Privacy Policy

1. Introduction

HolisticCare (“Company,” “we,” “us,” or “our”) is an AI-driven wellness and wellbeing platform operated by HOLISTICCARE A MEDICAL CORPORATION, a [STATE] [corporation/LLC] with its principal place of business at [ADDRESS] (“HolisticCare,” “we,” “us,” or “our”). We provide digital wellness tools, AI wellness and wellbeing coaching, clinical guidance by practitioners, and community features to individuals (“End Users,” “you,” or “your”) through our web application and mobile applications (collectively, the “Platform”).

This Privacy Policy describes how we collect, use, disclose, and protect your personal information and, where applicable, your Protected Health Information (“PHI”) when you access or use the Platform. It applies to:

  • Individual subscribers who sign up directly (B2C);
  • Employees or members who access the Platform through an organization that has licensed the Platform (B2B licensees); and
  • Patients referred to the Platform by a partner healthcare practice or physician.

Please read this Privacy Policy carefully. By creating an account or using the Platform, you acknowledge that you have read and understood this policy.

2. Information We Collect

2.1 Information You Provide Directly

We collect information that you voluntarily provide when you register, set up your profile, or use features of the Platform:

  • Identity data: full name, email address, mobile number, date of birth, gender, and profile photo.
  • Account credentials: password (stored in hashed form) and authentication tokens.
  • Wellness and Wellbeing data: health goals, medical conditions you choose to disclose, medications, allergies, dietary preferences, fitness levels, and wellness program participation records.
  • Biometric and activity data: exercise logs, sleep tracking entries, weight, heart rate, and other self-reported measurements.
  • Mental health and behavioral data: mood check-ins, stress levels, mindfulness session logs, and journal entries you choose to record.
  • Communications: messages sent through the AI Wellness and Wellbeing Coach chat, telehealth consultation notes (transcribed by the Platform), feedback submissions, and support requests.
  • Payment information: billing name, address, and payment card details (processed by our payment processor, Stripe; we do not store raw card numbers).

2.2 Information Collected Automatically

When you use the Platform, we automatically collect certain technical information:

  • Device and usage data: device type, operating system, app version, browser type, IP address, and general location (city/country level unless you grant precise location access).
  • Log data: pages viewed, features accessed, session duration, clicks, and error logs.
  • Analytics and performance data: aggregated usage patterns used to improve the Platform (collected through Azure Application Insights and similar tools).
  • Cookies and similar technologies: session tokens, preference cookies, and analytics identifiers. See our Cookie Policy for details.

2.3 Information from Third Parties

We may receive information from:

  • Your employer or sponsoring organization or clinic (if you access the Platform as a B2B licensee): your name, email address, and enrollment status.
  • EHR data: medical conditions, medications, allergies, clinical appointments.
  • Healthcare partners or referring physicians: referral information and, where you have consented, relevant clinical context.
  • Integrated third-party health platforms or wearables: fitness data from devices you connect (e.g., Apple Health, Google Fit, fitness trackers), subject to your consent at the time of connection.

3. How We Use Your Information

We use the information we collect for the following purposes:

3.1 Providing and Personalizing the Platform

  • Creating and managing your account;
  • Delivering AI-powered wellness and wellbeing coaching, wellness program content, and personalized recommendations;
  • Generating predictive wellness insights and trend analysis;
  • Enabling voice note transcription and AI-assisted visit preparation;
  • Facilitating community features, group programs, and social engagement tools;
  • Processing payments and managing subscriptions.

3.2 HIPAA-Related Purposes (where applicable)

Where HolisticCare functions as a Covered Entity or Business Associate under HIPAA, we may use or disclose your PHI for Treatment, Payment, and Health Care Operations (“TPO”) as described in our Notice of Privacy Practices, which is incorporated herein by reference.

3.3 Communications

  • Sending appointment reminders, wellness tips, program updates, and push notifications (where you have enabled them);
  • Responding to support inquiries and feedback;
  • Sending administrative notices (e.g., changes to terms, security alerts).

