This Privacy Policy describes how Holistic University’s marketplace and related sites collect, use, and share personal information. It is written to match what the product actually does today.
Who this covers
This policy covers marketplace discovery, accounts, bookings, retreat interest, practitioner applications, first-party analytics cookies, and related educational membership surfaces that share the same platform.
What we collect
- Account: name, email, password (handled by Supabase Auth), profile fields you choose to add.
- Bookings: session type, time, timezone context, optional notes to the practitioner, payment attempt metadata when paying through Stripe.
- Discovery: location filters you type, modality/specialty filters, and (if you tap Near Me) a temporary browser location used only to reverse-geocode a city label. We store the city-style label for filtering, not your exact GPS coordinates in our database.
- Retreat interest: name, email, party size, optional note.
- Practitioner applications and credentials: public listing fields, private review answers, credential details, and any credential documents a practitioner uploads for private staff review.
- Practice galleries: photos a practitioner uploads and Instagram posts a practitioner chooses to import or feature. We do not publish the connected Instagram handle or a direct Instagram profile link.
- Instagram connections: Instagram account identifiers and an encrypted access token used to import eligible media after the practitioner connects a supported Creator or Business account.
- On-platform messages: message text, attachments, reactions, and thread information shared between signed-in members and practitioners.
- Reviews: rating and optional comment.
- Analytics: first-party visitor/session cookies, page paths, engagement time, referrer path, allowlisted UTM parameters, coarse device class — no IP or raw user-agent stored in our analytics tables as designed.
- Affiliate: optional referral code cookie when you arrive with ?ref=.
- Communications: transactional email content used to send authentication, application, booking confirmation, appointment reminders, reschedule, cancellation, and related account notices through Resend.
Why we collect it
To create and secure accounts, show nearby and filtered practitioners, schedule sessions, process payments when used, notify people about bookings, review practitioner applications, improve the product with first-party analytics, attribute affiliate referrals, and (only if you opt in) send marketing updates.
Who receives information
- Practitioners: booking details and notes for sessions with them; calendar event metadata if they connect Google Calendar (without member notes in the description).
- Supabase Auth: email, password, session tokens, and account metadata (including terms acceptance time and policy version).
- Our Postgres database (hosted with our app infrastructure): application data listed above.
- Stripe: amounts and checkout metadata for marketplace deposits, balances, tips, and membership billing when those flows run.
- Google Calendar API: we read free/busy availability from a connected practitioner calendar to block unavailable times, and we send session title, schedule, and member/practitioner labels for synced bookings. We do not include member notes in calendar descriptions.
- Instagram / Meta API: when a practitioner chooses to connect Instagram, we receive account identifiers, eligible media, and access credentials needed to import selected content. Access tokens are encrypted at rest and are not displayed publicly.
- Nominatim / OpenStreetMap: reverse-geocode and place suggestions for city-level location (not advertising).
- OpenFreeMap: map tiles only (no personal form fields).
- Resend: transactional email delivery, including authentication, practitioner application, booking confirmation, appointment reminder, reschedule, and cancellation notices.
- We do not sell personal information for advertising networks in the current product design. First-party analytics are not wired to a third-party ad pixel in inventory.
Health-related information you choose to share
We do not ask you to fill a medical chart. You may still type health-related details in free-text fields (booking notes, retreat notes, review comments, specialty search filters). That content can be sensitive.
Booking notes go to your practitioner and stay in our booking records. They are not sent to Google Calendar descriptions. Retreat notes go to the retreat team via our interest records. See also our Consumer Health Data Privacy Policy for a focused summary.
Cookies
We use essential auth cookies (Supabase session), first-party analytics cookies (hu_vid visitor id ~400 days; hu_sid session ~30 minutes sliding), an affiliate cookie (hu_ref ~30 days), and short-lived OAuth state for Google Calendar and Instagram connections. Cookie Settings explains choices in plain language.
Retention
Account data lasts for the life of the account. Bookings, notes, messages, applications, credential records, gallery records, and interest rows remain until a user or administrator uses an available removal flow or our operational lifecycle handles them. There is not yet one self-serve action that deletes the entire account. Session cookies expire as described above. Exact account-wide deletion tooling is an acknowledged gap we intend to improve.
Your choices
You can edit many profile fields in settings, disconnect Instagram, remove manual gallery photos, and remove eligible credential evidence. Disconnecting Instagram clears the stored access credential and removes Instagram items from your visible profile; manual uploads remain until you remove them. You can decline browser location and type a city instead. Marketing consent at signup is optional. For access, correction, or deletion requests, email management@holisticuni.com — we will handle requests manually until self-serve tools exist.
Children
The marketplace is intended for adults capable of forming a contract under applicable law.
Changes and contact
We will update this policy as the product changes. Contact: management@holisticuni.com.
