PRIVACY POLICY
The short version
We collect your name and email so we can send you what you signed up for. We collect health information when you tell us about it, so we can teach you safely. We use a handful of ordinary services to run the business, and most of them are American, which means your information leaves Canada.
We don't sell your information and we never will.
You can ask us at any time what we hold about you, ask us to correct it, or ask us to delete anything we no longer need and aren't required to keep.
The rest of this page is the detail.
1. Who is responsible for your information
Eva Blumenfeld, operating as The Garden, 348 Palmerston Boulevard, Toronto, Ontario, Canada.
Eva Blumenfeld is the person accountable for personal information at The Garden. If you have a question, a request, or a complaint about privacy, write to support@thegarden.earth and it comes to her.
This policy covers thegarden.earth, the Garden publication on Substack, our Zoom sessions, our community spaces, our forms, and everything we sell.
2. What We Collect
When you subscribe to the newsletter or the membership: your name and email address. Substack also records your subscription tier, your subscription and cancellation dates, and whether you open and click our emails.
When you buy something from thegarden.earth: your name, email address, billing address, and what you bought. Your card details go straight to Stripe. We never see or store a card number.
When you register for an immersion or retreat, a workshop, a training, or anything in person:whatever you tell us on the intake form, which normally includes emergency contact details, dietary requirements, and health information.
When you tell us something so we can teach you safely: injuries, conditions, pregnancy, medication, and anything else you choose to disclose. See section 8.
When you join a live session: your name as it appears in Zoom, your video and voice if your camera and microphone are on, and anything you type in the chat.
When you join a community space: your phone number and WhatsApp display name. See section 10, because this one matters.
When you visit the site: ordinary technical information such as IP address, browser type, device type, approximate location and pages visited. See section 11.
When you write to us: whatever is in your message.
We collect what we need to run The Garden and nothing else. If we ever ask for something that isn't obviously necessary, ask us why, and if the answer isn't good, don't give it to us.
3. Why we collect it
• To deliver what you've paid for, and to send you what you signed up for
• To teach you safely, which is the only reason we ask about health
• To answer you when you get in touch
• To take payment and keep accounting records
• To meet legal and tax obligations
• To let you know about classes, workshops, immersions, retreats and trainings, if you've agreed to hear from us
• To understand, in the aggregate, what people find useful
If we ever want to use your information for a new purpose, we'll identify that purpose and ask you for fresh consent before we do it. Agreement you gave us for one thing doesn't carry over to something else.
4. Consent, and taking it back
You give us your information voluntarily, and by giving it you're consenting to the uses described here.
You can withdraw consent at any time. Write to support@thegarden.earth. Some consequences follow from that: if you withdraw consent for us to hold your health information, we may not be able to teach you safely and may not be able to keep you in a class. If you withdraw consent entirely, we'll close your account. Some records we have to keep for tax and legal reasons, and section 12 explains which.
We will never refuse you a service because you declined to give us information that wasn't necessary to provide it.
5. Who we share it with
We don't sell, rent or trade your information, and we never share it for anyone else's marketing.
We share it with the services we use to run the business:
|Service |What it handles |Where
Substack |The publication, subscriptions, subscriber list |United States
Stripe |Payment processing |United States
Squarespace |The website and its shop |United States
Zoom |Live classes, workshops and immersions, retreats and their recordings. |United States
WhatsApp (Meta) |Community groups |United States
Google |Email, documents, forms |United States
Fillout |Intake and homework forms |United States
HubSpot |Contact records |United States
Vimeo and YouTube. |Hosting of recordings |United States
If we add a service to this list, we'll update this page.
Each of these has its own privacy policy, and your use of them is also governed by it.
We also share information:
• With a teacher who is covering a session, where they need to know something to teach you safely
• With a venue, where you're attending in person and they need a name list or dietary information
• Where the law requires it, or to respond to a legal process
• Where it's necessary to protect someone's safety
If we ever want to share your information in a way not described here, we'll ask you first.
6. Your information leaves Canada
Almost every service we use is based in the United States, which means your information is stored and processed there and is subject to United States law. That includes the possibility of access by American courts, law enforcement and government agencies under their laws, and those are not protections we can extend to you.
