Who are we?
Music for my Mind is a Charitable Incorporated Organisation registered in England and Wales with the Charities Commission, registered number 1167246. We are the data controller for the information described in this notice, which means we decide what is collected and what happens to it.
At Music for my Mind, we're committed to protecting and respecting your privacy. This Privacy Policy explains why we process personal data, what it is, how we use it, the conditions under which we may disclose it to others, how we keep it secure and your rights as a data subject.
Any questions regarding this Policy and our privacy practices should be sent to Music for my Mind:
By post at Rivers Lodge, West Common, Harpenden, Hertfordshire, AL5 2JD;
or through our Contact page;
by email at info@musicformymind.com.
What do we mean by personal data?
Personal data relates to a living individual who can be identified from that data. Identification can be by the information alone or in conjunction with any other information we hold or may acquire. The processing of personal data is governed by the General Data Protection Regulation (the "GDPR") and some other UK legislation, including the Data Protection Act 2018.
What data do we have from you?
Website
Subject to the Privacy Policy of Google Analytics, no personally identifiable information is sent to Google Analytics from our website. During your visit to our webpages, the data we obtain about you includes traffic data, location data and behavioural data, such as what pages you've navigated between and what buttons you've clicked. We keep a record of the data you've provided when you sign up to our newsletter or contact us through our message form or directly on our email. This personal information might include your name, email address, phone number, time zone and message.
Crowdfunding page
If you visited our crowdfunding page (now closed) and signed up to become an Ambassador, the information you provided was collected on our behalf by Sponsorcraft Limited under their Privacy Policy. If you made a donation on that page, the data you provided is held by Music for my Mind and handled by Sponsorcraft Limited on our behalf.
JustGiving
If you visit our fundraising page on JustGiving, the information you provide is collected on our behalf by JustGiving and processed under their Privacy Policy.
Research, Development and Service Delivery
If you are a participant in our research, we only collect and process your personal data, once you have signed an informed consent for us to do so. Consent will be obtained in accordance with the research protocol and Research Ethics Committee approvals applicable to the study or studies in which you are participating. The personal data collected will include names, date of birth, gender, video and audio recordings, signed consent or withdrawal forms, research data/records and contact details (such as phone number or email address).
If, as a research participant, you have filled out our musical preferences questionnaire about yourself, it means we will also be collecting information about where you grew up and your religion. This is so we can better personalise your music listening experience and find music that is relevant to you during your teenage years.
Playlist Maker tools
If you are a user of our playlist creation services, we collect and process the personal data you provide to enable a personalised playlist to be created for yourself or your friend/relative living with dementia. The personal data collected will include names, contact details (such as email address or phone number), year of birth, gender and your relationship to the person for whom the playlist is being created (if not for yourself). You will also have filled out our musical preferences questionnaire with information about your musical taste or that of your friend/relative, including your/their religion. This is so we can better personalise your music listening experience and find music that is relevant to that person during their teenage years.
Most playlists are made by a family member or carer for someone living with dementia. Before you submit the questionnaire we ask you to confirm that you are authorised to make the request on that person's behalf. By that we mean either that they are happy for you to do this, or that you hold formal authority such as a Lasting Power of Attorney.
Because the app exists mainly for people living with dementia, telling us that you are making a playlist for someone else implies something about their health, even though we never ask for and never store a diagnosis. Information of that kind gets extra protection under data protection law, and we explain how we handle it in the paragraphs above.
The listener's name appears in the email we send you, on the playlist page, on the printable sheet and bedside card, and in the name of the playlist we save to your Spotify, YouTube or Apple Music account. It is worth knowing that a playlist saved to your own music account may be visible to anyone you share that account or your listening activity with.
The playlist itself
We keep the playlist we made for you, the tracks in it, any tracks you star as favourites (up to 50), and a record of how the playlist was put together, including the instructions sent to the AI service and its reply.
That record is what powers the "How was this built?" explanation, and it lets our team check the quality of what the app produces.
If you email your playlist to family
If you use Share with family, we send your playlist to up to five email addresses you give us, with an optional short message. We use those addresses to send the email and then discard them: what we keep is a scrambled (one-way hashed) version of each address, the first part of the domain (for example gmail), the first name you typed for each recipient, your own email address, and the internet (IP) address the request came from. We keep that record for 90 days so we can honour unsubscribe requests, stop the feature being abused, and investigate if something goes wrong. If a recipient unsubscribes, we keep their scrambled address indefinitely so that they stay unsubscribed.
Your short message is cleaned before it is sent: web links, email addresses, phone numbers and similar are removed. We do not keep the original text.
