Privacy Policy

Overview

At Holistic Health, we take your privacy seriously. This Privacy Policy explains how we collect, use, share, and protect your information when you use our website, text our AI guide, view your care plan, or buy a supplement pack.

Holistic Health is not a healthcare provider or health plan, so the federal HIPAA privacy rules generally don't apply to the information you share with us. We protect it as this policy describes, and the state health-data laws described in our Consumer Health Data Privacy Policy may apply.

Service Types and Information We Collect

Text Messaging (iMessage, RCS & SMS) — How the Guide Works

• Your guide works entirely over Messages. No account, email address, or app is required.
• When you text your guide, we collect your mobile phone number and the content of your messages, including photos, documents, and voice notes you send
• This includes the health information you choose to share, such as symptoms, conditions, medications, supplements, pregnancy status, lab results, and goals, and what we generate from it, such as your care plan and recommendations
• A phone number is personal information, so texting conversations are not anonymous
• We store your message history and profile so your guide can respond, remember context, and send the check-ins you opted into
• Messages are delivered through your carrier and through Apple (iMessage) or Google (RCS); those messages are subject to their networks and are not end-to-end encrypted when sent over SMS/RCS
• Reply STOP to end messages at any time, or HELP for help. See the Text Messaging Terms section below.

Supplement Pack Orders

• When you buy a pack, we collect your name, email address, phone number, shipping address, the supplements in your pack, your order and delivery history, and the confirmations you give at checkout (for example, that you are not pregnant, breastfeeding, or trying to conceive)
• Payments are processed by our payment processor. We receive limited payment details (such as card brand and last four digits); we don't store your full card number
• If you contact us about an order or a reaction to a supplement, we keep a record of what you tell us

Website Visitors

• Browsing our website requires no account or personal information
• We collect minimal technical data for functionality (browser type, first-party session identifiers) and, subject to your choices, the analytics and ad-measurement data described under Cookies, Analytics & Advertising below

Legacy Web Accounts

• Before the guide moved to Messages, some members created web accounts with an email address. We no longer offer email-based sign-up for new members.
• If you have a legacy account, we retain its email address, wellness history, and conversation records so you keep access to them, under the same protections described in this policy
• You can request deletion of a legacy account and its data at any time (see Your Rights)

How We Use Your Information

For Wellness Services

• Process your wellness questions and concerns
• Generate your care plan and personalized recommendations, including suggestions for supplements we sell
• Coordinate with practitioners and clinics if you ask us to help you find care
• Maintain your wellness profile and history

For Operations

• Operate, secure, and improve our services and AI technology. Your conversations are processed by us and by the third-party AI providers that power your guide, under confidentiality and data-protection agreements. We do not sell this data or use it for third-party advertising.
• Process, prepare, ship, and support your supplement pack orders, including order changes and refunds
• Handle reports of reactions, product complaints, and recalls, and keep the records the law requires
• Provide customer support. Authorized members of our team may review conversations, profiles, and orders for support, safety, and order review; order review is an operational check, not a medical review
• Ensure platform security and prevent fraud

How We Share Your Information

We may share your information only in these circumstances:

• With clinics and practitioners: If you ask us to find care, potential clinics may receive an anonymized SOAP summary derived from your care plan so they can assess fit. Your name and contact details are released only when an introduction is made. Your full personal care plan is shared only if you separately and explicitly authorize it.
• With our manufacturing and fulfillment partner: When you buy a pack, we share what is needed to prepare and ship it: your name, email address, phone number, shipping address, and the supplements and label text for your pack. Because your pack's contents may reveal information about your health, we share them only for this purpose. We do not send the partner your conversations, medical history, medications, or pregnancy status.
• With shipping carriers: Your name and shipping address, to deliver your pack
• With service providers: Companies that help us operate our services on our behalf, such as the AI providers that power your guide, our messaging, hosting, database, analytics, email, and payment providers, and internal support tools, under confidentiality and data-protection terms
• With advertising platforms: If a Meta ad led you here and you start a text, we may send Meta a generic conversion event, Meta's own click identifier, and the click and event times, according to your privacy choices. We do not send your name, email address, phone number, messages, symptoms, care plan, or health information.
• As required by law: To comply with legal obligations
• With your consent: For any other purpose you explicitly authorize

We never sell your personal information or health data.

Data Security

We use industry-standard security measures to protect your information:

• Encryption in transit (TLS) between your browser or app and our servers
• Encryption at rest for stored data
• Access controls limiting who can view your data, and ongoing security review
• Employee training on data protection

A note on text messages:iMessage is end-to-end encrypted by Apple, but standard SMS and RCS messages are not end-to-end encrypted — they travel over your mobile carrier's network. Once your messages reach us they are stored on our systems so the guide can reply, so they are not end-to-end encrypted between you and us. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

Text Messaging Terms & Consent

Our guide communicates by text message over iMessage, RCS, and SMS. By starting a text conversation with us — or by replying to confirm when we ask — you give your prior express consent to receive text messages from Holistic Health at the mobile number you used, including automated messages and proactive check-ins about your plan, and updates about any orders.

