Consumer Health Data Privacy Policy · Beta

How IntoGREATion handles consumer health data

Last updated August 20, 2026. This policy is separate from our general terms and describes consumer health data handled by IntoGREATion. We do not sell consumer health data.

Categories, sources, and purposes

We collect information you provide directly: optional practice interests; private messages; booking service and session details; post-session feedback; saved or played content; and guide profile or uploaded content. We also receive transaction status and technical security/access data from the app and its service providers.

We use this data only to provide requested personalization, messaging, bookings, sessions, content access, payments, moderation, account support, security, legal compliance, and optional aggregate playback analytics. Practice interests are optional and may be skipped or cleared from Account settings.

Sharing

We share only the data needed to provide a feature you request: account/application data with hosting and managed database providers; media with Supabase Storage; generic payment records with Stripe; session participant details with Daily.co when video is enabled; and generic notifications with the configured email provider. Booking participants receive the information needed for their booking. Authorized administrators and guides receive only role-appropriate records. We have no affiliates and do not share health data for advertising.

Retention and security

Messages and post-session feedback remain while an account is active and are deleted on account closure. Owned media is deleted from object storage. Playback events are deidentified. Paid financial facts are retained with the identity anonymized for accounting and legal obligations. Access is role-scoped, sensitive reads are audited, sessions are revocable, and outbound email and payment descriptions omit health context.

Your rights and requests

Signed-in users can confirm and access data by exporting a portable JSON copy, replace optional onboarding answers, withdraw future collection by skipping personalization, or permanently delete their account and owned media from Account settings. You may also submit an authenticated access, correction, consent-withdrawal, sharing-list, or deletion request through the support form or to team@intogreation.com. We respond without undue delay and, where Washington law applies, within 45 days unless a permitted extension is necessary.

If we refuse a request, reply with “Privacy appeal” for a second review. We will respond in writing and explain how to contact the relevant regulator. Requests are free up to twice per year. You do not need to create a new account, though we must authenticate the request.