Privacy Policy

1. Introduction

Recovery Plus ("we," "us," or "our") operates the website myrecoveryplus.com and provides cryotherapy, red light therapy, compression therapy, and related wellness services at our location inside Ace gym, 1276 Callen Street, Vacaville, CA 95688. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, use our booking system, or receive our services.

By using our website or services, you consent to the practices described in this Privacy Policy. If you do not agree, please do not access the website or use our services.

2. Information We Collect

2.1 Personal Information You Provide

We collect information you voluntarily provide, including:

• Account & Booking Information: Full name, email address, phone number, date of birth (optional), and mailing address when you create an account or book an appointment.
• Payment Information: Credit/debit card details processed through Stripe or Square. We do not store full card numbers on our servers. We store only payment gateway customer IDs and transaction references for recurring billing and refund processing.
• Health & Intake Information: Medical history, current medications, known allergies, pregnancy status, cardiovascular conditions, Raynaud’s disease status, and other health disclosures collected via our intake form to ensure safe treatment.
• Emergency Contact: Name and phone number of an emergency contact.
• Communications: Messages you send us via email, contact forms, or SMS, and your communication preference (email or SMS).
• Marketing Preference: Whether you opt in to receive promotional communications.
• Reviews & Feedback: Star ratings, review text, and your name when you submit a review of our services.
• Event Requests: Contact name, email, phone, venue address, event details, attendee count, and budget when you request a group event or freeze party.
• Gift Card Purchases: Purchaser name and email, recipient name, email, and phone number when purchasing a gift card.

2.2 Information Collected Automatically

When you visit our website, we may automatically collect:

• Device Information: IP address, browser type and version, operating system, and device identifiers.
• Usage Data: Pages visited, time spent on pages, referring URL, click patterns, and booking flow interactions.
• IP Address: Recorded when you submit a review, purchase a gift card, or click a referral/affiliate link. Used for fraud prevention and affiliate commission tracking.
• User Agent: Your browser identification string, recorded when clicking referral links for attribution purposes.
• Booking Progress: If you begin but do not complete a booking, your selected service, date, time, and form data may be saved in your browser’s local storage so you can resume later (see Section 8).

2.3 Information from Third Parties

We may receive information from:

• Stripe: Payment confirmation, transaction status, subscription renewal status, and fraud detection signals.
• Square: Payment confirmation and transaction status (if used as payment method).
• Geocoding Services: When calculating travel distances for service delivery, we may send addresses to Google Maps Directions API or OpenRouteService to obtain travel time estimates. These services receive the address or coordinates but not your name or other personal details.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Service Delivery: To schedule appointments, process payments, perform health screenings, manage check-ins, and provide cryotherapy and related treatments safely.
• Communications: To send booking confirmations, appointment reminders, cancellation notices, follow-up messages, review requests, and subscription renewal notifications via your preferred channel (email or SMS). See Section 7 for SMS-specific terms.
• Account Management: To manage your account, track session history, package balances, subscription status, store credit balance, gift card balances, and referral activity.
• Recurring Billing: To process automatic subscription renewals, retry failed payments (up to 3 attempts), and manage trial periods.
• Safety & Compliance: To evaluate health contraindications before treatment, maintain treatment records, and comply with applicable health and safety regulations.
• Fraud Prevention: To detect and prevent fraudulent transactions, review spam, and referral abuse using IP address and transaction pattern analysis.
• Improvement: To analyze internal booking analytics (revenue, utilization, booking funnel), improve our website and booking experience, and develop new services. All analytics are processed internally — we do not use third-party analytics services such as Google Analytics.
• Marketing: To send promotional offers, new service announcements, and loyalty program updates to clients who have opted in. You may opt out at any time (see Section 6 for general marketing opt-out and Section 7 for SMS opt-out).
• Referral Program: To track affiliate and referral activity, attribute bookings to referral sources, and calculate referral commissions.
• Legal Obligations: To comply with applicable laws, regulations, legal processes, or enforceable governmental requests.