If you use the "Ask a question" help chat
The chat answers how-to questions about the app from our user guide. We keep the question, the answer, a scrambled version of your email address if you are signed in, and the IP address the question came from, for 30 days. We keep these so we can spot bad answers and improve them. The chat cannot see your playlists, your answers or your account, and it is not a source of medical advice.
Technical records
Every time a playlist is generated we write a small counting record holding only the IP address and the time, so that no one can run up our costs by generating playlists in bulk. These records hold no name, email or playlist reference and are deleted automatically after 7 days.
Our servers also keep operational logs for 30 days. These can include your email address (when we send you an email) and the text you typed in the free-text box (when it is sent for AI suggestions).
How is your information used?
We may use your information to:
Process a donation that you have made.
Reclaim Gift Aid (if applicable).
To provide you with information about our work and services or products we provide, such as campaign updates, future fundraising events or activities, work and research progress, etc.
To carry out our obligations arising from any contracts entered into by you and us.
To provide a personalised playlist in response to the data provided by you, through our musical preferences questionnaire and/or playlist creation App.
Seek your views or comments on the charity and services we provide.
Notify you of changes to our services or policies.
Process a grant or job application.
Gather feedback from you as the user on how to better communicate with and provide better service, which will inform our organisational goals.
Carry out our research and development programme; analyses of that data will be essential for both the development of our products and services and to inform our research findings.
To contact you about your participation in our research and about any findings as a result of the study or studies in which you participated.
Whenever we collect or process your personal data, we'll only keep it for as long as is necessary for the purpose for which it was collected (generally up to 7 years). Data obtained from participants for research purposes will be retained for 10 years. We are required to process some types of information to fulfil our legal obligations (for example the collection of Gift Aid). We review our retention periods for personal information on a regular basis. At the end of that period, your data will either be deleted completely or anonymised.
If you have asked us not to communicate with you any more we will retain your information indefinitely to ensure that we respect your request and do not inadvertently communicate with you again (unless we are legally required to do so).
What is the legal basis for processing your personal data?
Where personal data is collected in the course of fulfilling our contractual obligations to a data subject or other legal obligations, only necessary data is collected and any sensitive information is securely stored and access restricted only to workers or volunteers who need it.
Explicit consent of the data subject is obtained so that we can keep them informed about our work and services or products we provide, such as campaign updates, future fundraising events or activities, work and research progress, etc. You can withdraw your consent at any time by emailing us directly (info@musicformymind.com).
For workers and volunteers, processing is necessary for carrying out obligations under employment, health and safety, social security or social protection law, or a collective agreement.
Explicit, informed consent of research participants is obtained so that we can process their personal data as part of a research study and keep them informed about the study. You can withdraw your consent at any time by emailing us directly (info@musicformymind.com).
Explicit, informed consent is obtained from users of our playlist creation services so that we can process their personal data and that of their relative/friend to create a playlist, contact them further to obtain feedback and process the personal data they provide in that feedback to support further developments in use of personalised music to improve the well-being of people living with dementia. You can withdraw your consent at any time by emailing us directly (info@musicformymind.com).
We never collect:
Data on what you are listening to;
Location more precise than the country you grew up in;
Ethnicity, sexuality, biometrics;
Information about children. The app is for adults; the questionnaire will not accept an age under 18 for the person filling it in.
How we use artificial intelligence
Part of the playlist is suggested by an AI model (currently Claude, made by Anthropic) which we use through Amazon Web Services. What we send it is the era, country and music styles from your answers, and anything you typed in the free-text box. We do not send it your name or email address, or the listener's name.
The same AI service answers questions in the help chat, using our user guide as its source. Under our agreement with the provider, what we send is not used to train future AI models, and the request is processed on servers in Europe. The playlist is only ever a suggestion: nothing the AI does makes any decision about you.
Who has access to your information?
Our workers and trustees have access to your data and are obliged to respect the confidentiality of this information.
We will not sell or rent your information to third parties and we do not use it for advertising.
We may pass your data to trusted service providers and consultants, such as research collaborators, personalised email services, website/app developers and accountants for the purposes of research, completing tasks and providing services to you on our behalf. When we use third party service providers, we disclose only the personal information that is necessary to deliver the service and we have a contract in place that requires them to keep your information secure and not to use it for their own direct marketing purposes. If we stop using their services, your data held by them will be deleted or anonymised.
We also use a small number of trusted suppliers to run our playlist maker service:
Amazon Web Services;
Anthropic (through AWS) - no names or emails, only answers about era, country and music styles, and any free-text notes.
Spotify, Google (YouTube) and Apple Music - only if you choose to send your playlist to any of these streaming services. That part of the service is also governed by your own agreement with them, and their own privacy policies apply.
