate as an optional automatic translation service.

When the user activates this service, technical data and information relating to the page being translated may be processed by Google in accordance with its own terms and privacy policies.

Assist does not control the processing carried out independently by Google. Use of the translation service is optional, and the original English content remains the authoritative version.

Users should avoid activating automatic translation while viewing or entering confidential or sensitive information.

18. Recipients of personal data

Personal data may be accessed or processed, where necessary, by:

  • the Trustee and persons specifically authorised by Assist;

  • hosting, email, website-maintenance, security and technical-service providers;

  • e-commerce, order-management and digital-delivery providers;

  • payment, accounting, invoicing, delivery and shipping providers;

  • persons involved in organising an activity, where necessary and appropriately authorised;

  • professional advisers, insurers or consultants where required;

  • public authorities, tax authorities or judicial bodies where disclosure is required by law or necessary for the protection of rights.

Each recipient receives only the data reasonably necessary for its role.

Personal data are not sold or made available to third parties for their independent commercial marketing.

19. Hosting and technical infrastructure

The website and its database are hosted on infrastructure located in Italy.

Form submissions, account information, access records, orders and related data may be stored within Joomla and the components used to provide the relevant functions. Information may also be transmitted to the appropriate Assist contact address by email.

The names and functions of material technical, payment or e-commerce providers will be added to this Policy or made available at the relevant point before the corresponding service is activated.

Service providers process personal data only to the extent necessary to perform their functions and in accordance with applicable contractual and legal obligations.

20. International access and data transfers

The website is hosted on infrastructure located in Italy. Personal data submitted directly through the website are intended to be stored and processed primarily within the European Economic Area.

The website may be accessed, and services may be requested or purchased, from other countries. Access to the website by a person located outside the European Economic Area does not, by itself, constitute a transfer of personal data by Assist to a third country.

Optional third-party services, payment providers, affiliate retailers, translation services and technical providers may involve processing or transfers outside the European Economic Area.

Where Assist transfers personal data to a recipient outside the European Economic Area, the transfer will be carried out in accordance with applicable data-protection law and, where required, on the basis of an adequacy decision, appropriate contractual safeguards or another legally recognised transfer mechanism.

Nothing in this Privacy Policy limits mandatory rights granted to a data subject under the law applicable to that person.

21. Data retention

Personal data are retained only for as long as necessary for the purposes for which they were collected.

The principal retention periods or criteria are described in the relevant sections of this Policy. Data may be retained for longer where necessary to:

  • comply with a legal, accounting or tax obligation;

  • establish, exercise or defend legal rights;

  • preserve authorship, licence or institutional records;

  • investigate fraud, abuse or a security incident;

  • respond to an authority;

  • enforce confidentiality or access conditions.

When continued identification is no longer necessary, data will be deleted or anonymised where reasonably possible.

22. No automated decision-making

Assist does not intend to make decisions producing legal or similarly significant effects solely through automated processing.

Access, participation and editorial decisions are made or reviewed by a person. Technical systems may automatically apply ordinary security, account, payment or download rules without evaluating the user’s health, beliefs or personal characteristics.

23. Rights of data subjects

Subject to the conditions established by applicable law, a data subject may request:

  • access to personal data;

  • rectification of inaccurate or incomplete data;

  • erasure of personal data;

  • restriction of processing;

  • data portability, where applicable;

  • objection to processing based on legitimate interests.

Where processing is based on consent, the data subject may withdraw that consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

A request may be submitted using the contact details provided below. Assist may request information reasonably necessary to verify the identity of the applicant.

24. Complaints

A data subject may lodge a complaint with the competent data-protection supervisory authority.

Persons located in Italy may contact the Garante per la protezione dei dati personali. Persons located in another jurisdiction may also have the right to contact the supervisory or regulatory authority competent under the law applicable to them.

25. Security

Assist adopts reasonable technical and organisational measures appropriate to the nature of the website, the activities performed and the personal data processed.

Access to health-related information, restricted materials, account data and transaction records will be limited according to necessity and role.

However, no internet transmission or electronic storage system can be guaranteed to be completely secure. Users are responsible for keeping their account credentials confidential and for promptly reporting suspected unauthorised access.

26. Changes to this Privacy Policy

This Privacy Policy may be updated to reflect changes in the website, its activities, technical providers, applicable law or processing practices.

The date of the latest revision will be shown at the beginning of the document. Where a change materially affects registered users or an existing service, additional notice may be provided where appropriate.

27. Contact

Questions concerning this Privacy Policy or requests concerning personal data may be submitted through the NHF contact form or sent by PEC to:

This email address is being protected from spambots. You need JavaScript enabled to view it.