4. How We Share Your Information

We do not sell, trade, or rent your personal information to third parties. We may share information only in the following circumstances:

• Payment Processing: Stripe and/or Square receive payment details necessary to process your transactions. Their respective privacy policies govern their use of that data.
• Geocoding Services: Google Maps Directions API or OpenRouteService may receive address or coordinate data for travel time calculations. No personal identifiers are sent.
• Email/SMS Delivery: If we use a third-party email service (such as SendGrid) or SMS provider (Twilio), your email address or phone number is transmitted to deliver notifications. These providers are contractually prohibited from using your data for their own purposes. See Section 7 for details on SMS handling.
• Service Providers: We may share information with vendors who assist with website hosting and technical maintenance — only to the extent necessary to perform their services for us.
• Legal Requirements: We may disclose information if required by law, subpoena, court order, or governmental regulation, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email and/or prominent notice on our website.

We do not share your health or intake information with any third party except as required by law or with your explicit written consent.

5. Data Retention

We retain your data according to the following schedule:

• Account Data: Retained for as long as your account is active, plus 7 years after your last booking for clients with no recent activity.
• Health & Intake Records: Retained for 7 years from the date of your last treatment, in accordance with California medical record retention guidelines.
• Booking Records (Personal Information): Personally identifiable information on cancelled or no-show bookings is automatically anonymized after 2 years. Booking dates, amounts, and status are retained for financial compliance.
• Financial & Payment Records: Transaction records retained for 7 years for tax, accounting, and regulatory compliance. These records are never automatically deleted.
• Gift Card Records: Transaction history retained for 7 years. Gift cards themselves do not expire per California law.
• Referral/Affiliate Data: Click tracking data (IP, user agent, landing page) retained for the duration of the affiliate relationship.
• Reviews: Published reviews are retained indefinitely unless you request removal. Draft reviews stored in cookies expire after 30 days.
• Internal Analytics: Aggregated, non-personal analytics data retained indefinitely. Analytics cache refreshed hourly.
• SMS Consent Records: Phone number, consent type(s), opt-in timestamp, and IP address retained for 4 years from the most recent opt-in event for telecommunications compliance and audit purposes.

Our automated data retention system runs monthly to anonymize and purge data according to these schedules. You may request earlier deletion of your data subject to our legal retention obligations (see Section 6).

6. Your Privacy Rights

6.1 California Residents (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know what personal information we collect, use, and disclose about you.
• Delete your personal information, subject to legal exceptions (financial records may be anonymized rather than deleted).
• Correct inaccurate personal information.
• Opt out of the sale or sharing of personal information. Note: We do not sell your personal information.
• Non-discrimination for exercising your privacy rights.

6.2 Data Export

You may request a copy of all personal data we hold about you. We support the WordPress personal data export tool, which provides your account information, booking history, and associated records in a machine-readable format. To request an export, contact us at Brian.recoveryplus@outlook.com.

6.3 Data Deletion

You may request deletion of your personal data. Upon a verified request:

• Your client record will be deleted.
• Booking records will be anonymized (personal details removed; financial data retained for compliance).
• Payment records will have client identifiers removed but transaction amounts and dates retained for 7 years.
• Reviews you authored will be anonymized or removed.

To exercise any privacy right, contact us at Brian.recoveryplus@outlook.com or call (707) 761-1528. We will respond within 45 days.

6.4 Marketing Opt-Out

You may opt out of marketing communications by:

• Clicking the "Unsubscribe" link in any promotional email.
• Updating your communication preferences in your My Account dashboard.
• Contacting us directly.
• For SMS specifically, replying STOP to any text message (see Section 7 for full SMS terms).

Opting out of marketing does not affect transactional messages (booking confirmations, reminders, cancellations, payment receipts, subscription renewal notices).

7. SMS / Text Messaging

Recovery Plus may send transactional and, with your consent, promotional text messages to the mobile number you provide. We use Twilio as our SMS subprocessor.

7.1 Message Types

• Transactional (always sent if SMS is your communication preference): booking confirmations, appointment reminders, cancellation and rescheduling notices, subscription renewal notifications, payment receipts, and account-security alerts.
• Promotional (sent only with your separate opt-in): special offers, loyalty and rewards updates, new service announcements, and event invitations.

7.2 No Mobile Information Sharing

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information shared with subprocessors solely to deliver SMS messages — for example Twilio, our SMS provider — is not considered sharing for marketing purposes. This restriction applies to all categories of mobile data, including phone numbers and SMS opt-in status.

