Last updated: 26 June 2026
nest Mental Health Foundation ("nest", "we", "us") is committed to protecting your personal data. This policy explains what data we collect, why we collect it, how we use it, and what rights you have under the General Data Protection Regulation (GDPR) and other applicable data protection laws.
The data controller is nest Mental Health Foundation. For any questions about this policy or your personal data, contact us at valerie@nestmentalhealth.org.
We collect and process the following categories of personal data:
Account data. When you create a nest account, we collect your name and email address. Account authentication is managed by Clerk, a third-party authentication provider. Your email address is used for account access only and is never shared with other members.
Member directory data. If you choose to complete your member profile, you may provide your organisation, location, LinkedIn profile URL, roles, bio, and a profile photo. With your explicit consent, this information is displayed to other verified nest members in the member directory. You can withdraw consent at any time by unchecking the directory consent option in your profile settings, or by deleting your account.
Newsletter data. If you subscribe to nest notes, your email address is processed by Beehiiv, our newsletter platform.
Event registration data. When you register for nest events, your data is collected via Google Forms.
Cookie data. We use essential cookies to keep the site functioning. If you consent, we may also use analytics cookies to understand how people use the site.
Contact data. If you contact us by email, we process the information you provide in your correspondence. Introduction requests between members are routed through the nest team and do not involve the disclosure of any member's email address to other members.
We process your data on the following legal bases under Article 6 GDPR:
Consent. For newsletter subscriptions and non-essential cookies. You may withdraw consent at any time.
Contract performance. For account creation and access to member features.
Legitimate interest. For site security, fraud prevention, and improving our services.
We use the following third-party services that may process your data:
Clerk — authentication and account management (USA, with EU data processing agreements in place).
Vercel — website hosting and deployment.
Beehiiv — newsletter delivery.
Google — event registration forms.
Each of these providers operates under their own privacy policies and data processing agreements. Where data is transferred outside the European Economic Area, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses.
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected. Account data is retained while your account is active. If you delete your account, your data will be removed within 30 days. Newsletter data is retained until you unsubscribe.
Under the GDPR, you have the following rights:
Access. You can request a copy of the personal data we hold about you.
Rectification. You can ask us to correct inaccurate data.
Erasure. You can delete your account and all associated data at any time via the "Request account and data deletion" option in your profile settings. This takes effect immediately and is permanent.
Restriction. You can ask us to restrict how we process your data.
Portability. You can request your data in a structured, machine-readable format.
Objection. You can object to processing based on legitimate interest.
Withdraw consent. Where processing is based on consent, you may withdraw it at any time.
To exercise any of these rights, email valerie@nestmentalhealth.org. We will respond within 30 days.
Essential cookies are required for the site to function (authentication, session management). Analytics cookies are only set if you explicitly consent via the cookie banner. You can change your cookie preferences at any time by clearing your browser storage and revisiting the site.
If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority in the EU member state of your habitual residence, place of work, or place of the alleged infringement.
We may update this policy from time to time. Changes will be posted on this page with an updated date. We encourage you to review this policy periodically.