Where your information is held
All of the information we store is held in Amazon Web Services' London region, and our AI requests are processed in Europe. Nothing leaves the UK or the European Economic Area in normal operation, except where you choose to save a playlist to Spotify, YouTube or Apple Music, which sends it to that provider under your own agreement with them.
Your rights
If you do not want us to keep contacting you with news, updates and/or promotional messages, you can unsubscribe from our mailing list by emailing us directly (info@musicformymind.com) or through the 'Unsubscribe' button at the bottom of our emails.
In addition to the Music for my Mind's normal procedure for deleting stored data, users can revoke our access to their data via the Google security settings page at https://security.google.com/settings/security/permissions.
The accuracy of your information is important to us. We're working on ways to make it easier for you to review and correct the information that we hold about you. In the meantime, if you find errors or inaccuracies in your data, please email us at: info@musicformymind.com.
You are welcome to ask for a copy of the information Music for my Mind holds about you.
Other rights that you have with respect to your personal data (unless subject to an exemption under the GDPR), are:
The right to request your personal data is erased where it is no longer necessary or required by Music for my Mind.
The right, where there is a dispute in relation to the accuracy or processing of your personal data, to request a restriction is placed on further processing.
The right to object to the processing of personal data.
The right to lodge a complaint with the Information Commissioners Office. You can contact the Information Commissioners Office on 0303 123 1113 or via email https://ico.org.uk/global/contact-us/email/ or at the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
The right to withdraw your consent to participate in any of our research studies, without giving any reason and without your care or legal rights being affected.
Deleting your data yourself
Go to playlist.musicformymind.com/account/delete, enter your email address, and we will send you a confirmation link that is valid for 24 hours. The confirmation page shows exactly what will be removed. This deletes your account, every set of answers, every playlist, any feedback you left and the records of any playlists you emailed to family. Every playlist email we send also has a "This wasn't me" link at the foot which deletes that playlist and stops any further email to that address.
Deleting a playlist from our records does not remove a copy you have already saved to your own Spotify, YouTube or Apple Music account. You control those from within those services.
Security
On the occasions where we share your data with third parties, we have agreements in place with them that require them to keep that data secure at all times. Our workers and Trustees are also taking steps to ensure that any personal information is treated securely. Any files or portable devices that contain sensitive information are encrypted and/or password protected. All personal data included on paper forms will be kept in a locked filing cabinet in a secure location.
Access to the administrative view in our playlist maker tools is restricted and protected by a secret token, and the parts of our system that handle your information are given only the permissions they need. We keep this under review as the service grows.
Non-sensitive information (your email address etc.) is transmitted normally over the internet, and this can never be guaranteed to be 100% secure. As a result, whilst we strive to protect this personal information, we cannot guarantee the security of any information you transmit to us, and you do so at your own risk. Once we receive your information we make our best effort to ensure its security on our systems, but if a breach ever put your rights at risk we would tell you, and we would report it to the Information Commissioner's Office where the law requires.
Cookie Policy
Like many other websites, the Music for my Mind website uses cookies. A 'cookie' is a small text marker stored on your computer that enables us to track the use of our website during your visit. They collect statistical data about your browsing actions and patterns and do not identify you as an individual. Our cookies don't store sensitive information such as your name, address or payment details. This helps us to improve our website and deliver a more personalised service.
It is possible to switch off cookies by setting your browser preferences. Each browser is different, so check the 'Help' menu of your particular browser (or your mobile phone's handset manual) to learn how to change your cookie preferences. Turning cookies off may result in a loss of functionality when using our website.
The playlist maker app does store your last-used name and email in your own browser, so you do not have to type them again on a return visit. That stays on your device, and the "Clear and start over" link removes it.
Links to other websites
Our Playlist Maker WebApp contains links to third-party web sites or services that are not owned or controlled by Music for my Mind. Our WebApp uses Spotify, Apple Music and YouTube API Services, in order to deliver the personalised playlists users create.
We encourage you to read the privacy statements on the other websites you visit. You can read the Google Privacy Policy at http://www.google.com/policies/privacy; the Spotify Privacy Policy at https://www.spotify.com/uk/legal/privacy-policy/ and the Apple Privacy Policy at https://www.apple.com/uk/legal/privacy/.
Under 18?
We are keen to protect the privacy of children aged under 18. If you are aged under 18, please get your parent/guardian's permission beforehand whenever you provide us with personal information. Our playlist making tool will not accept an age under 18 for the person using it, and we do not knowingly collect information about children.
Review of this Policy
We keep this Policy under regular review.
We may change this Policy from time to time so please check this page occasionally to ensure that you're happy with any changes. By using our website, you're agreeing to be bound by this Policy.