7.3 Message Frequency

Message frequency varies based on your bookings, subscription status, and marketing preferences. Typically 2–8 messages per month. During promotional periods you may receive up to 4 additional promotional messages per month if you have opted in to marketing.

7.4 Costs

Message and data rates may apply. Recovery Plus does not charge for messages; standard rates from your wireless carrier apply.

7.5 How to Opt Out (STOP)

You may opt out of all non-transactional SMS at any time by replying STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, or QUIT to any message from us. We will send a one-time confirmation that you have been unsubscribed. You may resubscribe at any time by replying START, by toggling SMS preferences in your My Account dashboard, or by contacting us.

Note: certain transactional messages directly tied to an active service (such as a booking confirmation or appointment reminder for a session you have already scheduled) may continue to be sent even after STOP, until the related service is complete or cancelled. To stop transactional SMS entirely, change your communication preference in My Account or contact us directly.

7.6 How to Get Help (HELP)

Reply HELP or INFO to any message for assistance, or contact us directly at (707) 761-1528 or Brian.recoveryplus@outlook.com.

7.7 Carriers

Carriers are not liable for delayed or undelivered messages.

7.8 How We Collect SMS Consent

We collect SMS opt-in only via our online booking form at myrecoveryplus.com/book-now. During the Information step, you affirmatively check separate, unchecked consent boxes for transactional and (optionally) promotional SMS. We record the phone number, the consent type(s) you accepted, the timestamp, and your IP address with the booking record for compliance and audit purposes. We do not collect SMS opt-in via verbal, paper, keyword, or QR-code flows.

8. Cookies & Tracking Technologies

We use the following cookies and client-side storage:

8.1 Cookies

• Referral Cookie (crb_ref): Set when you visit our site via a referral link (e.g., ?ref=CODE). Stores the referral code for 30 days to attribute your booking to the referring party. Secure flag enabled; accessible to JavaScript for booking form integration.
• Review Draft Cookie (crb_review_draft_token): Stores your in-progress review for 30 days so you can return and complete it. HttpOnly flag enabled (not accessible to JavaScript).
• WordPress Session Cookies: Required for login authentication and website functionality.

8.2 Browser Local Storage

• Cart Recovery: If you begin a booking but do not complete it, your selected service, date/time, and form data are saved in your browser’s local storage. This allows you to resume your booking on your next visit. This data remains until you complete or clear the booking, or manually clear your browser storage. No server-side tracking of abandoned bookings occurs.
• User Preferences: Selected options and form state may be temporarily stored in session storage for the duration of your browser session.

8.3 What We Do Not Use

We do not use advertising cookies, retargeting pixels, Google Analytics, Facebook Pixel, or any third-party behavioral tracking on our website. All usage analytics are processed internally on our servers.

You can manage cookies through your browser settings. Disabling cookies may prevent the referral attribution and review draft features from functioning.

9. Data Security

We implement appropriate technical and organizational measures to protect your information, including:

• SSL/TLS encryption for all data transmitted between your browser and our servers.
• Payment processing handled entirely by Stripe and Square (PCI DSS Level 1 certified). We never store full credit card numbers, CVVs, or magnetic stripe data.
• Payment gateway customer IDs stored securely and used only for processing authorized transactions and refunds.
• Access controls limiting employee access to personal data on a need-to-know basis.
• Automated data retention enforcement removing or anonymizing data per our retention schedule.
• Regular security reviews of our website and booking systems.

No method of electronic transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

10. Children’s Privacy

Our services are not intended for individuals under 18 years of age. Minors (ages 14–17) may receive treatment only with a parent or legal guardian present who has signed the intake and consent forms. We do not knowingly collect information from children under 14. If we become aware that a child under 14 has provided us with personal information, we will delete it promptly.

11. Third-Party Links

Our website may contain links to third-party websites (e.g., Stripe or Square payment portals, social media profiles). We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Material changes will be communicated via email to registered users. Your continued use of our services after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions or concerns about this Privacy Policy, wish to exercise your privacy rights, or want to request a data export or deletion, contact us:

Recovery Plus
1276 Callen Street, Vacaville, CA 95688
(inside Ace gym)
Phone: (707) 761-1528
Email: Brian.recoveryplus@outlook.com