We remain accountable for it regardless. Under Canadian privacy law, handing your information to a service provider does not hand over the responsibility for it. We stay accountable for information we transfer for processing, wherever in the world that processing happens. In practice that means we choose services that publish real data protection commitments, we limit their use of your information to the purposes described here, and if something goes wrong at one of them, it is still ours to deal with and we will deal with it.
If this concerns you, tell us. There are parts of The Garden you can take part in without giving us much at all.
7. What we do not do
We do not sell your information.
We do not share your information with other members, other teachers, or anyone else for their own purposes.
We do not run behavioural advertising, retargeting or advertising pixels on our site.
8. Health information
Health information is the most sensitive thing you'll give us, so it gets its own section.
We only ask because of safety. Kundalini Yoga involves vigorous breathwork and sustained postures, and some practices are contraindicated for particular conditions and during pregnancy. We can't teach you safely without knowing.
Who sees it. Eva, and any teacher who is teaching a session you're attending and needs to know in order to teach you safely.
What we do with it. We use it to adapt what we teach you and to know what to do in an emergency. We don't use it for marketing, we don't analyse it, and we don't disclose it except as described in section 5 or where it's necessary to protect someone's safety.
What we are not. We are not healthcare providers. Health information you give us is not a medical record, it isn't covered by Ontario's health privacy legislation, and it isn't protected by the confidentiality rules that apply to a regulated health professional. It's kept confidential because we treat it that way, not because a college requires us to.
We ask for it expressly. Because health information is sensitive, we don't treat it as covered by a general agreement to our terms. Where we collect it on an intake form, the form carries its own consent line that you tick separately. Where you tell us something informally, in an email or before a class, you're consenting by telling us, and you can ask us to forget it at any time.
You choose what to tell us. You can decline. But if you decline to tell us something material, we may not be able to include you in a class, an immersion or a retreat, because we can't take responsibility for a risk we don't know about.
9. Live sessions and recordings
Live sessions may be recorded. Where a session will be recorded, we tell you. Membership recordings are posted for members for the season.
If your camera or microphone is on, you may appear in the recording. Other participants can see your name and, if your camera is on, your face. This is true in the room and in the replay.
If you'd rather not appear, keep your camera off and stay muted. You can change your Zoom display name to something other than your full name. Tell your teacher and they'll be careful not to call on you.
If you appear in a recording and want it removed, tell us. We'll remove the recording, or edit it if that's practical, as soon as we reasonably can. There may be a short delay.
Membership recordings come down at the end of each season unless we say otherwise. We may keep them, and we may use them again in future.
Where a recording includes you, meaning your image, your voice or something you said out loud, we'll either edit you out before using it for something new or ask you first. You can ask us to remove you from a recording at any time.
You may not record sessions yourself. That's in the Terms and Conditions, and it's a privacy rule as much as a copyright one. Other people in the room did not agree to be recorded by you.
10. Community spaces
Please read this before you join a WhatsApp group.
Your phone number is visible to every other member of that group. That's how WhatsApp works and we can't change it. If you'd rather not share your number with a group of strangers, don't join, and tell us so we can make sure you're not missing anything important.
WhatsApp is owned by Meta. Message contents are end-to-end encrypted, but Meta collects metadata about who you message and when, on its own terms, which we have no control over.
What other members do with what you share in a group is not something we can control either. We ask people to keep circles confidential, and we will remove someone who doesn't, but we can't undo a screenshot.
11. Cookies and tracking
Our website and Substack use cookies. Some are necessary to make the site work, remember what's in your cart and keep you logged in. Others help us understand, in the aggregate, which pages people read.
You can block or delete cookies in your browser settings. Some parts of the site may stop working properly if you do.
Substack sets its own cookies and tracks whether you open our emails and click our links. That's part of how the platform works and it's governed by Substack's privacy policy as well as this one.
