Your privacy, plainly.
This policy describes information handled through ’s website and studio services.
Information and sources
We receive information you provide when creating an account, booking, purchasing, completing forms, subscribing, or contacting us. Studio staff may add appointment notes and import existing client records from our previous booking system.
Contact and account information: name, email, telephone, birthday when provided, account credentials stored as password hashes, account role, communication preferences, and consent history.
Appointments and purchases: selected services, providers, dates, locations, orders, gift cards, packages, rewards, payment amounts and status, and payment references. Card entry is handled by the payment provider; our application does not store full card numbers or card security codes.
Intake and consent: answers about health background, pregnancy, medications, procedures, preferences, and other information requested by the form you complete. New form submissions preserve the wording, version, agreement choice, submission time, and signature provided. These records can contain sensitive information.
Communications and technical records: messages, applications, uploaded or submitted content, email delivery records, IP addresses, browser/user-agent details, sign-in and security events, and administrative audit logs. Hosting and payment providers may also collect technical information when delivering their services.
Use and access
We use these records to administer accounts, evaluate service suitability, arrange appointments, provide services and course access, process purchases and refunds, deliver receipts and reminders, support clients, prevent abuse, and maintain business records.
The website restricts intake and consent submission review to administrator accounts. Operational staff may access contact and booking information according to their role. Sensitive records are also processed by hosting and database providers as part of operating the website.
Marketing email requires a subscription. Audience tools can use general visit frequency, location, birthday month, and account or program activity. Intake answers and specific booked treatments are excluded from audience targeting. Requesting account deletion suppresses the account from marketing audiences while staff review the request.
Service providers and other disclosures
The website uses Vercel for hosting and infrastructure, Neon for hosted database storage, Square for configured card payments, and Resend for configured email delivery. The information each handles depends on its function: hosting and database systems process website records, payment systems handle transaction information, and email systems receive addresses and message content. Testing environments may simulate payments and email without delivering them.
Academy videos may use external video hosts. Those hosts connect only after you choose to load a lesson video. Links to social networks, maps, Google, or Yelp take you to services with their own privacy practices.
We may also disclose records when required by law, to respond to lawful requests, or to protect people and the security of our services. This website does not currently include advertising or cross-site analytics trackers in its application code. This statement does not describe the independent practices of a third-party site you choose to visit.
Retention and deletion review
Retention depends on the purpose of each record, ongoing services, accounting and transaction obligations, security needs, and actual or anticipated disputes. Account deletion is a reviewed request, not immediate automated erasure. Staff must identify what can be removed or anonymized and what must be retained, including records held in imports, service providers, and backups.
When records must be retained, the review should document their purpose and review date. Backup copies may persist until their retention period ends; restoration requires reapplying completed deletion decisions. Contact us for the handling of a particular record. We do not promise that every record disappears immediately when a request is submitted.
Access, correction, deletion, and marketing choices
You can review account information and update available fields in your account settings. To request a copy, correction, or deletion of other records, email hello@reflowwellness.com. Signed-in clients can also request deletion in account settings. Submitting the request does not itself delete the account.
We may need to verify your identity or an authorized representative’s authority before releasing or deleting records. Please do not email identity documents or detailed health information unless we arrange an appropriate way to provide them. We will explain any information we must retain and the outcome of the request.
Unsubscribe using the link in marketing email or your account communication settings. Essential account, transaction, and appointment messages are separate from marketing. Contact us if you need help with communication preferences.
Additional rights and response requirements depend on applicable law and whether the business is covered by it, including California privacy laws. This page does not claim that all CCPA provisions apply to every business or request. Contact us to exercise applicable rights; requesting privacy assistance does not change your eligibility for services.
Contact and policy updates
Contact at hello@reflowwellness.com or 2801 El Camino Real, Tustin, CA 92782, Suite #17. This policy covers this website; third-party services publish their own policies.
We will update this page and its effective date when our practices change, and provide additional notice or seek consent where required. A policy update does not replace consent where consent is required.