Privacy Policy

Afterlight Retreats operates clinically led psychedelic-assisted therapy retreats in Negril, Jamaica. For the purposes of data protection law, including the Jamaica Data Protection Act, 2020 and, where applicable, the EU and UK General Data Protection Regulation (“GDPR”), we are the data controller of the information you provide through the Clinical Review.

This policy applies to the Clinical Review form, our scheduling pages, and related communications. It does not cover third-party websites we link to, which have their own policies.

Information you give us

• Contact and identity details: first and last name, email address, phone number, date of birth, and country or region of residence.
• Enquiry details: the programme or dates you are interested in, what is bringing you to Afterlight, and your goals for treatment.
• Health information (special category data): psychological and psychiatric history, including diagnoses, hospitalisations, and any history of suicidal thoughts or self-harm; substance use or dependence; medical conditions such as cardiovascular, neurological, or liver conditions; pregnancy or breastfeeding; current medications and supplements; previous experience with psychedelics; relevant family history; and anything else you choose to write in free-text fields.
• Confirmations and preferences: your confirmations that the information is accurate, and your email and text message opt-in choices, including the date, time, and wording of any consent you give.
• Booking and correspondence: the consultation time you select, and the content of emails, texts, and calls with our team.

Information collected automatically

• Security and technical data: IP address, browser type, and request timestamps, used to protect the form from abuse (for example, rate limiting) and to keep our systems secure.
• Privacy-friendly analytics: aggregated page-view statistics that do not use advertising cookies. We remove query strings, which may contain your email address, before any analytics event is sent.

We do not knowingly collect information from third-party data brokers, and we do not use advertising or social media tracking pixels on the Clinical Review.

• To review your suitability and safety for psychedelic-assisted therapy, including identifying medical or psychological factors that need closer clinical attention.
• To prepare for, schedule, and conduct your Clinical Review consultation with our clinical team.
• To respond to your enquiry and, if you proceed, plan your preparation, retreat arrangements, and integration support.
• To send you service communications by email or text message where you have opted in.
• To keep our website and systems secure, prevent fraud and misuse, and troubleshoot problems.
• To meet our legal, regulatory, insurance, and professional record-keeping obligations, and to establish or defend legal claims.

We do not use your health information for marketing, advertising, profiling for commercial purposes, or to train artificial intelligence models.

Where the GDPR, UK GDPR, or the Jamaica Data Protection Act applies, we rely on the following legal bases:

• Steps before entering a contract (GDPR Art. 6(1)(b)): handling your enquiry and arranging your consultation at your request.
• Explicit consent (GDPR Art. 9(2)(a)): processing your health information. You give this consent when you choose to submit the Clinical Review. You may withdraw it at any time, although we may then be unable to assess your suitability for the programme.
• Health and care purposes (GDPR Art. 9(2)(h)): where your health information is reviewed by, or under the responsibility of, a professional subject to a duty of confidentiality.
• Consent (GDPR Art. 6(1)(a)): sending you emails and text messages when you opt in.
• Legitimate interests (GDPR Art. 6(1)(f)): keeping our systems secure and improving the Clinical Review through aggregated, non-identifying analytics.
• Legal obligation (GDPR Art. 6(1)(c)): keeping records we are required to keep by law.

The Clinical Review offers two optional, unticked checkboxes. Opting in is never a condition of submitting your review or purchasing any service.

We record the date, time, method, and exact wording of your consent. Messages relate to your enquiry, consultation, appointments, preparation, retreat arrangements, and related service updates.

How to opt out

• Text messages: reply STOP to any message to opt out, or HELP for help. You will receive one confirmation message.
• Email: use the unsubscribe link in any email, or contact us at hello@afterlight.com.

Message frequency varies. Message and data rates may apply. Mobile carriers are not liable for delayed or undelivered messages.

We do not sell, rent, or share your mobile phone number or text messaging opt-in data with third parties or affiliates for their own marketing or promotional purposes. Mobile numbers and consent records are shared only with the service providers that help us deliver our messages, as described in the next section.

