Privacy Policy

1. Who We Are

Next Step Wellness ("Next Step Wellness," "we," "us," or "our") provides remote bioenergetic testing and wellness education. SETUP REQUIRED: Add wording reviewed for Justine Hayes's credentials, location, licensing status, and scope of practice before publishing. This Privacy Policy applies to our website, booking process, client portal, communications, virtual review sessions, and related services (collectively, the "Services"). Questions or privacy requests may be sent to support@yourpractice.com.

2. Information We Collect

Information you provide

• Identity and contact information, including name, email address, telephone number, mailing address, and account credentials.
• Order and transaction information, including the service selected, client type, amounts paid, receipts, discounts, refunds or credits, and limited payment metadata. Payment card numbers are processed by Stripe or another payment processor and are not stored by us.
• Wellness and intake information, including date of birth, wellness history, symptoms or concerns, lifestyle, nutrition, supplements, goals, and other responses you choose to provide.
• Materials used to provide the Services, including a hair sample, a recent photograph, sample mailing or tracking details, appointment information, and communications with the practitioner.
• Client records created through the Services, including energetic testing results, reports, practitioner notes, balanced-product lists, imprinted-remedy information, and follow-up comparisons.
• Messages, contact-form submissions, survey responses, testimonials submitted with permission, and other communications.

Information collected automatically

When you use the website or portal, we and our service providers may collect device and usage information such as IP address, browser type, device type, operating system, pages viewed, referring pages, dates and times, approximate location derived from IP address, cookie identifiers, and security or diagnostic logs.

Information about children

A parent or legal guardian may purchase Services for a person under 18. The parent or guardian must create and control the account, provide the minor's information, upload any photograph, submit the sample, and consent to our handling of that information. The website and portal are directed to adults and are not intended for independent use by children under 13. We do not knowingly create accounts directly for children under 13. If you believe a child submitted information without appropriate parental authorization, contact us so we can review and delete it as required.

3. Consumer Health Information

Some information we handle may be considered consumer health data, sensitive personal information, or similar protected data under state law. This may include wellness-history responses, health-related concerns, photographs, testing results, reports, practitioner notes, and inferences drawn from those items.

We collect and use consumer health information only as reasonably necessary to provide the Services you request, communicate with you, maintain records, secure the Services, comply with law, and for other purposes to which you consent. We do not sell consumer health information. We do not use it for targeted advertising or disclose it to data brokers.

4. How We Use Information

• Create and maintain your account and authenticate access to the portal.
• Process orders and payments and provide receipts.
• Review your intake, perform remote QEST4 bioenergetic testing, prepare reports and notes, provide product or lifestyle information, mail any included imprint, and conduct follow-up services.
• Receive, identify, track, store temporarily, and dispose of mailed samples.
• Schedule and conduct virtual review appointments and send service-related notices.
• Operate secure messaging and respond to questions or support requests.
• Protect the Services, prevent fraud or misuse, troubleshoot errors, and maintain appropriate business records.
• Comply with legal obligations, enforce agreements, and establish or defend legal claims.
• Send optional news or promotional communications when permitted. You may unsubscribe at any time.

5. When We Disclose Information

We disclose information only as described below. We do not rent personal information or sell personal or consumer health information.

Service providers

We may provide information to vendors that host the website or portal, store files, process payments, deliver email or text notifications, support scheduling or video meetings, provide security and diagnostics, or otherwise operate the Services. Examples may include hosting providers, database or cloud-storage providers, Stripe, email-delivery providers, and Google Meet or another video-meeting service. These providers may process information only for the services they provide to us and under their own contractual and legal obligations.

At your direction

We may disclose information when you request or authorize us to do so, including when you ask us to send information to another person or professional. We will not treat a request to discuss wellness results as permission to disclose unrelated information.

Legal and safety purposes

We may disclose information when we reasonably believe disclosure is necessary to comply with law or valid legal process; protect the rights, safety, or property of you, us, or others; investigate fraud or security incidents; enforce our agreements; or establish, exercise, or defend legal claims.

Business transfers

If the practice is involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction, subject to appropriate confidentiality protections and applicable law.

6. Cookies and Similar Technologies

The website may use cookies and similar technologies that are necessary for sign-in, checkout, security, preferences, and basic analytics. You may control cookies through browser settings, but disabling necessary cookies may prevent account, portal, or checkout features from working. We do not knowingly permit third-party advertising trackers to collect consumer health information from authenticated portal pages.

