Privacy Policy

Who this covers

Controller / operator: [COMPANY LEGAL NAME] (“Holistic University,” “we”). Contact: management@holisticuni.com.

This policy covers marketplace discovery, accounts, bookings, retreat interest, practitioner applications, first-party analytics cookies, and related educational membership surfaces that share the same platform.

What we collect

• Account: name, email, password (handled by Supabase Auth), profile fields you choose to add.
• Bookings: session type, time, timezone context, optional notes to the practitioner, payment attempt metadata when paying through Stripe.
• Discovery: location filters you type, modality/specialty filters, and (if you tap Near Me) a temporary browser location used only to reverse-geocode a city label. We store the city-style label for filtering, not your exact GPS coordinates in our database.
• Retreat interest: name, email, party size, optional note.
• Practitioner applications: public listing fields and private review answers.
• Reviews: rating and optional comment.
• Analytics: first-party visitor/session cookies, page paths, engagement time, referrer path, allowlisted UTM parameters, coarse device class — no IP or raw user-agent stored in our analytics tables as designed.
• Affiliate: optional referral code cookie when you arrive with ?ref=.
• Communications: transactional email content needed to send booking status, auth, or application notices through Resend when email is enabled.

Why we collect it

To create and secure accounts, show nearby and filtered practitioners, schedule sessions, process payments when used, notify people about bookings, review practitioner applications, improve the product with first-party analytics, attribute affiliate referrals, and (only if you opt in) send marketing updates.

Who receives information

• Practitioners: booking details and notes for sessions with them; calendar event metadata if they connect Google Calendar (without member notes in the description).
• Supabase Auth: email, password, session tokens, and account metadata (including terms acceptance time and policy version).
• Our Postgres database (hosted with our app infrastructure): application data listed above.
• Stripe: amounts and checkout metadata for marketplace deposits, balances, tips, and membership billing when those flows run.
• Google Calendar API: session title, schedule, member/practitioner labels when a practitioner has connected calendar sync.
• Nominatim / OpenStreetMap: reverse-geocode and place suggestions for city-level location (not advertising).
• OpenFreeMap: map tiles only (no personal form fields).
• Resend: transactional email delivery (booking notices, auth mail, practitioner application notices to management when enabled).
• We do not sell personal information for advertising networks in the current product design. First-party analytics are not wired to a third-party ad pixel in inventory.

Health-related information you choose to share

We do not ask you to fill a medical chart. You may still type health-related details in free-text fields (booking notes, retreat notes, review comments, specialty search filters). That content can be sensitive.

Booking notes go to your practitioner and stay in our booking records. They are not sent to Google Calendar descriptions. Retreat notes go to the retreat team via our interest records. See also our Consumer Health Data Privacy draft for a focused summary.

Cookies

We use essential auth cookies (Supabase session), first-party analytics cookies (hu_vid visitor id ~400 days; hu_sid session ~30 minutes sliding), an affiliate cookie (hu_ref ~30 days), and short-lived OAuth state for Google Calendar connect. Cookie Settings explains choices in plain language.

Retention

Account data lasts for the life of the account. Bookings, notes, applications, and interest rows remain until admin or operational lifecycle handles them — there is not yet a self-serve account delete path in the product. Session cookies expire as described above. Exact deletion tooling is an acknowledged gap we intend to improve.

Your choices

You can edit many profile fields in settings. You can decline browser location and type a city instead. Marketing consent at signup is optional. For access, correction, or deletion requests, email management@holisticuni.com — we will handle requests manually until self-serve tools exist.

Children

[AGE GATE / CHILDREN — counsel to confirm minimum age and jurisdiction rules]. The marketplace is intended for adults capable of forming a contract under applicable law.

International and legal bases

[PRIMARY OPERATING JURISDICTION — counsel]. [GDPR / UK GDPR / CCPA-CPRA legal bases and consumer rights language — counsel; we do not invent statute claims here].

Changes and contact

We will update this draft as the product changes. Contact: management@holisticuni.com.

Contact

Marketplace privacy and legal questions: management@holisticuni.com. Please do not send medical records to this address.