Privacy Policy

1. Who We Are & Scope of This Policy

This Privacy Policy applies to Living Wholistically, operated by Maleeah Jay ("we," "us," "our," "Company"). We provide holistic wellness coaching, digital programs, guided audio products, and related services through this website and our client portal.

This Policy describes how we collect, use, disclose, store, and protect personal information about individuals ("you," "your") who visit our website, purchase our products or services, or otherwise interact with us. By using our services or submitting personal information to us, you consent to the practices described in this Policy.

If you have questions or concerns about this Policy or our data practices, contact us at: maleeahjay@livingwholistically.com

2. HIPAA Notice — Important Clarification

Your health and wellness information is nonetheless treated by us as highly sensitive. We implement strict internal controls governing who may access it, how it is stored, and when it may be shared. Please review Section 6 (How We Protect Your Data) for details.

3. What Information We Collect

Information You Provide Directly

• Name and email address — collected when you book a call, purchase a product, contact us, or subscribe to any communications.
• Phone number — if voluntarily provided when booking a call or completing an intake form.
• Health history and wellness information — including current health conditions, medications, supplements, dietary restrictions, wellness goals, and related information collected during the client intake process for the sole purpose of building your personalized protocol. This is sensitive personal information and is handled with strict confidentiality as described in this Policy.
• Payment information — processed securely by our third-party payment processor. We do not store, transmit, or have access to your full payment card number, CVV, or bank account details.
• Communications — emails, messages, notes, feedback, and testimonials you send to us or submit through our website.

Information Collected Automatically

• Usage and analytics data — pages visited, time spent on pages, links clicked, and browser or device type. This data is collected in anonymous or aggregated form and is used solely to understand and improve the performance and user experience of our website.
• IP address — automatically collected by our web hosting provider (Vercel) as a standard and unavoidable component of website hosting. We do not use IP addresses to identify or track individual users.
• Cookies and similar technologies — see Section 6 below for full details.

Information We Do Not Collect

We do not collect Social Security numbers, government-issued identification, biometric data, or financial account information beyond what is processed through our payment processor for the purpose of completing a transaction.

4. How We Use Your Information

We use the personal information we collect strictly for the following lawful purposes:

• To deliver your purchased program, protocol, digital product, or service;
• To communicate with you regarding your coaching sessions, program progress, purchases, and account;
• To schedule, confirm, and manage discovery calls and coaching sessions;
• To send you operational communications about your program, including updates, reminders, and support materials;
• To send you marketing or promotional communications about our services, only where you have provided consent or where permitted by applicable law (see Section 9 for opt-out options);
• To improve our website, products, and services based on anonymous usage patterns;
• To detect, investigate, and prevent fraud, unauthorized access, or other illegal activity;
• To enforce our Terms and Conditions; and
• To comply with applicable legal obligations.

We do not use your information to:

• Sell, rent, trade, or lease your personal information to any third party for their own marketing or commercial purposes;
• Engage in targeted advertising, behavioral tracking, or retargeting on social media platforms or elsewhere;
• Make automated decisions that produce legal or similarly significant effects about you; or
• Any purpose beyond what is reasonably necessary to provide and improve our services or as required by law.

5. Third-Party Services We Use

To operate our business, we use a limited number of carefully selected third-party service providers. Each provider has its own privacy policy governing how they handle data on our behalf. We enter into these relationships only with providers we trust and we share only the minimum data necessary for each provider to perform its function.

We are not responsible for the privacy or security practices of third-party service providers. We encourage you to review their privacy policies. If we add or remove a material service provider, we will update this table.

We do not sell, and have not in the past twelve (12) months sold, any personal information to third parties for monetary or other valuable consideration.

6. Cookies & Tracking Technologies

Our website uses a minimal number of cookies and similar tracking technologies. We use:

• Strictly necessary cookies — required for basic website functionality, including maintaining your logged-in session in the client portal. These cannot be disabled without affecting core functionality.
• Analytics cookies — anonymous, aggregate-level data used solely to understand how visitors use our website. We do not use these to build individual user profiles.

