Legal
Privacy Policy
Pending legal review
This document is a working placeholder. It describes what the application actually does with your information, but it has not been reviewed by a lawyer and should not be treated as a final policy or as compliant with any particular regulatory framework.
Last updated: [DATE]
This policy explains what Xtheory collects when you book an appointment or contact us, why we collect it, and what we do with it.
What we collect
When you book a scan, we ask for:
- Your name, email address and mobile phone number
- Your date of birth
- Optional context — your primary goal, how you heard about us, and whether you would like to hear about coaching
- Answers to a short pre-scan screening questionnaire, and your acknowledgement of the consent statements shown during booking
We also record the appointment itself: the service, date, time and its status. Payment is processed by Stripe. We store Stripe’s identifiers, the amount, the currency and the payment status. We never see or store your card details.
When you use our contact form we store the name, email address, optional phone number and message you submit.
Why we collect it
- To schedule, confirm and deliver your appointment
- To take payment and reconcile it against your booking
- To send transactional email: confirmations, reschedules, cancellations and reminders
- To make your appointment available to you through a private manage-booking link
- To answer questions you send us
If you tell us you are interested in coaching, we record that against your booking so we can raise it during your review. It does not sign you up to anything.
Who we share it with
We use a small number of processors, each for a specific purpose: Supabase (database and authentication), Stripe (payments), Cloudflare (bot protection on our forms), Vercel (hosting) and our transactional email provider. We do not sell your information, and we do not share it for advertising.
How long we keep it
[PLACEHOLDER — retention periods pending confirmation.] Appointment and payment records are retained for as long as we need them for business and accounting purposes.
Your manage-booking link
Your confirmation email contains a private link to your appointment. Anyone holding that link can view, reschedule or cancel that booking, so treat it as you would a password. The link contains a random token; we store only a cryptographic hash of it, which means we cannot recover the link for you if it is lost — contact us instead and we will help.
Your choices
[PLACEHOLDER — pending legal review of applicable rights, including under the California Consumer Privacy Act.] To ask what we hold about you, to correct it, or to ask us to delete it, contact us at [hello@example.com].
Health information
The screening answers collected during booking exist so we can confirm a scan is appropriate for you on the day. Xtheory is not a medical provider, and this service is not medical care. [PLACEHOLDER — the applicability of health-information regulation to this service has not been determined. Do not represent this policy as HIPAA compliant until that has been assessed by a qualified professional.]
Contact
Questions about this policy: [hello@example.com] — Xtheory Walnut Creek, [Xtheory Walnut Creek Address], Walnut Creek, CA [ZIP].