3.4 Analytics, Research, and Improvement

  • Analyzing aggregated, de-identified usage data to improve Platform features and content;
  • Training and improving our AI models using de-identified data only, subject to the restrictions described in Section 5;
  • Conducting internal research and quality assurance.

3.5 Legal and Safety Purposes

  • Complying with applicable law, regulations, and legal process;
  • Enforcing our Terms & Conditions and other agreements;
  • Detecting and preventing fraud, abuse, and security incidents;
  • Protecting the rights, safety, and property of HolisticCare, our users, and the public.

4. Legal Bases for Processing (where applicable)

Where applicable law (e.g., GDPR for users in the European Economic Area) requires a legal basis for processing, we rely on the following:

  • Contract performance: processing necessary to provide the Platform services you have requested.
  • Legitimate interests: improving the Platform, detecting fraud, and ensuring security.
  • Legal obligation: complying with HIPAA, applicable state health privacy laws, and other legal requirements.
  • Consent: where required (e.g., for certain marketing communications or sensitive health data categories), we obtain your explicit consent.

5. How We Share Your Information

We do not sell your personal information or PHI. We may share information in the following circumstances:

5.1 Service Providers

We share information with trusted third-party vendors who process data on our behalf under contractual data protection obligations, including:

  • Microsoft Azure (cloud infrastructure, AI services, communication services);
  • Stripe (payment processing);
  • Firebase / Google (push notification delivery);
  • Vimeo (wellness video content delivery);
  • Analytics and monitoring providers.

Where these providers may access PHI, we execute Business Associate Agreements (“BAAs”) as required by HIPAA.

5.2 Your Employer or Sponsoring Organization or Clinic (B2B Users)

If you access the Platform through an employer or organization license, your employer or organization may receive aggregated, de-identified reports (e.g., program participation rates, wellness outcome trends). We will not share individually identifiable health information with your employer without your explicit consent, except as permitted by law.

5.3 Healthcare Partners

If you are referred by or affiliated with a partner healthcare practice, we may share relevant wellness data with that practice to support coordinated care, subject to your consent or as permitted under HIPAA.

5.4 Legal Requirements

We may disclose information where required by law, court order, or government authority, or where we reasonably believe disclosure is necessary to protect safety or prevent harm.

5.5 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of our assets, your information may be transferred as part of that transaction. We will provide notice before your information is subject to a different privacy policy.

6. Protected Health Information (PHI) and HIPAA

To the extent that the Platform functions as a HIPAA-regulated service, we comply with the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and its implementing regulations, including the Privacy Rule (45 CFR Part 164), Security Rule, and Breach Notification Rule.

A separate HIPAA Notice of Privacy Practices (“NPP”) describes your rights with respect to PHI and our obligations. The NPP is available at [URL] and is incorporated into this Privacy Policy.

Key HIPAA rights include: the right to access and receive a copy of your PHI; the right to request amendment of PHI; the right to an accounting of disclosures; the right to request restrictions; and the right to file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights.

7. AI Features and Health Data

The Platform uses artificial intelligence (including Azure OpenAI services) to power the AI Wellness and WellbeingCoach, predictive insights, voice transcription, and personalized recommendations. Key disclosures:

  • AI-generated content is for informational and wellness support purposes only and does not constitute medical advice, diagnosis, or treatment.
  • Voice notes are transcribed using automated speech-to-text technology. Transcripts are stored as part of your account and may be reviewed by you and, where applicable, your healthcare provider.
  • We use de-identified and aggregated data to improve our AI models. We do not use individually identifiable PHI to train models without your explicit authorization.
  • AI interactions are logged for safety, quality assurance, and HIPAA audit purposes.

8. Data Security

We implement administrative, technical, and physical safeguards designed to protect your information, including:

  • Encryption at rest (Azure SQL Transparent Data Encryption, Azure Blob Storage encryption);
  • Encryption in transit (TLS 1.2 or higher across all endpoints);
  • Role-based access controls and multi-factor authentication for internal systems;
  • Azure Key Vault for secrets management;
  • Audit logging of all access to PHI;
  • Regular security assessments and penetration testing (scheduled prior to go-live).

