Your data, in plain words

Who this is about

This site is run by Wellness Within, a single-practitioner massage therapy practice in California, USA. There is no company behind it, no marketing department, and nobody else with access to the booking system.

What we collect when you book

Only what is needed to hold the appointment and remind you about it:

• Your name. First name is required; last name is optional, and only helps if two Sarahs book the same week.
• Your email address. Required. This is where your confirmation, any reminders, and your cancel-or-move link are sent.
• Your phone number. Optional. Used to reach you aboutthis appointment, and — only if you tick the box — to text you reminders.
• Anything you write in the notes box. Injuries, recent surgery, pregnancy, areas to avoid, pressure preference. This is health information and is treated as the most sensitive thing on the list. Please only put in what is useful for the treatment; anything longer is better said in person.
• The appointment itself — which treatment, when, and the timezone your device was set to, so your confirmation reads in your own local time.

We do not ask for or store payment card details. Payment happens in person at the end of the session. There is no account and no password to remember; your booking link is a long random web address that only you and Theresa have.

Reminders, and how to stop them

Once you have booked, the system sends you a small, fixed set of messages: a confirmation, one or two reminders before the appointment, and a note if it is canceled or moved. Nothing else. There is no newsletter, no marketing list, and your details are never sold, rented or shared with advertisers.

• Email reminders are on by default because they are how you get your confirmation. Every non-essential email has anunsubscribe link at the bottom; using it stops reminders while leaving the essential confirmation and cancellation notices for appointments you have actually booked.
• Text reminders are off unless you tick the box on the booking form. Reply STOP to any text to switch them off immediately; the system honours that automatically and permanently. Message and data rates may apply, and your carrier’s charges are between you and them.
• You can also just ask — ring or email and Theresa will turn either off for you.

Who else sees it

A handful of companies handle your data on our behalf, because a one-person practice cannot run its own mail servers. They are only allowed to use it to deliver the service:

• Cloudflare hosts this website and its database.
• An email provider delivers your confirmation and reminders, and therefore sees your name, email address and the appointment details.
• A text-message provider delivers SMS reminders, and therefore sees your phone number and the appointment time — but only if you opted in.
• Google Calendar. Your appointment is copied into Theresa’s own work calendar so she does not double-book you. The entry contains your name and the treatment; your notes and contact details are not copied there.

Nobody else. Your information is never shared with another therapist, clinic or insurer without your explicit say-so, except where the law requires it.

How long it is kept

Appointment records and treatment notes are kept for 7 years, which is what the licensing rules for this practice require. After that they are deleted. If you ask to be forgotten sooner, we delete everything we are allowed to delete and tell you plainly what we have to keep and why.

Cookies and tracking

This site does not use advertising cookies, analytics scripts, tracking pixels or social-media buttons. Nothing here follows you around the internet.

The only cookies the site can set belong to Theresa’s own admin screens — a login session, and a short-lived one that lasts a few minutes while she signs in with Google, which exists purely to check that the sign-in finishes in the same browser it started in. Neither is ever set on a visitor’s browser. Fonts are loaded from Google Fonts, which means Google sees the request for the font file; no cookie is set and nothing identifies you beyond the usual web-server basics.

Your rights

You can ask, at any time, to see what is held about you, to have a mistake corrected, to have your details deleted, or to receive a copy of them. Just ask — there is no form and no fee, and you will get an answer within a month, usually the same week.

Depending on where you live you may have further rights (GDPR in Europe and the UK, the CCPA in California, and similar laws elsewhere). Those rights apply here too, and asking is the same: ring or email.

If something goes wrong

If your data is ever exposed in a way that could put you at risk, you will be told directly — by email, and by phone if it is serious — along with what happened and what is being done about it.

Asking us anything

Questions about any of this go to the same place as everything else — see the contact page. There is no privacy department; it is just Theresa.