Privacy Policy

Overview

At Holistic Health, we take your privacy seriously. This Privacy Policy explains how we collect, use, share, and protect your information when you use our website, mobile app, and services.

Service Types and Information We Collect

Text Messaging (iMessage, RCS & SMS) — How the Guide Works

• Your guide works entirely over Messages. No account, email address, or app is required.
• When you text your guide, we collect your mobile phone number and the content of your messages
• A phone number is personal information, so texting conversations are not anonymous
• We store your message history and profile so your guide can respond, remember context, and send the check-ins you opted into
• Messages are delivered through your carrier and through Apple (iMessage) or Google (RCS); those messages are subject to their networks and are not end-to-end encrypted when sent over SMS/RCS
• Reply STOP to end messages at any time, or HELP for help. See the Text Messaging Terms section below.

Website Visitors

• Browsing our website requires no account or personal information
• We collect minimal technical data for functionality (browser type, first-party session identifiers) and, subject to your choices, the analytics and ad-measurement data described under Cookies, Analytics & Advertising below

Legacy Web Accounts

• Before the guide moved to Messages, some members created web accounts with an email address. We no longer offer email-based sign-up for new members.
• If you have a legacy account, we retain its email address, wellness history, and conversation records so you keep access to them, under the same protections described in this policy
• You can request deletion of a legacy account and its data at any time (see Your Rights)

How We Use Your Information

For Wellness Services

• Process your wellness questions and concerns
• Generate personalized wellness assessments and recommendations
• Coordinate with practitioners if you book a visit
• Maintain your wellness timeline (if you create an account)

For Operations

• Operate, secure, and improve our services and AI technology. Your conversations are processed by us and by the third-party AI providers that power your guide, under confidentiality and data-protection agreements. We do not sell this data or use it for third-party advertising.
• Provide customer support
• Process payments for practitioner visits
• Ensure platform security and prevent fraud

How We Share Your Information

We may share your information only in these circumstances:

• With clinics and practitioners: If you ask us to find care, potential clinics may receive an anonymized SOAP summary derived from your Blueprint so they can assess fit. Your name and contact details are released only when an introduction is made. Your full personal Blueprint is shared only if you separately and explicitly authorize it.
• With service providers: Companies that help us operate our services (payment processing, hosting) under strict confidentiality agreements
• With advertising platforms: If a Meta ad led you here and you start a text, we may send Meta a generic conversion event, Meta's own click identifier, and the click and event times, according to your privacy choices. We do not send your name, email address, phone number, messages, symptoms, wellness blueprint, or health information.
• As required by law: To comply with legal obligations
• With your consent: For any other purpose you explicitly authorize

We never sell your personal information or health data.

Data Security

We use industry-standard security measures to protect your information:

• Encryption in transit (TLS) between your browser or app and our servers
• Encryption at rest for stored data
• Access controls limiting who can view your data, and ongoing security review
• Employee training on data protection

A note on text messages:iMessage is end-to-end encrypted by Apple, but standard SMS and RCS messages are not end-to-end encrypted — they travel over your mobile carrier's network. If you prefer end-to-end encryption, use iMessage or our web chat. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

Text Messaging Terms & Consent

Our guide communicates by text message over iMessage, RCS, and SMS. By starting a text conversation with us — or by replying to confirm when we ask — you give your prior express consent to receive text messages from Holistic Health at the mobile number you used, including automated messages and proactive check-ins you have opted into.

• Message frequency varies and depends on your conversation. Proactive check-ins are limited to roughly one per week at most, and only after you opt in.
• Message and data rates may apply from your mobile carrier.
• Reply STOP at any time to stop all messages; we honor STOP immediately and permanently. Reply HELP for help, or contact support@holistic.health.
• Carriers and messaging providers (your carrier, Apple, Google) are not liable for delayed or undelivered messages.
• Consent to receive texts is not a condition of purchase. Crisis (988) and STOP/HELP requests are always honored regardless of consent state.

We retain your phone number and message history to provide the service and, where required, to keep a record of your messaging consent. You can request deletion of this data as described under Your Rights.

Your Rights

You have the right to:

• Access: Request a copy of all data we have about you
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your data
• Portability: Download your data in a common format
• Opt-out: Unsubscribe from marketing communications

To exercise these rights, contact us at support@holistic.health.

Cookies, Analytics & Advertising

The short version:we don't use browser advertising pixels and we never sell your information. If a Meta ad led you here and you start a text, our server may send Meta one generic conversion event using Meta's own click identifier. We do not send Meta your phone number, messages, symptoms, wellness blueprint, or health information.

What we use

• Essential: first-party cookies and identifiers required to run the site. Always on.
• Analytics: bounded page and named-screen analytics and masked session replay (PostHog, acting only on our behalf) on our public marketing, Blueprint, and profile pages. Screen events describe the screen and funnel stage, not access codes, messages, health details, recommendation contents, protocol contents, form inputs, or location fields. Replay masks all text and inputs, blocks health and protocol subtrees, strips dynamic URLs, titles, and referrers, and does not record network bodies, headers, canvas, or console logs.
• Advertising measurement: when a valid Meta click identifier is present and a visitor starts a text, we may send Meta one server-side StartConsultation event with that click identifier and the click and event times. This helps measure and optimize our ads. It contains no phone number, message content, symptoms, wellness blueprint, account identifier, or health information.
• Error diagnostics: PostHog receives sanitized technical exception details across the site and app so we can find and fix failures. This does not include original error messages, request contents, account or health data, or session replay, and it does not create a person profile.

Your choices

• Analytics and advertising measurement run by default with this notice. You can control them separately at any time through Your Privacy Choices in the footer of every page; your saved choices remain in effect until you change them.
• Turning off Advertising measurement, or enabling Global Privacy Control in your browser, suppresses future Meta conversion signals from that browser.
• Depending on where you live, this limited advertising measurement may be considered a disclosure or "sharing" under applicable privacy law. We honor your opt-out through Your Privacy Choices and Global Privacy Control.

Invite codes and how we measure ads

When you tap "Text the Guide," your prefilled first message may include a short invite code. We use it to connect the first text to its referral source (for example, an ad campaign) so we know what's working. The invite code itself stays on our systems and never affects your care. If the source was a Meta ad and advertising measurement is enabled, we may use the invite-code match to send the limited Meta conversion event described above. We do not send the invite code itself to Meta.

Age Requirement

You must be 18 or older to use Holistic Health. We do not knowingly collect information from anyone under 18. If we discover underage usage, we will immediately delete all associated data.

International Users

Our services are operated in the United States. If you access our services from outside the US, your information may be transferred to and processed in the US. By using our services, you consent to this transfer.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website with a new "Last updated" date.

For Practitioners

If you are a practitioner listed on our directory, additional privacy terms apply to your account. Please review our Practitioner Agreement for details on how we collect, use, and protect practitioner data — including profile information, credential verification, client matching data flows, analytics, and payment processing via Stripe.

Key practitioner privacy points:

• Public profile data (name, credentials, specialties, bio) is visible to platform visitors
• Private data (login credentials, license numbers, payment info, analytics) is never publicly displayed
• Client matching shares wellness goals and preferences — never medical records or PHI
• Payment processing is handled by Stripe (PCI DSS Level 1 certified)
• Cancelled account records retained for 3 years for legal/tax purposes
• You may request full data deletion by emailing support@holistic.health

Contact Us

If you have questions about this Privacy Policy or how we handle your information, please contact us:

Email: support@holistic.health
Practitioner privacy: support@holistic.health