Privacy notice.

This site sets no cookies, runs no analytics and embeds no tracking. It makes one third-party request, for the booking window, and only once you have started using the page. Everything else it needs is served from this domain.

Who is responsible

Piotr Mechlinski is the data controller for calm.academy and decides how and why personal data connected with this website and this coaching practice is processed. For any question about this notice or about your data, use the address above.

What this website collects

Nothing that identifies you personally is collected by the page itself. There are no cookies, no local storage, no analytics, no tracking pixels, no embedded video and no social widgets. Fonts, images and logos are served from this domain, so simply reading the page does not tell any other company that you visited.

As with any website, the hosting provider necessarily processes technical data in order to deliver the page and to protect the service from attack:

• your IP address
• the page or file requested, and the date and time
• your browser's user-agent string and preferred language
• the referring page, where your browser sends one

This is handled by Cloudflare, acting as processor, and is used only to serve the site, keep it available and defend it against abuse. No profiles are built from it and it is not combined with anything else.

The booking window

The two booking buttons open a scheduling window from Cal.com, Inc. on top of this page, rather than sending you elsewhere. This is the only third-party code the site uses, and it is deliberately held back: nothing is requested from cal.com while the page is simply sitting there. The code is fetched once you start using the page — scrolling, moving the pointer, touching the screen or pressing a key — and the booking window itself is only created if you actually click a booking button.

If you go on to book, what you type goes to Cal.com, not to this website: your name, your email address, anything you add in the notes, and the time you chose. Cal.com is an independent controller for that booking and sets its own cookies inside its own window. Payment is taken by Stripe, who receive your card details directly — they are never seen by this site or by me. Sessions themselves run on Microsoft Teams.

If you would rather not load cal.com at all, write to [email protected] and we will arrange a time by email.

The contact form

The form at the foot of the site does not send anything to this website, because there is nowhere here to send it. It opens a message in your own email program with the text already filled in, which you then send yourself. Nothing you type is transmitted or stored unless you press send in your own mail app.

If you email me

Writing to [email protected] means I receive your email address, your name if you give it, and whatever you write. Mail to that address is forwarded by Cloudflare Email Routing into a mailbox operated on Microsoft 365, both acting as processors.

I use it to reply to you and to take any steps you have asked for. Correspondence is kept for as long as the enquiry or the working relationship is live, and afterwards only where it must be — to comply with accounting or tax obligations, or to establish or defend a legal claim.

What is said in a session

Coaching conversations are confidential. I keep only brief working notes where they are needed to be useful to you between sessions, and they are not shared with your employer or with anyone else. Sessions are not recorded unless you ask for a recording and agree to it in advance.

Measurements during the four weeks

The four-week programme uses two instruments, an Oura ring or equivalent, and a Muse headband. You buy them, you register them in your own name, and you keep them. The accounts are yours, and the makers of the devices are the controllers for whatever their apps collect from you. Their own privacy terms govern that, not this notice.

What reaches me is only what you choose to show or send: readings and exports such as heart-rate variability, resting heart rate, sleep and time spent in a measured calm state. That is health data, treated as a special category under Article 9 of the GDPR, so I process it only with your explicit consent, given at the start of the programme and withdrawable at any time. It is used for one purpose — running and reviewing your protocol — and is never sold, shared or used for anything else. If you withdraw consent or the programme ends, I delete what I hold unless the law requires me to keep it.

Why I am allowed to do this

• Legitimate interests (Article 6(1)(f) GDPR) — delivering a working, secure website and responding to enquiries.
• Contract, and steps prior to it (Article 6(1)(b) GDPR) — booking, paying for and delivering a session or the four-week programme.
• Explicit consent (Articles 6(1)(a) and 9(2)(a) GDPR) — the health measurements described above.
• Legal obligation (Article 6(1)(c) GDPR) — where retention is required, such as accounting records.

Because this site sets no cookies of its own and does no tracking, there is nothing here that requires your consent to read the page, and so no consent banner.

Who else sees your data

Only the providers named above — Cloudflare for hosting and mail forwarding, Microsoft for the mailbox and for Teams, Cal.com for scheduling and Stripe for payment — and each only to the extent needed to run the service. All are bound by data processing terms. Some process data outside the European Economic Area; where that happens it is covered by the European Commission's Standard Contractual Clauses.

I do not sell personal data, I do not share it for advertising, and I use no advertising or analytics networks.

Automated decisions

There is no automated decision-making and no profiling that produces legal or similarly significant effects. Nothing about your measurements is scored or judged by a machine; the readings are read by a person, with you, and discussed.

Your rights

Under the GDPR you may ask me to:

• confirm what personal data I hold about you, and give you a copy
• correct anything inaccurate or incomplete
• erase your data, where there is no overriding reason to keep it
• restrict how I use it, or object to my use of it under legitimate interests
• receive it in a portable form, where that right applies
• withdraw consent to the health measurements at any time, without that affecting anything done before you withdrew it

Write to [email protected] and I will respond within one month. If you believe your data has been handled wrongly, you may also complain to a supervisory authority — in Poland that is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl) — or to the authority where you live or work.

Changes

If this notice changes, the revised version appears on this page with a new date below. Material changes will be described rather than made silently.

LAST UPDATED: 25 SEPTEMBER 2026