Despite these measures, no system is completely secure. If you believe your account has been compromised, contact us immediately at [SECURITY EMAIL].

9. Data Retention

We retain your personal information and PHI for as long as your account is active and as necessary to provide services, comply with legal obligations, resolve disputes, and enforce agreements. Specific retention periods:

  • Account and profile data: retained for the duration of the account and [X] years following account closure.
  • PHI: retained in accordance with HIPAA minimum necessary standards and applicable state medical records retention laws (typically a minimum of 6 years from creation or last use under HIPAA, longer under some state laws).
  • Financial and transaction records: [7] years in accordance with applicable law.
  • De-identified analytics data: may be retained indefinitely.

Upon a verified deletion request, we will delete or de-identify your personal data within [30/45/60] days, subject to legal retention obligations.

10. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal information:

  • Access: request a copy of the personal information we hold about you.
  • Correction: request correction of inaccurate or incomplete information.
  • Deletion: request deletion of your personal information, subject to legal retention obligations.
  • Portability: request a machine-readable copy of your data.
  • Restriction: request that we restrict processing in certain circumstances.
  • Objection: object to processing based on legitimate interests or for direct marketing.
  • Withdraw consent: where processing is based on consent, withdraw it at any time without affecting prior processing.

California residents may have additional rights under the CCPA/CPRA, including the right to opt out of the sale or sharing of personal information (we do not sell personal information) and the right to limit use of sensitive personal information.

To exercise your rights, contact us at: [PRIVACY EMAIL] or [MAILING ADDRESS]. We will respond within the timeframe required by applicable law (typically 30–45 days).

11. Children’s Privacy

The Platform is not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If we learn that we have inadvertently collected such information, we will delete it promptly. If you believe a minor has provided us with personal information, please contact us at [PRIVACY EMAIL].

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email, in-app notification, or a prominent notice on the Platform prior to the change taking effect. The “Effective Date” at the top of this policy reflects the date of the most recent revision. Your continued use of the Platform after the effective date constitutes acceptance of the updated policy.

13. Contact Us

For privacy-related inquiries, to exercise your rights, or to file a complaint:

  • Email: [PRIVACY EMAIL]
  • Mailing address: HOLISTICCARE A MEDICAL CORPORATION, Attn: Privacy Officer, [ADDRESS]
  • To file a HIPAA complaint with the U.S. Department of Health and Human Services: https://www.hhs.gov/hipaa/filing-a-complaint/

Last Updated : 17-Sep-2026

1. Introduction and Scope

This Organization Administrator Privacy Policy (“Policy”) governs the collection, use, and disclosure of information relating to Organization Administrators (“Org Admins,” “you,” or “your”) who manage an organization’s deployment of the HolisticCare platform (“Platform”) on behalf of a licensed employer, health plan, healthcare practice, or other enterprise client (“Organization”).

This Policy supplements the End User Privacy Policy and should be read alongside it. To the extent there is a conflict between this Policy and the End User Privacy Policy as applied to Org Admin activities, this Policy governs.

By accepting the Organization Administrator Terms & Conditions and accessing the admin console, you acknowledge that you have read and understood this Policy.

2. Information We Collect About Organization Administrators

2.1 Identity and Professional Information

  • Full name, job title, and business email address;
  • Organization name, industry classification, and billing contact details;
  • IP address and device information associated with admin console access.

2.2 Administrative Activity Data

  • User management actions: accounts created, modified, or deactivated; bulk import records;
  • Content moderation decisions: approvals, rejections, or flags of organizational content, surveys, or communications;
  • Configuration changes: program settings, role assignments, feature toggles;
  • Audit logs: all admin console actions are timestamped and logged for compliance and security purposes.

2.3 Organizational User Data (Accessed in Admin Role)

In your capacity as Org Admin, you may access certain information about end users within your organization’s tenant, including:

  • User enrollment status and account status;
  • Program participation rates and wellness engagement metrics (aggregated and, where your role and the Platform configuration permits, individual-level);
  • Survey responses and contest results created by your organization;
  • De-identified or aggregated analytics and reporting data.

