Privacy Policy

1.1 Scope

This Privacy Policy applies to all information collected through the Services, whether online, through our mobile apps, in person, by phone, or by email.

1.2 HIPAA Status

Balanced Naturopathics, LLC is not a "covered entity" or "business associate" under the Health Insurance Portability and Accountability Act (HIPAA). Information you share with us is not "protected health information" (PHI) as defined under HIPAA and is not governed by HIPAA.

1.3 Consumer Health Data Laws

Although HIPAA does not apply, several U.S. state laws regulate consumer health data collected by non-HIPAA companies, including Washington's My Health My Data Act, Nevada's SB 370, and health data provisions of the Connecticut Data Privacy Act. We handle consumer health information in accordance with these laws where applicable, including obtaining consent before collecting, using, or sharing health data where required.

1.4 Commercially Reasonable Safeguards

We apply commercially reasonable administrative, technical, and physical safeguards to protect the information we collect, regardless of whether a specific law requires it.

2.1 Information You Provide Directly

Identifiers and Contact Information:

• Full name
• Email address
• Mailing and shipping addresses
• Phone number (for SMS opt-in, support, or delivery)
• Date of birth (where age verification is required)
• Account login credentials (username, hashed password)

Commercial Information (Rhizomatic Gardens):

• Purchase history and order details
• Billing address
• Payment method tokens (actual card numbers are not stored on our servers; they are processed by PCI-compliant third parties such as Stripe, Shopify Payments, and PayPal)
• Product preferences, wish lists, subscription selections

Health and Wellness Information (My Deficiencies App, Balanced Naturopathics consulting/coaching):

• Medications you input
• Supplements and vitamins you input
• Symptoms, lifestyle factors, sleep patterns, diet, and other self-reported health data
• Intake form responses
• Coaching notes and consultation summaries (Balanced Naturopathics only)
• Insights and outputs generated by the My Deficiencies App based on your inputs

Content You Submit:

• Reviews, testimonials, ratings
• Messages through contact forms or support channels
• Community posts, comments, uploads
• User-generated content such as photos or stories (where applicable)

2.2 Information Collected Automatically

Device and Usage Data:

• IP address
• Browser type, version, and language
• Operating system and device model
• Device identifiers (for the App)
• Pages visited, features used, time spent
• Referring URLs and clickstream data
• App crash and performance logs

Location Data:

• Approximate location derived from IP address
• Precise location only if you grant the App explicit permission (currently not used; reserved for future features)

Cookies and Similar Technologies:

See Section 6 for details.

2.3 Information from Third Parties

• Payment processors (order confirmation, fraud signals)
• Shipping carriers (tracking status)
• Email service providers (delivery, open, and click data)
• Analytics providers (aggregated usage patterns)
• Social media platforms (if you connect an account or interact with our pages)

3.1 Categories of Sensitive Information

Certain information we collect is classified as "sensitive personal information" under state privacy laws, including:

• Health and medication information you enter into the My Deficiencies App
• Health data shared during Balanced Naturopathics coaching or consulting
• Precise geolocation (not currently collected)
• Account login credentials

3.2 Explicit Consent Required

We collect sensitive personal information only with your explicit, opt-in consent. You may withdraw consent at any time by contacting privacy@balancednaturopathics.com or by deleting your account.

3.3 Limited Use

We use sensitive personal information only for the purposes you consented to, such as generating App outputs, delivering coaching, or fulfilling a consulting engagement. We do not use sensitive personal information for advertising, profiling outside the intended purpose, or any secondary use without additional consent.

3.4 No Sale or Sharing for Advertising

We do not sell sensitive personal information. We do not share sensitive personal information for cross-context behavioral advertising.

