Privacy information
Privacy Policy
This policy explains how Pain Strategies, operating the Ticked Bucket List brand, handles personal information when you use the website, planning tools, customer account, purchases, forms, emails or Trip Decision Review.
Some trip-planning information can stay in your own browser. Other information is sent when you create an account, make a purchase, submit a form, contact us, apply for Trip Decision Review or allow optional analytics or marketing technologies.
Some tool answers and progress can remain in the browser you are using.
Squarespace and related website services may handle account, commerce, form and technical information used to operate the site.
Payment credentials are handled by the payment provider. TBL may receive transaction and fulfilment information.
Technical visit and conversion information may be processed when the relevant technology is enabled and permitted.
General forms and email are not clinical record systems. Do not send full medical records, payment-card details or unrelated sensitive information unless a specific approved workflow clearly asks for it.
Who is responsible
Pain Strategies operates Ticked Bucket List.
Pain Strategies operates the Ticked Bucket List website, products and services. Where Pain Strategies decides why and how personal information is processed, it acts as the data controller or equivalent responsible organisation under applicable privacy law.
Service providers may process information for Pain Strategies. Some external platforms and payment providers may act as separate controllers under their own privacy notices when you interact with them directly.
Privacy questions and requests can be sent to info@tickedbucketlist.com. Please do not include unnecessary health information or payment-card details in the first message.
Where information goes
Browser-local data, account data, payments and submitted information are different.
The feature you use determines what is stored locally, what is transmitted and who handles it.
Browser-local planning data
Some TBL tools can save answers, notes, checklists, preferences or progress in local browser storage. Ticked Bucket List does not automatically receive that browser-local content merely because you use the tool. Clearing site data, resetting the tool, changing browser or device, or using private browsing may remove it.
Squarespace and customer-account information
Website hosting, customer-account access, commerce features, forms and related technical functions may be provided through Squarespace or connected services. Information handled there may include account details, contact details, order information, access status, form submissions and technical logs, depending on the feature used.
Payment information
Payment credentials are processed by the payment provider used at checkout. Pain Strategies may receive customer, transaction, amount, status, invoice, receipt, refund and support information needed to fulfil and account for the purchase. The exact fields depend on the provider and payment method.
Forms, email and Trip Decision Review
Information is transmitted when you submit a form, send an email, apply for a service, upload a file or provide Trip Decision Review information. This may include trip details, planning concerns, relevant accessibility or health context, communications and documents you deliberately provide.
Analytics and marketing data
Where enabled and permitted, analytics or marketing technologies may process technical identifiers, pages viewed, referring information, general location derived from network information and visit or conversion events. Health details, free-text answers, Trip Decision Review intake content, payment-card information and uploaded files should not be included in analytics or marketing event data.
Cross-device use
Browser-local trip data is separate from customer-account access. Unless a feature specifically says that it syncs, saved trip answers or progress should not be assumed to appear on another device or browser.
Export and backup
Where a TBL tool offers an export or backup function, the exported copy is created for you to save or move. Once you store that copy outside the TBL tool or browser, its security and availability depend on the location and service you choose for the file.
Cookies and similar technologies
The website may use:
- essential technologies needed to run, secure and deliver the site;
- functional storage for preferences and saved tool progress;
- optional analytics technologies to understand visits and improve the site;
- optional marketing technologies to measure or improve advertising.
Where consent is required, optional analytics and marketing technologies should not be activated until you make a choice. Available cookie controls can be used to accept, decline or manage categories.
Blocking or clearing browser storage may remove saved progress, preferences or account-session information. It does not delete information already submitted to Ticked Bucket List or a service provider.
Why information is used
Information is used for a service, operating or legal purpose.
Purposes may include:
- providing the page, tool, account, purchase or service you request;
- responding to enquiries, support requests, privacy requests or complaints;
- processing Trip Decision Review applications, confirming scope and delivering accepted reviews;
- providing Starter Kit access and purchase support;
- sending receipts, access messages, service communications and policy notices;
- operating, securing, debugging and improving the website and workflows;
- measuring visits, content use and advertising performance where permitted;
- preventing fraud, misuse, spam and security incidents;
- meeting accounting, tax, record-keeping and legal obligations;
- establishing, exercising or defending legal claims.
Depending on the processing and the law that applies, the legal basis may be consent, steps taken at your request, performance of a contract, compliance with a legal obligation or a legitimate interest that does not override your rights.
Sensitive information, including health-related context, may require an additional or explicit legal basis. Where that applies, the relevant workflow should provide any notice or consent step required by law.
Providers and transfers
Service providers are used to operate the website and deliver requested services.
Provider categories may include website hosting, customer accounts, forms, email delivery, file storage, payments, analytics, marketing, customer support, security, professional advisers and other infrastructure needed for the requested service.
A provider should receive only the information needed for its role and should process it under an appropriate contract or its applicable terms. Some providers act on Pain Strategies' instructions. Others may determine parts of their own processing.
