Privacy Policy — SolariMend

Key definitions

To make the policy practical, we provide clear definitions and attach short examples for program scenarios such as workshop registration, coaching sessions, and research surveys.

Purposes of processing

We list program-focused purposes with practical examples so you understand why a specific data point is collected and how it supports participant outcomes.

• Program delivery: using contact and content data to schedule sessions, provide coaching, and share materials for active course participation.
• Customization: tailoring curriculum and peer group placement using intake questionnaires and professional background to improve learning dynamics.
• Billing and administration: processing payments, issuing receipts, and maintaining business records in compliance with local accounting practices.
• Safety and accommodations: using health or accessibility information to arrange safe, inclusive in-person retreats and venues.
• Quality improvement: aggregating anonymized feedback and engagement data to refine content and facilitator approaches, illustrated by anonymized case studies.
• Research and evaluation: with explicit consent, analyzing outcomes to produce non-identifying case reports that inform future cohorts.
• Legal and regulatory compliance: responding to lawful requests from authorities and maintaining records as required by Singapore law.
• Security and fraud prevention: detecting and preventing unauthorized access or misuse of our platforms.

Legal bases for processing

We rely on lawful bases relevant to each processing activity. For each program scenario, we identify the appropriate basis such as contract, consent, legitimate interest, or compliance with legal obligations.

• Contract: processing necessary to perform an enrolment agreement or deliver the chosen program (e.g., sharing course materials).
• Consent: optional activities such as marketing emails or publishing testimonials, where explicit consent is obtained and documented.
• Legitimate interest: administrative activities such as improving platform security and managing attendance, balanced by participant rights.
• Legal obligation: retention of business records and cooperation with lawful authorities in line with Singapore regulations.
• Vital interests or public interest: limited to rare scenarios where disclosure may be necessary to protect safety or respond to legal requests.

Rights under data protection laws

Depending on applicable law, participants may have rights such as access, rectification, erasure, restriction, objection, and data portability. We illustrate each right with a practical action example.

• Access: request a copy of the personal data we hold for your enrolment; example: obtain your intake responses and attendance records.
• Rectification: ask us to correct inaccurate or incomplete information; example: update your emergency contact on file before an in-person retreat.
• Erasure: request deletion of personal data where there is no overriding legitimate interest; example: withdraw consent for marketing communications.
• Restriction: request limited processing while a dispute is resolved; example: pause further use of coaching notes while you contest recorded data.
• Data portability: request a structured, commonly used format of data you provided; example: export your completed workshop assignments.
• Complaint rights: you may lodge complaints with relevant supervisory authorities if you believe processing does not comply with applicable laws.

Cookies and similar technologies

We use cookies to support website functionality, remember preferences, and analyze usage. Below we explain types and how they apply to participant scenarios like accessing course modules.

Types include session cookies for login persistence, persistent cookies for remembering preferences, and third-party cookies for analytics. Example: a persistent cookie stores preferred language for the participant portal.

Categories: essential (site operation), performance (analytics), functional (preferences), and marketing (optional tracking). Essential cookies are required for core platform features such as live session access.

You can manage cookies via your browser settings or use the cookie consent tool on gharisend.digital. Disabling non-essential cookies may limit some personalized features during programs.

Read our full cookie guidance on gharisend.digital/cookie-policy

Sharing your data

We share personal data only for limited, documented purposes. Each sharing scenario is accompanied by an example to clarify the necessity and safeguards in place.

• Service providers: sharing with trusted vendors such as payment processors and platform hosts to operate our services, under contracts that require appropriate protections.
• Event partners and venues: providing minimal participant information to coordinate logistics and ensure accessibility during in-person events.
• Legal and regulatory bodies: disclosing data when required to comply with legal obligations or to respond to lawful requests.
• Research partners: sharing anonymized, aggregated data for program improvement studies only with explicit consent and after de-identification.
• Marketing platforms: only with consent; examples include sending newsletters or program invitations via an email service provider.
• Affiliated entities: limited sharing with affiliated service teams within SolariMend for program administration and support.

International data transfers

Some third-party processors and cloud hosts operate across borders. When transfers occur, we implement appropriate safeguards such as contractual data protection clauses and provider assessments to protect your personal data.

Safeguards include standard contractual clauses, provider security reviews, and restricting transfers to jurisdictions with adequate protections whenever feasible; transfers are used only to support program delivery and platform reliability.

Data retention

We retain personal data only as long as necessary for the purposes described, including legal, accounting, and program evaluation needs. We provide retention examples tied to specific data types.

Account and enrolment records: retained for the duration of participation and for a defined administrative period thereafter (for example, business reconciliation and alumni support), consistent with applicable law.

Communications and support correspondence: retained for case resolution and service improvement for a limited period following the closure of the support matter.

System and access logs: retained for security monitoring and incident contribute for a defined period to ensure platform integrity.

When retention periods expire or upon valid deletion requests, we remove or anonymize data unless retention is required by law; practical examples include anonymizing survey data for long-term curriculum research.

Security of your data

We implement technical and organizational measures to protect personal data against unauthorized access, disclosure, alteration, and destruction. Our approach is risk-based and includes administrative controls, access management, and regular reviews tied to operational case studies such as incident response simulations.

• Access control and encryption: role-based access to participant records and encryption of sensitive data in transit and at rest to protect records such as intake forms and payment metadata.
• Monitoring, backups and staff training: logging and monitoring of systems, regular backups to prevent data loss, and ongoing staff training in privacy practices illustrated by real operational scenarios.
• Encrypted backups stored in geographically separated locations to reduce risk of data loss; example: a cohort application database is snapshotted daily and encrypted with keys rotated quarterly.
• Regular security audits and third-party penetration testing with remediation plans tracked until closure; scenario: after a simulated breach, identified gaps were patched and verified within 30 days.

Your Data Rights and How to Exercise Them

SolariMend provides practical avenues for participants, clients, and subscribers to exercise control over their personal data. Below are key rights explained with examples and simple steps to act.

• Access: You may request a copy of personal data SolariMend holds about you. Example case: a past program participant asked for their enrollment records and received a structured export within the stated response period.
• Correction: If an entry such as your mailing address or email is inaccurate, request a correction and we will update records and confirm the change with you.
• Deletion: You may request removal of personal data where retention is no longer necessary. For instance, alumni who opt out can have their marketing data removed while aggregated program metrics remain anonymized.
• Restriction: You can request limited processing for specific use cases, such as pausing direct marketing while retaining service-critical records needed for contractual reasons.
• Portability: When practical, we provide your data in a commonly used machine-readable format so you can move it to another provider; scenario: a coach requesting client session logs for continuity with a new platform.
• Objection: You may object to certain processing activities such as direct marketing. We will stop processing for those purposes while we review your objection.
• Withdraw Consent: If you previously gave consent for data processing, you can withdraw it; example: unsubscribing from a mailing list stops future campaign emails.
• Complain: If you believe your rights are not respected, you can file a complaint with SolariMend or the relevant regulatory authority in Singapore. We provide clear steps and case tracking for such complaints.

How to Submit a Rights Request

Send a detailed request including your full name, email used with SolariMend, and the specific right you wish to exercise. Where appropriate, include supporting documentation to verify identity. Example: to request access, indicate the timeframe and types of records you want exported.

[email protected]

We typically acknowledge receipt within 5 business days and aim to respond substantively within 30 calendar days. For complex requests we may extend the period and will notify you with reasons and a projected timeline.