We do not use advertising cookies, tracking pixels for retargeting, or any cookies that share your browsing behavior with third-party advertisers.

You may control cookies through your browser settings. Most browsers allow you to refuse, delete, or be notified about cookies. Please note that disabling strictly necessary cookies may impair functionality of the client portal login and other features. Disabling analytics cookies will not affect your access to our services.

By continuing to use our website after being notified of our cookie practices, you consent to our use of cookies as described above.

7. How We Protect Your Data

We take the security of your personal information seriously, particularly your health and wellness information. We implement the following security measures:

• Encrypted connections: All pages on our website use HTTPS (SSL/TLS encryption) to protect data in transit.
• Secure platforms: Client data stored in our portal is hosted on Supabase, which employs industry-standard security protocols including encryption at rest.
• Access controls: Access to client health information is restricted exclusively to Maleeah Jay. No third party, employee, or contractor has access to client health records without explicit client consent.
• Data minimization: We do not retain sensitive health information beyond what is necessary for the active program and the retention periods described in Section 8.
• Payment security: All payment processing is handled by third-party PCI-DSS compliant processors. We never receive, store, or process full payment card data directly.

While we implement commercially reasonable technical and organizational safeguards, no method of data transmission or storage over the internet is completely secure. We cannot guarantee absolute security of your information. By using our services, you acknowledge and accept this inherent risk.

Data Breach Notification

In the event of a data breach that compromises your personal information and creates a risk of harm, we will notify affected individuals as required by applicable law. Where feasible, we will provide notice within seventy-two (72) hours of discovering the breach, and will cooperate with relevant authorities as required. Notification will be provided via email to the address on file. We will describe the nature of the breach, the information affected, and the steps we are taking to address it.

8. How Long We Retain Your Data

We retain personal information only as long as necessary for the purposes described in this Policy or as required by applicable law. Our standard retention periods are:

• Active client data (program materials, communications, portal data): Retained for the duration of your active program plus twelve (12) months following completion, to allow for follow-up support and to address any disputes or questions.
• Health history and intake forms: Deleted or anonymized within ninety (90) days of program completion, unless you request otherwise in writing.
• Purchase and transaction records: Retained for seven (7) years from the date of transaction, as required for accounting, tax compliance, and legal purposes.
• Email and written communications: Retained for up to two (2) years from the date of the communication.
• Marketing consent records: Retained for as long as you remain subscribed, plus three (3) years following unsubscription, to maintain evidence of consent.

Upon expiration of the applicable retention period, we will securely delete or irreversibly anonymize your personal information, except where longer retention is required by law.

9. Email Communications & CAN-SPAM Compliance

We may send you email communications for the following purposes:

• Transactional emails — purchase confirmations, program delivery, session reminders, and direct responses to your inquiries. These are necessary to provide our services and you cannot opt out of them while you have an active program or pending transaction.
• Marketing and promotional emails — information about new programs, offers, content, or services. You may opt out of these at any time.

In compliance with the CAN-SPAM Act and other applicable laws, all marketing emails we send will:

• Clearly identify Living Wholistically as the sender;
• Include our valid business contact information;
• Include a clear and conspicuous opt-out mechanism in every email; and
• Honor all opt-out requests promptly (within ten (10) business days).

To unsubscribe from marketing emails, click the "Unsubscribe" link in any email we send you, or email us directly at maleeahjay@livingwholistically.com with the subject line "Unsubscribe." We will process your request within ten (10) business days. Please note that even after unsubscribing from marketing communications, you may continue to receive transactional emails necessary for active programs or purchases.

10. Your Privacy Rights

Depending on your state of residence, you may have the following rights with respect to your personal information. We honor these rights regardless of where you are located.