We use collected information to:

4.1 Provide the Services

• Create and manage your account
• Process, fulfill, and deliver orders
• Deliver coaching, consulting, and course content
• Generate and deliver App outputs based on your inputs
• Authenticate users and prevent unauthorized access

4.2 Communicate With You

• Send transactional messages (order confirmations, shipping notifications, subscription reminders, password resets)
• Respond to support requests
• Send marketing communications you have opted into
• Send service announcements and material updates to this policy

4.3 Improve the Services

• Analyze usage patterns to improve features and performance
• Diagnose and fix technical issues
• Develop new products, features, and content
• Conduct research and aggregate analysis (using de-identified or aggregated data only)

4.4 Protect the Services and Users

• Detect, prevent, and respond to fraud, abuse, security incidents, and unlawful activity
• Enforce our Terms and Conditions
• Verify compliance with age requirements

4.5 Meet Legal Obligations

• Comply with tax, accounting, FDA, FTC, and other regulatory requirements
• Respond to lawful requests from courts, regulators, and law enforcement
• Establish, exercise, or defend legal claims

4.6 No Automated Decision-Making With Legal Effect

We do not use automated decision-making, including profiling, in a way that produces legal or similarly significant effects on you.

Where applicable, we rely on the following legal bases:

• Performance of a contract (fulfilling your order, providing App features you requested)
• Consent (marketing emails, SMS, sensitive health data)
• Legitimate interests (improving Services, preventing fraud, securing our systems)
• Legal obligations (tax, regulatory compliance)

You may withdraw consent at any time for processing based on consent. Withdrawal does not affect prior lawful processing.

6.1 Types of Technologies

We use cookies, pixels, software development kits (SDKs), local storage, and similar technologies to:

• Operate the website and App (strictly necessary)
• Remember your preferences (functional)
• Measure traffic and performance (analytics)
• Deliver relevant marketing (advertising, with consent where required)

6.2 Analytics Providers

We currently use one or more of: Google Analytics, Shopify Analytics, Meta Pixel, and similar tools. Providers and tools may change; a current list is available on request.

6.3 Your Choices

• Browser settings: most browsers let you block or delete cookies.
• Mobile device settings: you can reset your advertising identifier or limit ad tracking.
• Opt-out tools: Google Analytics Opt-Out Browser Add-on, Digital Advertising Alliance opt-out page.
• Global Privacy Control (GPC): we honor GPC signals where required by law as an opt-out of sale or sharing.

6.4 Do Not Track

Most browsers offer a "Do Not Track" signal. Because there is no industry consensus on how to interpret it, we do not currently respond to Do Not Track signals. We honor Global Privacy Control instead.

We share information only as described below. We do not sell personal information for money. We do not share sensitive personal information for cross-context behavioral advertising.

7.1 Service Providers

We share information with vendors and contractors who perform services on our behalf, including:

• Payment processors (Stripe, Shopify Payments, PayPal)
• E-commerce platform (Shopify)
• Subscription management (Shopify Subscriptions)
• Shipping carriers (USPS, UPS)
• Cloud hosting providers
• Email service providers (for transactional and marketing email)
• SMS providers (for opt-in text messaging)
• Analytics providers
• Customer support tools
• Fraud prevention services
• Legal, accounting, and tax advisors

Service providers are contractually bound to use information only for the purposes we specify and to maintain appropriate safeguards.

7.2 Healthcare and Wellness Partners

We share health-related information with partners (for example, a naturopathic practitioner collaborating on a program) only with your explicit, prior consent and only to the extent necessary for the collaboration.

7.3 Legal and Safety

We may disclose information when we believe in good faith that disclosure is necessary to:

• Comply with applicable law, regulation, subpoena, court order, or other legal process
• Enforce our Terms and Conditions
• Protect the rights, property, or safety of Balanced Naturopathics, our users, or others
• Detect, prevent, or respond to fraud, security, or technical issues

7.4 Business Transfers

If Balanced Naturopathics is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our assets, your information may be transferred to the successor entity. We will notify you of any such transfer and any material change in how your information will be handled.

7.5 Aggregated or De-Identified Information

We may share aggregated or de-identified information that cannot reasonably be used to identify you for any lawful purpose.

