Privacy Policy

---

At Cryo of The Woodlands ("we," "us," or "our"), we are committed to protecting your privacy and safeguarding your personal information. This Privacy Policy explains how we collect, use, disclose, and protect your information when you interact with our services, including our website, our wellness and recovery programs, and our mobile application ("App") available on Apple and Android devices.

This policy complies with applicable federal laws, including the Federal Trade Commission (FTC) Act and the FTC's Health Breach Notification Rule (where applicable), as well as Texas state laws, such as the Texas Data Privacy and Security Act (TDPSA). We incorporate best practices for data privacy, such as data minimization, transparency, consent for sensitive data, and robust security measures, to ensure the highest level of protection for your personal and sensitive data.

Please read this policy carefully. By using our services, website, or App, you consent to the practices described herein. If you do not agree, please do not use our services.

1. Information We Collect

We collect information to provide you with wellness and recovery services, manage your participation, and improve our offerings. We minimize data collection to only what is necessary and obtain consent where required, especially for sensitive data under TDPSA.

Categories of Information:

• Personal Information: Name, address, email, phone number, date of birth, gender, and other identifiers you provide when registering, scheduling sessions, or using our App.
• Sensitive Personal Data (under TDPSA): Wellness goals, recovery progress,      biometric data (e.g., from connected devices), health-related details, or other sensitive categories such as mental or physical health conditions. We require explicit consent before collecting or processing this data.
• Device and Usage Data: Automatically collected when using our App or website,      including IP address, device type, operating system, browser type, App usage logs, location data (with consent), and cookies or similar technologies for analytics.
• Payment Information: Billing details for services, processed securely through third-party providers.
• Other Data: Feedback, survey responses, or communications with our staff.

We do not collect information from children under 13 without verifiable parental consent, in compliance with the Children's Online Privacy Protection Act (COPPA). Our services are intended for adults.

2. How We Collect Information

• Directly from You: When you fill out forms, create an account on the App, participate in programs, or contact us.
• Automatically: Through cookies, log data, and tracking technologies on our website and      App. You can manage cookie preferences via your browser settings.
• From Third Parties: From connected devices (with your consent) or analytics      providers like Google Analytics.
• App-Specific: The App may request permissions for camera, location, or notifications to      enable features like virtual sessions or reminders. We limit permissions to essentials and explain their use.

3. How We Use Your Information

We use your information for legitimate purposes, with transparency and in compliance with TDPSA's processing requirements and FTC guidelines.

Purposes for Processing Personal Data:

• To provide wellness counseling, recovery support, track progress, and      coordinate services.
• To process payments and billing.
• For operational improvements, such as quality enhancement, staff training,      auditing, and App updates.
• To send communications like session reminders, program updates, or wellness      tips via email, text, or App notifications (you can opt out).
• To analyze usage patterns and improve our services, using de-identified data      where possible.
• For legal compliance, such as responding to subpoenas or reporting as required      by law.
• With your consent, for marketing to inform you about new services. We do not      sell your data for marketing without explicit opt-in.
• De-identified data may be used for research or analytics.

Under TDPSA, we process personal data only for the disclosed purposes above. We do not engage in automated profiling or targeted advertising without your consent. For sensitive personal data, we obtain your explicit consent prior to processing.

4. Sharing and Disclosure of Information

We share information only as necessary and with safeguards. We do not sell your personal data, as defined under TDPSA.

Categories of Personal Data Shared and Third Parties:

• With Service Providers: Categories such as personal identifiers, device data, and sensitive data (with consent) shared with third-party vendors (e.g., App developers, payment processors, cloud storage providers) bound by contracts ensuring data protection and compliance with TDPSA.
• With Your Consent: For sharing with family, other providers, or connected      apps.
• Legal Requirements: To comply with laws, court orders, or government requests.
• Emergencies: To protect health or safety.
• De-Identified Data: Aggregated, anonymized data for research or analytics, which is      not considered personal data.

Categories of third parties include: Service providers (e.g., IT and analytics firms), payment processors, and legal authorities (as required).

Under TDPSA, we recognize global privacy controls (e.g., opt-out preference signals) for opting out of any potential sales or targeted advertising (though we do not currently engage in these activities).

5. Your Rights Regarding Your Information

You have rights under TDPSA and other applicable laws. To exercise them, contact us using the details below. We respond to verified requests within 45 days (extendable as permitted).

• TDPSA Rights (for Texas Residents): 
  • Confirm whether we process your personal data and access it.
  • Correct inaccuracies in your personal data.
  • Delete your personal data.
  • Obtain a portable copy of your personal data.
  • Opt out of the sale of personal data, targeted advertising, or profiling in       furtherance of decisions that produce legal or similarly significant       effects.
  • Opt out of processing sensitive personal data.

If we deny a request, you may appeal by contacting us, and we will provide a response within 60 days.

• General Rights: Request restrictions on uses or disclosures; manage      communications preferences.
• App-Specific Rights: Uninstall the App to stop collection; manage permissions in      device settings.

We do not charge fees for reasonable requests.

6. Data Security

We implement administrative, physical, and technical safeguards to protect your information, following best practices and FTC guidelines.

• Encryption of data in transit and at rest.
• Access controls, firewalls, and regular security audits.
• Employee training on privacy and security.
• Secure authentication (e.g., passwords or biometrics for App login).
• Incident response plans, including breach notifications as required under the FTC's      Health Breach Notification Rule (if applicable to unsecured personal      health records).

Despite these measures, no system is 100% secure. We minimize risks but cannot guarantee absolute security. In the event of a breach involving personal health data, we will notify affected individuals and the FTC as required by law.

7. Data Retention

We retain information as long as necessary for the purposes described, or as required by law. When no longer needed, we securely delete or anonymize it in accordance with best practices.

8. Children's Privacy

Our services are not directed to children under 13. If we learn we have collected personal data from a child under 13 without verifiable parental consent, we will delete it promptly, in compliance with COPPA.

9. International Transfers

Your data is processed and stored in the United States. If transferred internationally, we ensure adequate protections through contracts or other mechanisms.

10. Changes to This Policy

We may update this policy to reflect changes in laws or practices. We will notify you via email, App notice, or website posting. Continued use after changes constitutes acceptance.