• Right to Know / Access — You may request a copy of the personal information we hold about you, including the categories of information, the purposes for which it is used, and the third parties with whom it is shared.
• Right to Correction — You may request that we correct inaccurate or incomplete personal information we hold about you.
• Right to Deletion — You may request that we delete your personal information. We will honor such requests subject to our legal obligation to retain certain data (e.g., transaction records) and any other lawful basis for retention.
• Right to Opt Out of Sale or Sharing — We do not sell or share your personal information for cross-context behavioral advertising. If this practice changes, we will update this Policy and provide you with an opt-out mechanism.
• Right to Non-Discrimination — We will not discriminate against you for exercising any of your privacy rights. You will not be denied services, charged different prices, or provided a different level of service as a result of exercising your rights.
• Right to Data Portability — You may request that we provide your personal information in a structured, commonly used, and machine-readable format where technically feasible.
• Right to Opt Out of Marketing — See Section 9 above.

California Residents — CCPA/CPRA Notice

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), including the right to know the specific pieces of personal information we have collected about you, the right to delete, the right to correct, and the right to opt out of the "sale" or "sharing" of personal information. We do not sell or share personal information as defined under the CCPA/CPRA. To submit a verifiable consumer request, contact us at maleeahjay@livingwholistically.com with the subject line "California Privacy Request." You may designate an authorized agent to make a request on your behalf by providing written authorization.

How to Submit a Privacy Request

To exercise any of the rights described above, email us at maleeahjay@livingwholistically.com with the subject line "Privacy Request." Please include your full name, the email address associated with your account, and a description of the right you wish to exercise. We will verify your identity before processing the request and will respond within thirty (30) days. If we need additional time (up to sixty (60) additional days), we will notify you in writing within the initial thirty-day period.

11. Children's Privacy

Our services are directed exclusively to individuals who are eighteen (18) years of age or older. We do not knowingly collect, use, or disclose personal information from anyone under the age of 18. If you are a parent or guardian and believe that your minor child has provided us with personal information without your consent, please contact us immediately at maleeahjay@livingwholistically.com and we will take prompt steps to delete such information from our records.

If we discover that we have collected personal information from a minor under the age of 18, we will delete it as soon as reasonably practicable.

12. Third-Party Links & Services

Our website may contain links to third-party websites, services, or platforms (such as Instagram, Calendly, or Beacons.ai) that are not owned or controlled by Living Wholistically. This Privacy Policy applies solely to our website and services. We have no control over and assume no responsibility for the privacy practices, content, or security of any third-party websites or services. We encourage you to review the privacy policies of any third-party services you use through or in connection with our services.

13. Disclosure of Your Information

We do not disclose your personal information to third parties except in the following limited circumstances:

• Service providers: To our trusted third-party service providers listed in Section 5, strictly to the extent necessary for them to perform services on our behalf.
• Legal compliance: When disclosure is required by applicable law, regulation, subpoena, court order, or valid governmental request.
• Protection of rights: When we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Living Wholistically, our clients, or the public; to detect, prevent, or address fraud; or to prevent imminent physical harm.
• Business transfers: In the event of a merger, acquisition, reorganization, sale of assets, or bankruptcy, your personal information may be transferred as part of that transaction. We will provide notice before your personal information is transferred and becomes subject to a different privacy policy.
• With your consent: For any other purpose with your prior explicit written consent.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, applicable law, or our services. When we make material changes, we will update the "Last Updated" date at the top of this page and, where required by law or as reasonably practicable, notify you via email. The updated Policy will be effective upon posting unless a later effective date is stated.

Your continued use of our services after any modification to this Policy constitutes your acceptance of the revised Policy. If you do not agree to the revised Policy, you must discontinue use of our services.

15. Contact Us

If you have questions, concerns, requests, or complaints about this Privacy Policy or our data practices, please contact us in writing. We take all privacy inquiries seriously and will respond promptly.

• Business: Living Wholistically
• Owner / Coach: Maleeah Jay
• Email: maleeahjay@livingwholistically.com
• Instagram: @livingwholistically_

Note: This Privacy Policy was prepared for informational and protective purposes. While drafted to be comprehensive, it is not a substitute for advice from a licensed attorney admitted in your jurisdiction. We recommend consulting qualified legal counsel regarding your specific privacy obligations, particularly in connection with the collection of health-related information.