7.6 With Your Direction

We share information at your direction, such as when you publicly post a review, share a referral link, or connect a third-party integration.

We retain information only as long as necessary for the purposes described in this Privacy Policy or as required by law.

8.1 Retention Periods

• Account information: until you close your account, plus a reasonable wind-down period.
• Order and transaction records: at least seven (7) years for tax and accounting purposes.
• Health and consultation data: only as long as needed to provide services, plus a brief archival period, unless you withdraw consent earlier.
• App-generated health inputs: stored until you delete them or your account, whichever is earlier.
• Marketing communications data: until you unsubscribe.
• Security logs and fraud-prevention records: up to two (2) years, or longer where legally required.
• Support communications: up to three (3) years.

8.2 Deletion and Anonymization

When retention periods end and no legal hold or lawful retention reason applies, we securely delete or anonymize the information.

9.1 Safeguards

We apply commercially reasonable administrative, technical, and physical safeguards, including:

• Encryption of data in transit using TLS
• Encryption of data at rest for sensitive systems
• Role-based access controls
• Multi-factor authentication for administrative accounts
• Regular review of access permissions
• Vendor security assessments for providers handling personal information
• Incident response procedures

9.2 No Perfect Security

No system is perfectly secure. Despite our safeguards, we cannot guarantee absolute security. You are responsible for protecting your account credentials and for using a strong, unique password.

9.3 Breach Notification

If a security incident compromises personal information, we will notify affected users and regulators as required by applicable law, including North Carolina's Identity Theft Protection Act (N.C. Gen. Stat. § 75-65) and similar laws in other states where affected users reside.

10.1 General Rule

Our Services are not directed to children under 18. We do not knowingly collect personal information from children under 18.

10.2 COPPA

Our Services are not directed to children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected information from a child under 13 without verifiable parental consent, we will delete it promptly.

10.3 Parental Requests

A parent or legal guardian who believes we may have collected information from a child may contact privacy@balancednaturopathics.com to request review or deletion.

Depending on where you live, you may have the following rights regarding your personal information.

11.1 Rights Available to All U.S. Users

You may:

• Request access to a copy of the personal information we hold about you.
• Request correction of inaccurate information.
• Request deletion of your information, subject to lawful exceptions (e.g., completed transactions retained for tax purposes, security logs, legal holds).
• Opt out of marketing emails using the unsubscribe link in any marketing email.
• Opt out of SMS marketing by replying STOP to any text message.
• Withdraw consent for processing based on consent, including sensitive health data.

11.2 California Residents (CCPA/CPRA)

In addition to the rights above, California residents may:

• Request to know categories and specific pieces of personal information collected, sources, purposes, and recipients.
• Request deletion of personal information subject to statutory exceptions.
• Request correction of inaccurate information.
• Opt out of "sale" or "sharing" for cross-context behavioral advertising (we do not sell or share as defined).
• Limit use of sensitive personal information to specified permitted purposes.
• Exercise rights through an authorized agent.
• Not be discriminated against for exercising rights.
• Receive this notice annually (available at any time on our website).

11.3 Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and Other State Residents

Residents of states with comprehensive privacy laws may have rights similar to California, including access, correction, deletion, portability, and opt-out of targeted advertising, sale, and certain profiling. We honor these rights in accordance with the applicable state law.

11.4 Washington Residents (My Health My Data Act)

Washington residents may exercise additional rights regarding consumer health data, including the right to withdraw consent, request deletion of health data, and receive a list of third parties with whom health data has been shared.

11.5 Nevada Residents

Nevada residents may submit a verified request to opt out of the "sale" of covered personal information as defined under Nevada SB 370.

11.6 How to Exercise Your Rights

Submit a request by:

• Email: privacy@balancednaturopathics.com
• Mail: Balanced Naturopathics, LLC, P.O. Box 6803, 8323 Linville Road, Oak Ridge, NC 27310

We will verify your identity by confirming information we already have on file. We do not ask for sensitive documents (such as government IDs) unless strictly necessary for verification.

