The Mullins Method app privacy policy
Your wellbeing information is personal. This policy explains what The Mullins Method uses, why we use it, who helps us provide the app and how you can control or delete your information.
It covers the app and app-support enquiries. It does not replace separate privacy information for therapy services or other uses of the Mullins Therapy website.
Effective date: 1 October 2026
Version: 1.0
Who is responsible for your information?
The app is provided by Kevin Mullin trading as Mullins Therapy, the controller responsible for the personal information described here.
Email: support@mullinstherapy.com
Address: 238 Baltic Chambers, 50 Wellington Street, Glasgow, G2 6HJ.
The Mullins Method is for adults aged 18 and over. It is a wellbeing and self-help tool, not a diagnostic service, emergency service or replacement for qualified care.
What information do we use?
Account information. We use your email address, account identifier, sign-in method and verification status to create, protect and recover your account. If you choose Google sign-in, Google supplies the account details needed to sign you in. Our authentication provider also processes technical information, including IP addresses, device/browser information and sign-in activity, for authentication and abuse prevention.
Wellbeing information you choose to record. This can include journal titles and entries, guided reflections, check-in scores, moods, emotions, intensity ratings, optional notes, exercise responses and technique outcomes. The app uses your activity to show reflections, progress and achievements, with associated dates and times. These records are linked to your account and may reveal information about your mental or physical health. Please avoid including names or identifying details about other people in your entries.
Preferences on your device. Your chosen first name, support areas, main goal and onboarding progress are stored on your device for personalisation, rather than synchronised to your cloud wellbeing records. Support areas and goals may themselves reveal health information. Reminder settings, playback positions and information needed to finish a pending privacy request are also stored locally.
Privacy choices. We record your adult confirmation, consent choices, the wording and policy version you agreed to, and the date and time of those choices. We also keep the information needed to process a withdrawal or deletion request safely.
Support messages. If you contact us, we receive your email address, message and any information you choose to provide. Please avoid sending passwords, verification codes, journal entries, detailed health information or other people's personal information. We will explain if we need a particular additional detail to help you.
Technical information. Services that run and protect the app may process connection details, request times, error information and security records. Podcast and media hosts receive connection information when your device requests their content. Public podcast content may be cached on your device.
Why do we use it?
We use information to provide the features you request, keep your account secure, respond to you and respect your privacy choices.
| Purpose | Our lawful basis under the UK GDPR |
|---|---|
| Provide your account, sign-in, recovery and requested app features, including saved wellbeing records and device preferences | Article 6(1)(b): processing necessary to provide the service you request. |
| Protect accounts, prevent abuse and investigate technical faults | Article 6(1)(f): our legitimate interests in running a secure, reliable service, balanced against your rights. This does not authorise routine reading of your wellbeing content. |
| Answer an enquiry about your app service | Article 6(1)(b): providing the service you request. For other general enquiries, Article 6(1)(f): our legitimate interest in responding to people who contact us. |
| Handle data-rights requests and maintain necessary evidence that we have respected your choices | Article 6(1)(c): complying with applicable data-protection obligations. |
Health information has additional protection. We rely on your explicit consent under Article 9(2)(a) for the health information you choose to provide through wellbeing features. This is separate from the Article 6 basis above. Routine support does not require detailed health information; if such information is necessary, we will explain why and establish the appropriate permission before requesting it.
You are not required by law to give us your wellbeing information. You choose what to enter. Account details are needed to provide an account, and the protected wellbeing features cannot operate without the necessary consent. You can still access account and privacy controls if you do not consent.
Your consent and choices
Before you use protected wellbeing features, we ask you separately to confirm that you are at least 18 and to give explicit consent to wellbeing processing. Neither choice is preselected.
You can withdraw consent through Profile → Privacy and data. Withdrawal stops access to wellbeing features and removes your saved cloud check-ins, journal, reflections, progress and achievements when the request completes. This cannot be undone.
Your sign-in account and a record of your consent choices remain. After removal finishes, you can consent again and start a new wellbeing history, or delete your account completely. Withdrawal does not affect the lawfulness of processing that took place before you withdrew.
A connection problem can leave withdrawal pending. Follow the app's retry instructions or contact support if it cannot complete. An incomplete request is not confirmation that your information has been deleted.
Signing out is different: it does not withdraw consent or delete your cloud account or saved wellbeing records.
Who can see your information?
Your wellbeing records are intended for your own use. Mullins Therapy does not routinely read your journal, check-ins or other wellbeing content, and the app does not provide automatic therapist monitoring.
Authorised technical personnel and infrastructure providers may need limited access for service operation, security, a legal requirement or a request from you. Access must be necessary and limited to the task. Your records are not technically inaccessible to every administrator or service provider.
The following services help provide the app:
- Google/Firebase: account authentication, cloud storage and server processing for consent, withdrawal and account deletion.
- Google Workspace/Gmail: handling app-support and privacy correspondence with our authorised support team.
- Podcast and media hosting services, including Spotify/Anchor: delivering the public audio and associated content you request. These services receive technical connection information; playing a podcast does not require us to send them your journal or check-ins.
- Services and people you choose when sharing a report: receiving a report at your instruction.
- Apple or Google platform services: handling app distribution and relevant device functions under their own privacy information.
We may also disclose information where a specific legal obligation requires it. We limit any disclosure to what is necessary.
Progress reports you export or share
You can generate a PDF on your device containing selected check-ins, feelings, before-and-after ratings and techniques. It excludes your name, email address, account identifier, journal entries and free-text notes. The report can still contain sensitive health information, so consider who you share it with.
Creating a report does not automatically send it to Mullins Therapy or a therapist. You choose a recipient or sharing service using your device's sharing options.
The app attempts to remove its temporary report file after sharing. An interruption may delay cleanup. Copies you save, send or upload elsewhere are not recalled when you withdraw consent or delete your app account.
Where is information processed?
Our cloud wellbeing database is hosted in the European Union. Firebase Authentication processes account authentication information in the United States. Other provider operations, support email and media delivery may also involve processing outside the UK. Google explains Firebase's processing locations here.
For transfers outside the UK, we use an applicable UK adequacy arrangement or appropriate contractual safeguards, such as approved contractual clauses with the UK provisions where required. You can contact us for information about the safeguards relevant to your data and how to obtain a copy.
How long do we keep information?
| Information | How long it is kept |
|---|---|
| Sign-in account | While your account exists, until account deletion completes. |
| Cloud journal, check-ins, reflections, progress and achievements | While you keep them in the app, until successful withdrawal or account deletion. You can also delete individual journal entries. |
| Consent and removal records | While your active or limited account exists, so we can respect and demonstrate your choices. These records are removed with full account deletion. |
| On-device onboarding profile | Retained on ordinary sign-out; cleared through withdrawal or deletion on the device completing the request. |
| Account-specific reminders and playback positions | Cleared on sign-out and through withdrawal or deletion on that device. |
| Temporary progress PDFs | Cleanup is attempted after sharing. Copies saved or shared elsewhere remain under their holders' control. |
| App-support correspondence | Six months after the case closes, unless earlier deletion is appropriate or a specific legal obligation requires longer retention. |
| Security, operational and recovery records | For the period needed to protect and restore the service, investigate a specific incident or meet an applicable legal obligation, taking account of the provider's retention and deletion arrangements. These records are not retained indefinitely simply because an account once existed. |
Removing an active account does not instantly erase every provider-held copy. Google states that Firebase Authentication keeps logged IP addresses for a few weeks and removes other authentication information from its live and backup systems within 180 days after user deletion is initiated. This period concerns Firebase Authentication; it is not a general retention period for your journal or all app data. Read Firebase's retention information.
Device backups, recovery copies and files on an offline device may remain until their own deletion or expiry processes run. Account deletion cannot erase copies you have given to another person or saved with another service. If a legal requirement prevents us from deleting particular information, we will explain the reason and retention period where we are permitted to do so.
Delete your account
In the app, go to Profile → Privacy and data → Delete account. You will be asked to verify your identity again where necessary and confirm deletion.
When deletion completes, it removes your sign-in account, cloud wellbeing records and account-linked consent records. The device completing in-app deletion also clears account-specific onboarding preferences, reminders and playback positions. Completed deletion is permanent; there is no recovery period.
You can also request deletion without the app. Email support@mullinstherapy.com with the subject The Mullins Method — account deletion. Tell us the email address associated with the account and your sign-in method. We will take proportionate steps to verify ownership before acting. You do not need to reinstall the app or create a new account to request deletion.
If deletion is interrupted, follow the retry instructions or contact support. The provider, support-correspondence and external-copy limits described above still apply.
Your rights
Depending on the circumstances, you can ask to access, correct or erase your personal information, restrict its use, or receive information you supplied in a portable form. You can withdraw consent at any time.
Your right to object: you can object to processing based on our legitimate interests for reasons relating to your particular situation.
Email support@mullinstherapy.com to exercise a right or raise a concern. We may need to verify your identity. We will handle requests within the applicable legal deadlines and explain any lawful limitation or extension.
You can complain directly to the UK Information Commissioner's Office; you do not have to complain to us first. Contact the ICO or make a complaint.
Updates to this policy
We will update this page when our handling of information changes and show the current version and effective date. We will bring material changes to your attention and seek fresh consent where it is needed before introducing a new use of your health information.
For questions about this policy, contact support@mullinstherapy.com.