International processing
Providers and technical systems may process or store information outside Kenya or outside your country. Where the law requires it, an appropriate transfer basis, safeguard or consent process should be used.
External links
When you visit an airline, hotel, insurer, social platform, payment page, regulator or other external site, that organisation processes information under its own privacy notice. This policy does not control an external organisation's independent processing.
Sensitive information and AI
Health-related context needs additional care.
Health and accessibility context
Pain, fatigue, symptoms, mobility, sensory needs, medication context and similar information may be sensitive personal data. Share only what is relevant to the form or accepted service.
General TBL tools do not require formal medical records or proof of diagnosis. Do not upload records or detailed medication information unless a specific approved workflow clearly requests it and explains why it is needed.
Analytics and advertising limits
Health details, free-text form content, tool answers, Trip Decision Review intake content, payment-card information and uploaded files should not be included in analytics or marketing event data.
No sale or rental
Pain Strategies does not sell or rent personal information and does not provide submitted health or trip information to data brokers.
Sharing with a service provider to operate the website or deliver a requested service is not treated as a sale by this policy, although applicable law may use different definitions.
General-purpose AI training
Ticked Bucket List does not use user-entered tool answers, private messages, uploaded files or Trip Decision Review submissions to train general-purpose AI models.
Any future feature that sends submitted information to an AI-assisted provider should be assessed, configured and explained in the relevant workflow before it is used.
Retention and security
Information is kept for the purpose that requires it, then reviewed.
Different information has different retention needs. Legal, accounting, dispute, security and service-delivery requirements may affect how long a record must be kept.
| Information | What determines retention | What happens afterwards |
|---|---|---|
| Browser-local tool data | Remains until you reset the tool, clear site data, change browser or device, or the browser removes it. | It may be removed from that browser. Ticked Bucket List may not be able to recover it. |
| Contact and support messages | Kept while the request is handled and for a limited operational, complaint or legal period afterwards. | Deleted, anonymised or retained only where a continuing legal or operational reason applies. |
| Orders, invoices and refunds | Accounting, tax, fraud-prevention, access, refund, dispute and legal record requirements. | Deleted or restricted when the relevant retention requirement ends. |
| Trip Decision Review records | Service delivery, follow-up, quality control, complaint, dispute and legal requirements. | Deleted, anonymised or restricted when the applicable retention basis ends, subject to any continuing legal, complaint or dispute requirement. |
| Marketing records | Kept while you are subscribed or while consent remains valid, plus a limited suppression record after unsubscribe. | Marketing stops; limited evidence of the request may be kept. |
| Security and technical logs | Limited period needed to secure, debug and investigate the website or meet legal requirements. | Deleted or aggregated when identifiable detail is no longer needed. |
Security
Security controls vary by feature, provider and the information involved. Ticked Bucket List limits the information it asks users to send and relies on the access, account, transmission and other controls available in the systems used for each data flow.
No website, browser, email, payment system or electronic storage method is completely secure. Contact us promptly if you believe information connected with Ticked Bucket List has been misused or exposed.
Your privacy rights
You can ask what information is held and how it is used.
The rights available and any exceptions depend on the law that applies to you and the processing.
Ask how and why personal information is being processed.
Ask whether we hold your information and request an available copy.
Ask us to correct information that is inaccurate or incomplete.
Request deletion where the law gives that right and no exception applies.
Object to or ask us to limit certain processing where available.
Withdraw consent for future processing that relies on consent.
Request portable information in circumstances where the law provides it.
Raise a concern with us or an appropriate data-protection authority.
Make a privacy request
Email the request, the right you want to exercise and enough information to identify the relevant interaction. We may need to verify identity and authority before disclosing or changing personal information.
Email a privacy requestWe aim to respond within the period required by applicable law. Some information may be retained or withheld where an exemption or continuing legal obligation applies.
In Kenya, you may also raise a concern with the Office of the Data Protection Commissioner. People in other countries may contact their local supervisory or privacy authority.
Children and policy changes
Children's information needs additional safeguards.
Where Kenyan law applies, processing a child's personal information generally requires consent from a parent or guardian and appropriate mechanisms for age verification and consent, subject to any applicable legal exception. Other laws may add further requirements.
A parent or guardian should contact Ticked Bucket List before submitting a child's information through an account, purchase or service workflow so the appropriate route can be confirmed. Do not send a child's medical records or other unnecessary sensitive information through a general form or email.
If you believe a child has provided personal information without the required permission, email info@tickedbucketlist.com so the matter can be reviewed.
Changes to this policy
We may update this policy when products, data flows, providers, cookie settings, legal requirements or business operations change. The last-updated date and version will be changed. Where required, a material change will also be communicated through an appropriate notice or consent step.
Related legal and trust pages
Issued by Ticked Bucket List, operated by Pain Strategies. Last reviewed 28 July 2026.