11.7 Response Timeframes

We respond to verifiable requests within forty-five (45) days, extendable by an additional forty-five (45) days where reasonably necessary, with notice to you.

11.8 Authorized Agents

You may designate an authorized agent to make a request on your behalf. We will verify the agent's authority and may contact you to confirm.

11.9 Appeals

If we deny a request, you may appeal by replying to our response or emailing privacy@balancednaturopathics.com with "Privacy Appeal" in the subject line. We will respond to appeals within the timeframes required by your state's law. If your appeal is denied, you may contact your state Attorney General.

11.10 Non-Discrimination

We do not deny, charge different prices for, or provide a different level or quality of the Services because you exercise a privacy right, except where permitted by law (for example, financial incentives offered in exchange for opt-in data use).

12.1 Email

We send marketing emails only to users who have opted in. Every marketing email includes an unsubscribe link. We honor unsubscribe requests within ten (10) business days as required by the CAN-SPAM Act. Transactional emails (order confirmations, shipping updates, subscription notices) are not governed by unsubscribe preferences and continue until your account or subscription is closed.

12.2 SMS and Text Messages

If you opt in to SMS marketing, you agree to receive automated marketing text messages from us. Consent is not a condition of purchase. Message and data rates may apply. Message frequency varies. Reply HELP for help. Reply STOP to unsubscribe. We comply with the Telephone Consumer Protection Act (TCPA).

12.3 Push Notifications

If you enable push notifications in the My Deficiencies App, you may disable them in your device settings at any time.

12.4 Direct Mail and Phone

We do not currently market by direct mail or telephone. If we begin, this Privacy Policy will be updated.

The Services are operated from the United States. Information is stored and processed in the United States. If you access the Services from outside the United States, your information will be transferred to, stored in, and processed in the United States, which may not provide the same level of protection as your home country. By using the Services, you consent to this transfer.

We currently ship physical products only within the United States.

14.1 How We Notify You

We may update this Privacy Policy from time to time. The "Last Updated" date at the top reflects the most recent revision.

14.2 Material Changes

If updates are material, we will notify you by:

• Email to the address on your account,
• In-app notice within the My Deficiencies App, or
• Prominent notice on the website.

14.3 Effective Date

Material changes take effect no earlier than fourteen (14) days after notice, unless a shorter period is required by law.

14.4 Your Choices

If you do not agree with material changes, you may stop using the Services, delete your account, and exercise your deletion rights before the changes take effect.

This Privacy Policy is governed by the laws of the State of North Carolina, United States, without regard to its conflict of laws principles, except where a U.S. state privacy law grants the user greater rights, in which case that law applies to that user's information.

We are committed to making this Privacy Policy accessible. If you experience difficulty accessing or reading this Privacy Policy, or need it in an alternative format, contact privacy@balancednaturopathics.com and we will accommodate requests within a commercially reasonable time.

We do not sell personal information for money. We do not share personal information for cross-context behavioral advertising without consent where required. To submit a "Do Not Sell or Share My Personal Information" request (required by California and other states), email privacy@balancednaturopathics.com with "Do Not Sell or Share" in the subject line, or use any opt-out mechanism provided on our website.

California Civil Code Section 1798.83 permits California residents who have an established business relationship with us to request certain information about our disclosure of personal information to third parties for their direct marketing purposes. We do not share personal information with third parties for their direct marketing purposes. To make a request, email privacy@balancednaturopathics.com.

If you have a complaint about our privacy practices:

• Contact us first at privacy@balancednaturopathics.com. We aim to resolve complaints directly.
• You may also contact your state Attorney General.
• California residents may contact the California Privacy Protection Agency at cppa.ca.gov.
• Federal concerns may be directed to the Federal Trade Commission at ftc.gov.

For privacy questions, requests, or complaints: