Privacy Snapshot

Below is a high‑level overview. For full details, read the complete Policy that follows.

Flowdara Privacy & Data Protection Policy

Effective Date: 27 March 2026
Last Reviewed: 27 March 2026

Flowdara, Inc. and its subsidiaries ("Flowdara", "we", "our" or "us") respect your privacy. This Privacy & Data Protection Policy ("Policy") describes how we collect, use, disclose, and protect your personal information when you interact with our booking platform, websites, mobile applications, application‑programming interfaces (APIs) and related services (collectively, the "Services").

Layered approach. This Policy is our comprehensive disclosure. Where required, we also provide contextual "just‑in‑time" notices (e.g., cookie banner, OAuth consent screens). If a regional law offers you stronger rights or imposes stricter duties, we comply with that law.

1. Definitions

2. Scope & Applicability

This Policy applies to all users in North America and the United Kingdom (preparatory compliance) and governs every point of collection - websites, mobile apps, emails, APIs, support channels, and marketing touch‑points.

The Services are not directed to children under 16. We do not knowingly collect data from children under 13. See Section 12.

HIPAA Notice; No Business Associate Agreement

Flowdara provides software for independent wellness and holistic practitioners. The Services are not intended for use by HIPAA covered entities (for example, clinics, health plans, or clearinghouses acting in that capacity) in connection with protected health information subject to the U.S. Health Insurance Portability and Accountability Act and its regulations (HIPAA). Flowdara does not enter into Business Associate Agreements (BAAs) with subscribers or their clients.

Wellness- and health-related information. Subscribers may configure features that collect identifying and health- or wellness-related information - such as intake questionnaires, liability waivers, session notes, messages, and similar content- that clients or subscribers submit voluntarily. That information may be sensitive and is processed as described in this Policy (including Section 3 and Section 8). Whether any specific information is PHI under HIPAA depends on the subscriber's role and use case; Flowdara does not assess your regulatory status.

Security is not a HIPAA program. Descriptions of encryption, access controls, and monitoring in this Policy describe general commercial safeguards. They do not mean Flowdara is your HIPAA business associate, that we implement HIPAA Security Rule controls for your practice, or that the Services are a HIPAA-compliant electronic health record or clinical system.

For contractual terms (including eligibility and prohibited use), see our Terms of Service.

3. What We Collect & Why

3.1 Data‑Processing Matrix

* Legal basis references GDPR Articles 6 & 9 and comparable concepts under U.S. state laws (including CPRA) and PIPEDA. For special category / health-related data under EU/UK GDPR, we typically rely on explicit consent (Art. 9(2)(a)), contract or provisions relating to health care where applicable (e.g. Art. 9(2)(h)), or another permitted Article 9 basis. Subscribers who configure intake or waiver forms are responsible for obtaining any client consent required in their jurisdiction. When multiple bases apply, we use the strongest lawful option.

† Subscribers choose whether to use intake forms, waivers, notes, and similar features. Clients submit answers voluntarily. Flowdara does not market the Services as a HIPAA compliance product. We apply the protections described in Section 8; they are commercial safeguards, not a substitute for a HIPAA compliance program. See Terms of Service (HIPAA; no BAA).

4. How We Use Personal Information

1. Service delivery & account administration – create profiles, schedule bookings, send confirmations.
2. Payment processing & fraud prevention – via Stripe (PCI‑DSS Level 1).
3. Product research & development – aggregate analytics, A/B testing, error diagnostics.
4. Security & abuse prevention – monitor logs, investigate suspicious activity, enforce Terms.
5. Marketing (opt‑in only) – newsletters, promotions, referral programmes; unsubscribe anytime.
6. Legal & compliance – tax records, contractual enforcement, regulatory reporting.
7. Corporate events – mergers, acquisitions, or asset sales with appropriate confidentiality safeguards.

We never use Stripe payment data or sensitive health information for marketing or profiling.

5. Cookies, Pixels & Tracking Technologies

We use first‑ and third‑party cookies, web beacons, local storage, and similar technologies to:

• Keep you signed in;
• Remember preferences;
• Measure site performance;
• Detect fraud.

5.1 Consent & Controls

• EU/UK users: non‑essential cookies are blocked until you click "Accept" on our banner; granular settings available.
• Global Privacy Control (GPC): honoured for U.S. state "Do Not Sell/Share" signals.
• Analytics opt‑out: install Google Analytics Opt‑out Add‑on.

Full details appear in our Cookie Policy.

6. How & With Whom We Share Data

A dedicated list of sub-processors, how we update it, and how to reach us about changes is published at flowdara.com/subprocessors.

