1. Introduction
Welcome to 365 Wellness Solutions ("we," "our," or "us"). We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, applications, and services (collectively, the "Service").
By using our Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with our policies and practices, please do not use our Service.
2. Information We Collect
2.1 Personal Information
We collect information that you provide directly to us, including:
- Name (first and last name)
- Email address
- Password (stored securely using bcrypt hashing)
- Contact information, including emergency contacts
- Health and wellness questionnaire responses
- Family member information (up to 2 additional family members) including names, relationships, and health questionnaire responses
- Consultation preferences and scheduling information
- Payment information (processed securely through Authorize.Net - we do not store full credit card details)
- Subscription and billing information
- Digital waiver signatures and consent records
2.2 Automatically Collected Information
When you access or use our Service, we may automatically collect certain information, including:
- Device information (device type, operating system, browser type)
- Usage data (pages visited, features used, time spent)
- IP address and geolocation data
- Cookies and similar tracking technologies (see Section 7 for more details)
- Session information and authentication tokens
3. How We Use Your Information
We use the information we collect for the following purposes:
- Service Provision: To provide, maintain, and improve our wellness services, including consultation scheduling, personalized wellness plans, and subscription management
- User Account Management: To create and manage your account, process registrations, and authenticate users
- Communication: To send you emails, notifications, and updates regarding your account, consultations, payments, and service-related information via AWS Simple Email Service (SES)
- Payment Processing: To process payments, manage subscriptions, and handle billing through Authorize.Net payment gateway
- Health and Wellness Services: To provide personalized nutrition and wellness guidance based on your questionnaire responses and consultation history
- Application Management: To review, approve, or manage wellness applications and related documentation
- Compliance and Legal: To comply with legal obligations, enforce our Terms of Service, and protect our rights and the rights of our users
- Analytics and Improvement: To analyze usage patterns, improve our Service, and develop new features
- Security: To detect, prevent, and address security issues and fraudulent activities
4. Information Sharing and Disclosure
We do not sell your personal information to third parties. We may share your information only in the following circumstances. California residents have the right to opt out of the sale or sharing of their personal information (see Section 6.2).
- Service Providers: We share information with trusted third-party service providers who assist us in operating our Service, including:
- Authorize.Net (payment processing and subscription management)
- AWS Simple Email Service (email delivery)
- MongoDB (data storage and database services)
- Hosting and cloud infrastructure providers
- Legal Requirements: We may disclose your information if required by law, court order, or government regulation, or if we believe such disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or comply with a government request
- Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction
- With Your Consent: We may share your information with third parties when you have explicitly given us permission to do so
All third-party service providers are contractually obligated to protect your information and use it only for the purposes specified by us.
5. Data Storage and Security
We implement appropriate technical and organizational measures to protect your personal information:
- Encryption: Passwords are hashed using bcrypt with 12 salt rounds. All data transmitted to and from our Service is encrypted using SSL/TLS protocols
- Secure Storage: Your data is stored in secure databases hosted by MongoDB with access controls and encryption at rest
- Authentication: We use NextAuth.js and JWT tokens for secure session management
- Access Controls: Role-based access control ensures that only authorized personnel can access sensitive information
- Payment Security: Payment card information is processed directly by Authorize.Net (PCI-DSS compliant). We do not store full credit card numbers on our servers
- Regular Updates: We regularly update our security measures and conduct security assessments
Despite our efforts, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee absolute security.
6. Your Rights and Choices (GDPR & CCPA)
Under the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), you have certain rights regarding your personal information:
6.1 GDPR Rights (European Residents)
- Right of Access: You can request access to the personal information we hold about you and receive a copy of your data
- Right to Rectification: You can request correction of inaccurate or incomplete personal information
- Right to Erasure (Right to be Forgotten): You can request deletion of your personal information, subject to our legal retention obligations
- Right to Restrict Processing: You can request that we limit how we use your personal information
- Right to Data Portability: You can request a copy of your data in a structured, machine-readable format
- Right to Object: You can object to processing of your personal information for certain purposes
- Right to Withdraw Consent: You can withdraw consent at any time where we rely on consent as the legal basis for processing
6.2 CCPA Rights (California Residents)
- Right to Know: You can request disclosure of the categories and specific pieces of personal information we collect, use, disclose, and sell
- Right to Delete: You can request deletion of your personal information, subject to certain exceptions
- Right to Opt-Out: You can opt out of the sale or sharing of your personal information
- Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights
- Right to Correct: You can request correction of inaccurate personal information
6.3 How to Exercise Your Rights
You can exercise these rights by:
We will respond to your request within 30 days (GDPR) or 45 days (CCPA) of receipt. We may request verification of your identity before processing your request to protect your privacy and security.
Note: Some information may be retained for legal compliance, accounting purposes, or to complete transactions you have initiated, even after you request deletion.
7. Cookies and Tracking Technologies
We use cookies and similar tracking technologies to enhance your experience. For detailed information about our use of cookies, please see our Cookie Policy.
- Necessary Cookies: Essential for the website to function (always active, cannot be disabled)
- Authentication Cookies: Used to maintain your login session and authentication state
- Session Cookies: Used to track your session and remember your preferences
- Analytics Cookies: Used to understand how you interact with our Service and improve functionality (requires consent)
- Marketing Cookies: Used for advertising and marketing purposes (requires consent)
You can manage your cookie preferences through:
- Our cookie consent banner when you first visit our website
- Your Privacy Settings page
- Your browser settings (though disabling cookies may affect functionality)
We respect your cookie preferences and will only use non-essential cookies if you have provided consent.
8. Data Retention
We retain your personal information for as long as necessary to:
- Provide you with our Service
- Comply with legal obligations
- Resolve disputes and enforce our agreements
- Maintain records for tax and accounting purposes
When you delete your account, we will delete or anonymize your personal information, except where we are legally required to retain certain information (e.g., transaction records, legal compliance).
9. Children's Privacy
Our Service is not intended for children under the age of 18. We do not knowingly collect personal information from children under 18. If you believe we have collected information from a child under 18, please contact us immediately, and we will take steps to delete such information. Parents or legal guardians may provide information about children as family members through our family member questionnaire feature, and by doing so, consent to our collection and use of that information in accordance with this Privacy Policy.
10. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. We encourage you to review this Privacy Policy periodically. Your continued use of our Service after any changes constitutes acceptance of the updated Privacy Policy.
11. International Data Transfers
Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that differ from those in your country. By using our Service, you consent to the transfer of your information to these countries. We take appropriate measures to ensure that your information receives an adequate level of protection in accordance with this Privacy Policy.
12. Health Information Privacy
As a wellness service provider, we may collect health-related information through questionnaires and consultations. We treat this information with additional care and in accordance with applicable health privacy laws. This information is used solely for:
- Providing personalized wellness and nutrition guidance
- Conducting consultations with our wellness professionals
- Managing your wellness application and subscription
We do not share your health information with third parties except as necessary to provide our Service or as required by law.
13. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
By using our Service, you acknowledge that you have read and understood this Privacy Policy and agree to our collection, use, and disclosure of your information as described herein.