7. Payment Processing

Payments are processed by Stripe or another third-party payment processor. The processor receives payment details and related transaction information under its own privacy policy. We generally receive confirmation, payment status, limited card details such as brand and last four digits, and billing or fraud-prevention information, but not the full card number or security code.

8. Hair Samples and Photographs

A hair sample and recent photograph are collected solely to perform and administer the requested Services. Unless a longer period is reasonably necessary to resolve a service issue or required by law, physical hair samples will be kept only as long as needed to complete the applicable testing and will then be securely discarded. Samples are not used for DNA sequencing, genetic testing, laboratory analysis, research, sale, or unrelated purposes. Submitted photographs are retained with the client record only as reasonably necessary for service delivery, follow-up comparison, recordkeeping, security, or legal compliance.

Mailing carries risks outside our control. Do not send original documents or irreplaceable items with a sample.

9. Retention

We retain personal information for only as long as reasonably necessary for the purposes described in this policy, including providing the purchased service, maintaining account and transaction records, responding to disputes, meeting tax and legal obligations, enforcing agreements, and maintaining security. Retention periods vary by record type. We may retain transaction and legal records after an account is closed. When information is no longer needed, we will delete, de-identify, or securely dispose of it, subject to backup cycles and legal holds.

10. Security

We use reasonable administrative, technical, and physical safeguards designed for the nature of the information we maintain. Measures may include encrypted transmission, access controls, password protection, restricted practitioner access, service-provider controls, and secure portal delivery rather than ordinary email attachments. No system, transmission, or storage method is completely secure, and we cannot guarantee absolute security. Keep your password confidential, use a unique password, log out of shared devices, and promptly notify us of suspected unauthorized access.

11. Data Breach Notice

If personal or consumer health information is affected by a security incident, we will investigate and provide notices to affected individuals, regulators, or others when and as required by applicable law, including applicable state breach-notification laws and the Federal Trade Commission Health Breach Notification Rule if that rule applies.

12. Your Privacy Choices and Rights

Depending on where you live and subject to legal exceptions, you may have the right to request access to or a copy of personal or consumer health information; request correction or deletion; withdraw consent for certain processing; obtain information about categories of information and recipients; appeal a denied request; or opt out of marketing, sale, sharing, or targeted advertising. We do not sell personal or consumer health information.

Submit a request to support@yourpractice.com. We may need to verify your identity and authority before acting. A parent or guardian may make a request for a minor. An authorized agent may be required to provide written authority. We will respond within the period required by applicable law. We will not discriminate against you for exercising a privacy right, although deleting information may make it impossible to continue providing a requested Service.

13. Consent and Withdrawal

When required, we rely on your consent to collect and use sensitive or consumer health information needed for the Services. You may withdraw consent by contacting us. Withdrawal does not affect processing already completed and may prevent us from completing a pending service. Our no-refund terms continue to apply except where law requires otherwise or where we agree in writing.

14. Email and Text Communications

We may send transactional communications about accounts, orders, samples, appointments, results, security, and policy updates. These are necessary to administer the Services and may continue while an account or order remains active. You may opt out of promotional email through the unsubscribe link or by contacting us. If text messaging is offered, message and data rates may apply and consent to promotional texts is not a condition of purchase.

15. Third Party Links and Services

The Services may link to third-party websites, products, supplements, video platforms, or resources. Their privacy practices are governed by their own policies. A reference or link does not mean we control or endorse the third party, and we are not responsible for its privacy, security, content, or practices.

16. HIPAA

Next Step Wellness provides non-medical wellness and educational services. Unless we notify you otherwise in writing, Next Step Wellness is not acting as a health plan, health care clearinghouse, or covered health care provider under the Health Insurance Portability and Accountability Act. HIPAA may therefore not govern information you submit to us. Other privacy, consumer-protection, security, and breach-notification laws may apply, and we handle information as described in this policy.

17. Visitors Outside the United States

The Services are operated from the United States and are intended for United States residents unless we agree otherwise in writing. If you access the Services from another country, information may be transferred to and processed in the United States, where privacy laws may differ from those in your location.

18. Changes to This Policy

We may update this Privacy Policy to reflect changes in the Services, vendors, or law. The revised policy will be posted with a new effective date. When required, we will provide additional notice or obtain consent. Continued use after an update is effective signifies acknowledgment of the revised policy, but does not replace consent where consent is legally required.

19. Contact Us

Privacy questions and requests may be sent to:

Next Step Wellness, Attn: Privacy — support@yourpractice.com — yourpractice.com/contact