• Message frequency varies and depends on your conversation. You can ask your guide at any time to send fewer check-ins or none.
• Message and data rates may apply from your mobile carrier.
• Reply STOP at any time to stop our messages, or START to resume them. Texting CANCEL also stops messages; it does not cancel an order. Reply HELP for help, or contact support@holistic.health.
• Carriers and messaging providers (your carrier, Apple, Google) are not liable for delayed or undelivered messages.
• Consent to receive texts is not a condition of purchase. Our guide is not a crisis service: if you are in crisis, call or text 988, and in an emergency call 911.

How Long We Keep Information

We keep your phone number, message history, and profile while you use the Services, and a record of your messaging consent and opt-outs as the law requires. When you ask us to delete your data, we delete or de-identify it, except for information we must keep for legal, tax, or safety reasons, such as order and payment records and records of reported reactions to supplements (which federal law requires us to keep for six years).

Your Rights

You have the right to:

• Access: Request a copy of all data we have about you
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your data
• Portability: Request a copy of your data in a common format
• Opt-out: Unsubscribe from marketing communications

To exercise these rights, contact us at support@holistic.health.

Cookies, Analytics & Advertising

The short version:we don't use browser advertising pixels and we never sell your information. If a Meta ad led you here and you start a text, our server may send Meta one generic conversion event using Meta's own click identifier. We do not send Meta your phone number, messages, symptoms, care plan, or health information.

What we use

• Essential: first-party cookies and identifiers required to run the site. Always on.
• Analytics: bounded page and named-screen analytics and masked session replay (PostHog, acting only on our behalf) on our public marketing, care plan, and profile pages. Screen events describe the screen and funnel stage, not access codes, messages, health details, recommendation contents, protocol contents, form inputs, or location fields. Replay masks all text and inputs, blocks health and protocol subtrees, strips dynamic URLs, titles, and referrers, and does not record network bodies, headers, canvas, or console logs.
• Advertising measurement: when a valid Meta click identifier is present and a visitor starts a text, we may send Meta one server-side StartConsultation event with that click identifier and the click and event times. This helps measure and optimize our ads. It contains no phone number, message content, symptoms, care plan, account identifier, or health information. We never send it for people located in Washington, Nevada or Connecticut, based on location and phone area code.
• Error diagnostics: PostHog receives sanitized technical exception details across the site and app so we can find and fix failures. This does not include original error messages, request contents, account or health data, or session replay, and it does not create a person profile.

Your choices

• Analytics and advertising measurement run by default with this notice. You can control them separately at any time through Your Privacy Choices in the footer of every page; your saved choices remain in effect until you change them.
• Turning off Advertising measurement, or enabling Global Privacy Control in your browser, suppresses future Meta conversion signals from that browser.
• Depending on where you live, this limited advertising measurement may be considered a disclosure or "sharing" under applicable privacy law. We honor your opt-out through Your Privacy Choices and Global Privacy Control.

Invite codes and how we measure ads

When you tap "Text the Guide," your prefilled first message may include a short invite code. We use it to connect the first text to its referral source (for example, an ad campaign) so we know what's working. The invite code itself stays on our systems and never affects your care. If the source was a Meta ad and advertising measurement is enabled, we may use the invite-code match to send the limited Meta conversion event described above. We do not send the invite code itself to Meta.

Age Requirement

You must be 18 or older to use Holistic Health. We do not knowingly collect information from anyone under 18. If we discover underage usage, we will immediately delete all associated data.

International Users

Our services are hosted in the United States. If you access our services from outside the US, your information may be transferred to and processed in the US.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website with a new "Last updated" date.

For Practitioners

If you are a practitioner listed on our directory, additional privacy terms apply to your account. Please review our Practitioner Agreement for details on how we collect, use, and protect practitioner data — including profile information, credential verification, client matching data flows, analytics, and payment processing via Stripe.

Key practitioner privacy points:

• Public profile data (name, credentials, specialties, bio) is visible to platform visitors
• Private data (login credentials, license numbers, payment info, analytics) is never publicly displayed
• Client matching shares a de-identified summary of the member's wellness needs, as described under How We Share Your Information
• Payment processing is handled by Stripe (PCI DSS Level 1 certified)
• Cancelled account records retained for 3 years for legal/tax purposes
• You may request full data deletion by emailing support@holistic.health

Contact Us

If you have questions about this Privacy Policy or how we handle your information, please contact us:

Email: support@holistic.health
Practitioner privacy: support@holistic.health