Your access to individually identifiable end-user health information is governed by the role-based access controls configured for your organization and the Business Associate Agreement (“BAA”) between HolisticCare and your Organization.

3. How We Use Org Admin Information

We use Org Admin information for the following purposes:

  • Authenticating and authorizing your access to the admin console;
  • Enabling you to manage users, content, surveys, and organizational programs within your tenant;
  • Generating organizational analytics and reporting for your Organization;
  • Maintaining audit logs required by HIPAA and our security obligations;
  • Providing technical support and account management;
  • Billing and subscription management;
  • Enforcing the Organization Administrator Terms & Conditions;
  • Detecting and preventing unauthorized access, fraud, and misuse.

4. Multi-Tenant Architecture and Tenant Isolation

The Platform operates as a multi-tenant SaaS system. Each Organization’s data is logically isolated within a dedicated tenant. HolisticCare maintains technical controls to prevent cross-tenant data access, including row-level security on all database tables.

As Org Admin, your access is scoped to your Organization’s tenant only. You will not have access to data belonging to other organizations on the Platform. HolisticCare platform administrators (Super Admins) may access your tenant’s data for legitimate operational, support, and compliance purposes, and such access is audit-logged.

5. HIPAA Obligations and Business Associate Agreement

Where your Organization is a Covered Entity or Business Associate under HIPAA, HolisticCare will enter into a Business Associate Agreement (“BAA”) with your Organization prior to enabling access to PHI. The BAA governs:

  • The permitted uses and disclosures of PHI by HolisticCare on behalf of your Organization;
  • HolisticCare’s obligations to safeguard PHI using the safeguards described in this Policy and the End User Privacy Policy;
  • Breach notification obligations and timelines;
  • Your Organization’s obligations as the Covered Entity or upstream Business Associate.

Org Admins are responsible for ensuring that their use of the admin console and access to user data complies with the BAA and HIPAA. Org Admins must not access, export, or use PHI beyond the scope permitted by the BAA and applicable law.

6. Data Shared with Your Organization

HolisticCare provides the following categories of data to your Organization through the admin console and reporting features:

  • Aggregated wellness and program engagement metrics (de-identified, at population level);
  • Individual user participation records (to the extent permitted by the BAA and your Organization’s configured access controls);
  • Survey and contest results;
  • Administrative audit logs (scoped to your tenant).

HolisticCare does not share individually identifiable health information with your Organization beyond what is permitted by the applicable BAA and consented to by the end user, except as required by law.

7. Org Admin Responsibilities

As an Org Admin, you are responsible for:

  • Ensuring that your Organization’s use of the Platform complies with all applicable laws, including HIPAA, applicable state health privacy laws, and employment laws governing employee wellness programs;
  • Obtaining any required employee or member consents before deploying wellness programs that collect health information;
  • Maintaining the confidentiality of your admin credentials and promptly reporting any unauthorized access or suspected breach to HolisticCare at [SECURITY EMAIL];
  • Ensuring that user data accessed through the admin console is used only for legitimate, authorized organizational wellness management purposes;
  • Deactivating accounts of departing employees promptly;
  • Complying with ADA, GINA, ERISA, and other regulations applicable to employer-sponsored wellness programs.

8. Data Retention — Org Admin Data

Admin console audit logs are retained for a minimum of [6] years in accordance with HIPAA record-keeping requirements. Org Admin account data is retained for the duration of the Organization’s license agreement and [X] years thereafter. Upon termination of the Organization’s agreement, HolisticCare will follow the data return and destruction procedures specified in the BAA and Organization Agreement.

9. Security

HolisticCare implements the same technical and organizational security measures described in the End User Privacy Policy for admin console access, with additional controls:

  • Admin console access is controlled via Multi Factor Authentication (MFA) with role-based access controls;
  • Multi-factor authentication is required for all Org Admin accounts;
  • All admin actions are audit-logged and monitored;
  • Admin sessions are subject to timeout and re-authentication requirements.

