Privacy Policy | Massage Intake

1. Information We Collect

Account information, including name, email, and optional phone number.
Clinic and therapist profile data, including optional avatar images.
Client intake and consent information entered by authorized users.
Therapist licensing details such as license number, state, and expiration.
Uploaded media and signature files required to complete workflow tasks.
Operational and security event logs needed to protect the service.
When website analytics is enabled, public store page-view counts and store-specific pseudonymous visitor identifiers derived from IP address and browser information using a secret-keyed hash. Analytics storage does not retain raw IP addresses or browser strings, and this feature does not set tracking cookies.

2. How We Use Information

Provide and maintain account access and role-based workflows.
Process intake, consent, countersignature, export, and support operations.
Protect service security, investigate misuse, and improve reliability.
Respond to support requests and legal or regulatory obligations.
Provide platform administrators with aggregate store website traffic and estimated unique-visitor counts, excluding obvious automated traffic.

3. Sharing and Disclosure

We do not sell personal data. We may share information with trusted service providers that process data on our behalf for hosting, authentication, storage, and support. We may also disclose information when required by law or to protect rights, safety, and security.

4. Data Retention

We retain account profile and operational data while an account is active. After an account deletion request is verified, account-level personal data is deleted or anonymized within 30 days, except where retention is required for legal, tax, fraud-prevention, security, or dispute-resolution obligations.

Security and audit logs, including completed deletion request records, may be retained for up to 12 months.
Billing, tax, and legally required records may be retained for up to 7 years.
Daily website traffic counts and pseudonymous visitor identifiers are retained while the store exists to support all-time visitor estimates. They are deleted when the store is deleted.

5. Data Deletion and Your Rights

You can request account deletion and associated personal data deletion in Settings > Request account deletion in the app. Confirming records your request and displays its ID and status; you do not need to email or call. If you cannot access your account, contact support@massageintake.com. See /data-deletion for processing and retention details. We verify requester identity before processing deletion requests.

Clinic-owned intake and consent records are managed by clinic account owners and may be retained based on clinic policy and applicable law.

6. Security

We use administrative, technical, and organizational safeguards designed to protect personal information, including encryption in transit and access controls.

7. Contact

For privacy questions, contact: support@massageintake.com

8. Phone Verification and Booking Texts

KEYITECH LLC operates Massage Intake. If you request phone verification or, as a store-owner account user, opt in to platform booking alerts, we process your verified account phone, alert consent and its timestamp, opt-out or opt-in events, and delivery status. We use Supabase and Twilio to provide authentication, number country checks, message delivery, and opt-out handling. Booking texts include the store name, appointment time, and booking status, not customer names, customer phone numbers, or medical intake answers. Customer-directed booking SMS is currently disabled; we do not use a booking customer's phone as the recipient of an owner alert.

Mobile phone information and SMS opt-in consent are not sold or shared with third parties or affiliates for marketing or promotional purposes. We share only the information needed with providers that support message delivery and authentication. Requesting an account verification code does not opt you into booking or marketing texts.

Owner alert consent is linked to the owner account and a verified phone snapshot; delivery records are linked to the booking. We retain opt-out records to honor STOP across platform booking alerts, including after a booking is removed. Reply START to resume future alerts with a valid subscription; past messages are not replayed. Changing the verified phone requires new alert consent. Contact support@massageintake.com for access or deletion requests. See our SMS terms.