7. Your Privacy Rights & How to Exercise Them

1. Access / Know
2. Correct / Rectify
3. Delete / Erase
4. Portability (machine‑readable JSON/CSV)
5. Restrict / Object
6. Opt‑out of marketing
7. Do Not Sell or Share – GPC signals accepted.
8. Appeal – If we decline your request, you may appeal within 45 days.

7.1 U.S. state laws; sensitive personal information

Residents of California and other states with comprehensive privacy laws may have rights regarding sensitive personal information, which can include certain health-related or wellness-related details submitted through intake forms, waivers, or similar features. Depending on your state, you may have the right to limit use or disclosure of sensitive information, to access or delete it, or to exercise other rights described in applicable law. Use the request channels below (for example Account → Privacy Dashboard or privacy@flowdara.com). We do not use sensitive personal information for cross-context behavioral advertising. We do not sell personal information as that term is commonly defined under U.S. state privacy laws (see also the Privacy Snapshot above).

Submit requests via Account → Privacy Dashboard or email privacy@flowdara.com with subject "Data Subject Request". We will verify identity (two‑factor challenge or signed request via logged‑in session) and respond within:

• 45 days (U.S. state laws) – extendable once by 45 days;
• 1 month (GDPR/UK GDPR) – extendable by 2 months for complexity.

If you believe we have not resolved your concern, you may lodge a complaint with your local supervisory authority (contact links provided in the Privacy Dashboard).

8. Security Measures

• Encryption – TLS 1.2+ in transit; AES‑256 at rest (Supabase & Azure).
• Access controls – role‑based, least‑privilege, MFA for all staff.
• Monitoring & audits – SOC‑2‑aligned controls, annual penetration tests, quarterly vulnerability scans.
• Incident response – 24×7 on‑call team, forensic logging, 72‑hour regulator & user notice window if breach likely to result in risk.
• PCI‑DSS – Stripe stores all card data; Flowdara never stores raw PAN.
• HIPAA – These measures are not offered as HIPAA Security Rule implementation, certification, or a business-associate compliance program. We do not sign BAAs.

9. Data Retention

We keep Personal Information only as long as necessary for the purposes described or as required by law:

• Active account – data retained while account open.
• Financial records – 7 years (tax & accounting).
• Support tickets & logs – 2 years.
• Marketing opt‑out lists – indefinitely (to honour opt‑out).

When retention expires, data is securely erased or anonymised within 60 days.

10. International Transfers

Personal data may be processed in the United States and Canada; backups may be stored in United Kingdom Azure regions. When we transfer personal data from the EEA, UK, or Switzerland to the United States or other countries, we use appropriate safeguards, including Standard Contractual Clauses (SCCs) and vendor data-processing agreements.

Data Privacy Framework (DPF). If Flowdara self-certifies to the EU-U.S. Data Privacy Framework, the UK Extension, and/or the Swiss-U.S. Data Privacy Framework, we will state that clearly on this Policy and link to our listing on the official Data Privacy Framework program site. Unless and until such certification is published in this Section, do not rely on the DPF as your transfer mechanism- SCCs and vendor DPAs apply. Supplementary measures include encryption, access logging, and sub-processor vetting.

11. Integrations & Limited‑Use Disclosure

If you connect Flowdara to Google Calendar™ or other OAuth providers, we will access calendar metadata solely to display availability and create events you ask us to create. Flowdara's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Humans do not read calendar content except with your explicit consent for support or security reasons.

12. Children

We do not knowingly collect data from children under 13 (COPPA). Parents who believe a child has provided us data may contact privacy@flowdara.com for immediate deletion. Minors aged 13–15 may use the Services only with verifiable parental consent; UK/EU users aged 13–16 require guardian consent per GDPR Article 8.

13. Changes to This Policy

Minor updates are posted at https://flowdara.com/privacy. Material changes (those that reduce your rights or expand processing) will be announced 30 days in advance via email and in‑app notices. Continued use after the effective date constitutes acceptance.

14. Contact & Data Protection Officer

Data Controller: Flowdara, Inc.
Privacy Office:
210 SW Century Dr., Bend, OR 97702, USA
✉︎ privacy@flowdara.com (preferred for all privacy and data-rights requests)

EU/UK representative details will be added prior to UK launch and will appear here.

For unresolved GDPR complaints you may contact the Irish Data Protection Commission or your local supervisory authority. If Flowdara participates in the Data Privacy Framework, we will link to the applicable DPF dispute-resolution and arbitration procedures from this Section when certification is published (see Section 10).