10. Org Admin Rights

In your personal capacity as an individual, you retain the same privacy rights described in the End User Privacy Policy with respect to your own personal information held by HolisticCare. To exercise those rights, contact us at [PRIVACY EMAIL].

With respect to data processed on behalf of your Organization, rights requests relating to end-user data should be directed to your Organization as the data controller, which is responsible for responding to such requests under applicable law. HolisticCare will assist your Organization in responding to end-user rights requests as required by the BAA and applicable law.

11. Changes to This Policy

We may update this Policy from time to time. Material changes will be communicated to the designated admin contact for your Organization by email at least [30] days before taking effect. Continued use of the admin console after the effective date constitutes acceptance.

12. Contact Us

  • Email: [PRIVACY EMAIL]
  • Mailing address: HOLISTICCARE A MEDICAL CORPORATION, Attn: Privacy Officer, [ADDRESS]

Last Updated : 17-Sep-2026

Last Updated : 16-Dec-2025

HolisticCare (“we”, “our”, or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and safeguard your information when you access or use our website and mobile applications (collectively, the “Services”).

By using HolisticCare, you agree to the practices described in this Privacy Policy.

1. Information We Collect 

We collect information that helps us provide secure access, personalized wellness experiences, and a reliable platform.

Information You Provide : When you create an account or interact with our Services, you may provide personal information such as your email address for account creation and OTP-based login, optional profile details, and any feedback, survey responses, or support requests you submit.

Information Collected Automatically : To maintain security and improve platform performance, we automatically collect certain technical information. This may include your device type, operating system, browser type, IP address for security validation, and usage data for analytics and service improvement.

Authentication and Security Information : To secure your account and prevent unauthorized access, we process authentication-related data such as OTP verification attempts, encrypted token information, session expiration timestamps, and device or session activity logs. These security mechanisms are implemented using enterprise-grade cloud infrastructure and modern authentication standards.

Wellness Interaction Data : We may collect non-medical interaction data, such as content you view, self-guided sessions you explore, and wellness preferences you choose to save. This information is used solely to improve personalization and engagement and is not treated as medical records.

2. How We Use Your Information

We use your information to operate and improve HolisticCare, including to create and manage user accounts, authenticate access securely, personalize wellness content, improve platform performance, communicate important updates, detect fraudulent or suspicious activity, and comply with legal and regulatory obligations.

3. How We Protect Your Information

We use strong technical and organizational safeguards to protect your data. These include encrypted communication, secure authentication tokens, role-based access controls, audit logging, and enterprise-grade cloud security. Our infrastructure is hosted on Microsoft Azure and follows industry best practices for data protection and resilience.

4. Data Sharing

We do not sell your personal information. We may share limited data with trusted third-party service providers only when necessary to deliver our Services, such as for authentication, infrastructure hosting, communication delivery, analytics, or legal compliance. These providers are required to protect your information and use it only for authorized purposes.

5. Cookies and Tracking Technologies

HolisticCare uses essential cookies required for secure login and platform functionality, as well as limited analytics cookies to understand usage patterns. You may disable cookies through your browser settings, but doing so may affect certain features of the Services.

6. Data Retention

We retain your information only for as long as necessary to operate the platform, meet security and compliance requirements, and fulfill legal obligations. Authentication logs and session data are retained in accordance with security best practices and automatically cleaned up where applicable.

7. Your Rights

Depending on your location and applicable laws, you may have the right to request access to your personal information, correct inaccuracies, request deletion of your account, restrict certain processing activities, or request a copy of your data. You may submit such requests by contacting us using the details below.

8. Children’s Privacy 

HolisticCare is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children.

9. International Users

Your information may be processed and stored in India and other countries where our cloud service providers operate. We take appropriate measures to ensure data protection across jurisdictions.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Continued use of the Services after changes are posted constitutes acceptance of the updated policy.

11. Contact Us

If you have questions or concerns about this Privacy Policy, please contact:

HolisticCare
Email: contact@holisticcarecorp.com