12. How long we keep things
|What |How long
Your subscription and contact details |While you're subscribed, and then 2 years, unless you ask us to delete them sooner, or unless they're attached to a record we keep longer (see the note below)
Financial and transaction records |6 years from the end of the last tax year the records relate to, because the Canada Revenue Agency requires it
Signed waivers and health intake forms |7 years after your last participation
Health information you gave us informally. |Deleted when you stop practising with us, or on request
Class recordings |Available to members for one season, then taken down unless we say otherwise. We may keep them afterward
Emails you send us |2 years
Records of a privacy breach |24 months, because PIPEDA requires it
Where one record is attached to another, the longer period applies to both. If you've signed a waiver or given us health information on an intake form, we keep the name and contact details attached to that record for as long as we keep the record itself. A waiver with no way of identifying who signed it is no use to anyone.
When a retention period ends, we delete the information or make it anonymous.
13. How we protect it
We use reputable services with encryption in transit and at rest. Accounts are protected by strong, unique passwords and two-factor authentication wherever the service offers it. Access is limited to Eva and to anyone on the team who needs it for their work, and they're told what the rules are.
No system is completely secure, and we won't pretend otherwise.
Your part: keep your own password private and don't share your login. If you think someone has your account, tell us immediately.
14. If something goes wrong
If there's a breach of our safeguards involving your information, we will:
1. Assess whether it creates a real risk of significant harm to you
2. If it does, report it to the Office of the Privacy Commissioner of Canada and tell you directly, as soon as we reasonably can
3. Tell you what happened, what information was involved, and what you can do about it
4. Tell anyone else who might be able to reduce the harm to you
5. Keep a record of it, as the law requires, whether or not it reached the reporting threshold
We'd rather tell you about something small than have you find out later.
15. Your rights
You can:
• Ask what we hold about you, and get a copy, along with how it has been used and who it has been shared with
• Ask us to correct it if it's wrong or out of date
• Ask us to delete personal information we no longer need and aren't required to keep
• Withdraw your consent to any use of it, bearing in mind what section 4 says about the consequences
• Unsubscribe from any email at any time
• Ask us how long we keep something, or why we collect it
• Complain, and have the complaint actually dealt with
Write to support@thegarden.earth. There's no charge.
For a request to see what we hold, the law gives us up to 30 days to respond and we'll usually be a great deal faster. Everything else we deal with promptly.
We may need to confirm it's really you before we act, particularly on a deletion request.
There are limits, and it's fairer to name them than to promise more than the law gives you. We can't delete something we're legally required to keep. And there are narrow situations where we may have to withhold information from an access request, such as where releasing it would reveal personal information about someone else. If either applies, we'll tell you exactly what we're holding back and why.
16. Children and young people
The Garden is for adults. You must be 18 or older to hold an account or make a purchase.
Some parts of The Garden are open to participants under 18 with a parent or guardian, as set out in section 2 of the Terms and Conditions. In those cases the parent or guardian holds the account, provides the information, and gives consent on the young person's behalf. We don't collect information directly from a minor.
If you believe we hold information about someone under 18 that we shouldn't, write to support@thegarden.earth and we'll delete it.
17. Email
We send newsletters and occasional announcements to people who've asked for them. We do this in accordance with Canada's anti-spam legislation.
Every email has an unsubscribe link and we act on it within 10 business days, usually the same day. You can also just write to us.
We add people to our list when they subscribe themselves. We don't buy lists, and we don't add people who gave us their email for some other reason, like registering for a workshop, without asking.
Unsubscribing from the newsletter doesn't cancel a paid membership, and it doesn't stop transactional emails about something you've bought.
18. Changes to this policy
We may update this page. When we make a meaningful change, we'll post the new version with a new date and tell members by email.
If a change introduces a new use or disclosure of your personal information that requires your consent, we'll ask for that consent before using your information for the new purpose.
19. Questions and complaints
Write to support@thegarden.earth. Every privacy question comes to Eva directly.
We'll acknowledge within 5 business days, investigate, tell you what we found, and tell you what we've done about it. If we got something wrong, we'll say so and fix it.
If you aren't satisfied, you can take it further with the Office of the Privacy Commissioner of Canada, at priv.gc.ca or 1-800-282-1376.
The Garden · thegarden.earth · Toronto, Ontario
Last updated 11 September 2026 · Version 1.0