We share personal information only with:

• Our clinical and care team: clinicians and staff who review your submission and support your care, all bound by confidentiality.
• Client management and messaging provider: HighLevel (LeadConnector), which stores your submission and consultation booking and sends our emails and text messages. It may use carriers and messaging partners to deliver texts.
• Hosting and analytics provider: Vercel, which hosts this website, processes requests securely, and provides aggregated, cookie-free page analytics.
• Professional advisers: lawyers, accountants, and insurers, where needed and under confidentiality.
• Authorities: where required by law or to protect someone's vital interests, for example in an emergency involving risk to life.
• Business transfers: a successor organisation in a merger, acquisition, or sale of assets, which must honour this policy.

Our service providers act on our instructions under written agreements and may not use your information for their own purposes. We do not sell your personal information or share it for cross-context behavioural advertising.

We are based in Jamaica, and some of our service providers process data in the United States and other countries. These countries may have data protection laws that differ from yours. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or the EU–U.S. Data Privacy Framework, together with additional contractual and technical protections.

• All connections are encrypted with HTTPS (TLS), and browsers are instructed to always use a secure connection.
• Your submission is sent to our own server first, validated and cleaned there, and then passed to our client management system. Our integration addresses and credentials are never exposed to your browser.
• The form is protected by rate limiting, request validation, size limits, and origin checks to block automated abuse.
• Security headers restrict which websites may embed our pages and which browser features the pages can use.
• Access to your information is limited to authorised team members who need it for your care or enquiry.

Your in-progress answers are saved only in your own browser so you can pick up where you left off. They are deleted automatically after 24 hours, when you submit, or when you choose to start over. On a shared device, we recommend finishing in one sitting or choosing Start Over.

No system is completely secure. If a breach affects your information, we will notify you and the relevant authorities as required by law.

• Enquiries that do not proceed: deleted or anonymised within 24 months of your last contact with us, or sooner on request.
• Clients who attend a retreat: clinical and care records are kept for the period required by applicable health record-keeping laws and professional standards, typically at least 7 years after your programme ends.
• Consent records: kept for as long as you remain subscribed and for 5 years afterwards, so we can show that you agreed to receive messages.
• Security logs: kept for a short period, typically no longer than 90 days, unless needed to investigate an incident.

Depending on your location, you may have the right to:

• Access the personal information we hold about you and receive a copy.
• Correct information that is inaccurate or incomplete.
• Delete your information, subject to our legal record-keeping obligations.
• Restrict or object to certain processing.
• Receive your information in a portable format.
• Withdraw consent at any time, without affecting processing that took place before.
• Complain to a data protection authority.

Jamaica

Under the Data Protection Act, 2020, you may exercise these rights with us and complain to the Office of the Information Commissioner of Jamaica.

European Economic Area and United Kingdom

You may complain to the data protection authority where you live or work, or to the UK Information Commissioner's Office (ICO).

United States

Residents of California and other states with consumer privacy or consumer health data laws, such as Washington's My Health My Data Act, may have the right to know, access, delete, and correct their information, to withdraw consent for health data processing, and to appeal a decision about their request. We do not sell personal information or consumer health data, and we do not use sensitive information to infer characteristics about you beyond what is needed to provide our services.

How to make a request

Email hello@afterlight.com. We may need to verify your identity before responding, usually by confirming details you have already given us. We aim to respond within 30 days, and in any case within the time required by law. You may use an authorised agent where the law permits it.

• Essential browser storage: saves your in-progress Clinical Review on your device for up to 24 hours. It never leaves your device until you submit.
• Analytics: aggregated, cookie-free page statistics. We do not use advertising, retargeting, or social media cookies.
• Scheduling: the booking calendar is provided by our client management provider and may set essential cookies needed for booking to work.

Some answers automatically add internal labels to your record, for example to highlight a medication that needs closer review. These labels only help our team prioritise and prepare. They never decide your eligibility, which is always determined by a qualified member of our clinical team.

The Clinical Review and our retreats are intended only for people aged 18 or older. We do not knowingly collect information from anyone under 18. If you believe a minor has submitted information, please contact us and we will delete it.

We may update this policy from time to time. The “Last updated” date shows when it was last revised. If we make material changes to how we use your information, we will notify you by email or through the Clinical Review before the changes take effect, and ask for your consent again where required.

For questions about this policy or your information, or to exercise your rights, contact us:

See also our Terms of Use.