Privacy Policy

Introduction

Holistic4Spirit ("we," "our," or "us") operates the website at holistic4spirit.com and provides holistic health, aesthetic, and laser hair removal services in Greenville, North Carolina. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you visit our website, contact us, or use our services.

This Privacy Policy applies to personal information collected through our website. For information about how we handle Protected Health Information (PHI) collected in connection with your medical care, please see our HIPAA Notice of Privacy Practices.

Information We Collect

Information You Provide

• Contact information: name, email address, phone number when you submit a contact form, book an appointment, or sign up for communications
• Booking information: appointment details, service preferences, intake form responses
• Health information: information provided on intake forms in connection with treatments — this is treated as PHI and governed by our HIPAA Notice
• Payment information: billing details processed securely by Stripe — we do not store full card numbers
• Communications: messages, emails, or inquiries you send to us

Information Collected Automatically

• Usage data: pages viewed, time on site, referring URLs, browser type, device type, operating system
• IP address: used for security, fraud prevention, and approximate geographic analytics
• Cookies: see our Cookie Policy for full details

How We Use Your Information

• To provide, schedule, and manage the health and aesthetic services you request
• To process payments and manage billing
• To communicate with you about appointments, confirmations, reminders, and follow-ups
• To send you information about services, memberships, or promotions you have consented to receive
• To improve our website, services, and client experience
• To comply with legal obligations, including HIPAA, North Carolina law, and applicable federal regulations
• To prevent fraud, abuse, and unauthorized access

Legal Basis for Processing (Where Applicable)

Where applicable privacy law requires a legal basis for processing, we rely on the following:

• Performance of a contract: processing necessary to provide services you have requested
• Legal obligation: processing required to comply with HIPAA, North Carolina law, and other applicable laws
• Consent: for marketing communications, you may withdraw consent at any time
• Legitimate interests: for website analytics and fraud prevention, where not overridden by your privacy rights

How We Share Your Information

We do not sell your personal information. We share information only as follows:

• CTE Studios (Technology Partner): our platform is built and maintained by CTE Studios, which operates as a HIPAA Business Associate. A BAA is in place. CTE Studios accesses data only to provide and maintain the platform.
• Stripe: payment processing. PHI is not transmitted to Stripe. Stripe is PCI DSS compliant.
• Twilio: SMS appointment reminders and notifications. Subject to BAA.
• Resend: transactional email (booking confirmations, reminders). Subject to BAA.
• Supabase: our database provider. All data encrypted at rest and in transit. Subject to BAA.
• Legal requirements: when required by law, court order, or government authority
• Safety: to prevent imminent harm to you or others, as permitted by HIPAA and applicable law
• Business transfer: in the event of a merger, acquisition, or sale of assets — you will be notified in advance

Data Retention

We retain your personal information for as long as necessary to provide services, comply with our legal obligations (including HIPAA medical record retention requirements under North Carolina law — generally 10 years for adult patients), resolve disputes, and enforce our agreements.

When we no longer need your information, we delete or anonymize it. You may request deletion of non-PHI personal data — subject to our legal retention obligations — by contacting us.

Your Privacy Rights

Depending on your jurisdiction, you may have the following rights:

• Access: request a copy of the personal information we hold about you
• Correction: request correction of inaccurate information
• Deletion: request deletion of personal data, subject to legal retention requirements
• Opt-out of marketing: unsubscribe from marketing communications at any time using the link in any email or by contacting us
• Do Not Sell: we do not sell personal information — no opt-out is required
• Data portability: request your data in a portable format where technically feasible

For rights related to your PHI under HIPAA, see our HIPAA Notice of Privacy Practices.

Cookies and Tracking

We use cookies and similar technologies for essential website functions and analytics. We do not use advertising or cross-site tracking cookies. See our Cookie Policy for full details.

Security

We implement administrative, physical, and technical safeguards appropriate to the sensitivity of the information we process, including TLS encryption in transit, AES-256 encryption at rest, access controls, and audit logging. No system is perfectly secure — if you believe a security incident has occurred, contact us immediately.

Children's Privacy

Our website is not directed to children under 18. We do not knowingly collect personal information from minors without verifiable parental consent. If you believe we have inadvertently collected information from a minor, please contact us immediately and we will delete it.

Third-Party Links

Our website may contain links to third-party sites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies before providing any information.

Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be announced on our website with reasonable notice before they take effect. The effective date at the top of this page indicates when it was last revised.