Sleep Balance Academy PC
Privacy Policy
What Sleep Balance Academy PC collects when you use our website and buy from us, why, who we share it with, how long we keep it, and the choices you have. Health information from your care is covered separately by our Notice of Privacy Practices.
- Effective
- Last updated
Contents
Effective date
Sleep Balance Academy PC is an Iowa professional corporation. This policy explains what we do with information about you when you use our website, buy something from us, or create an account. It is written to be read, not to be survived.
1Who we are
In this policy, we and us mean Sleep Balance Academy PC. Our business address is 350 W 6th #151, Dubuque, IA 52004.
2Which document covers which information
| Information | Covered by |
|---|---|
| What you tell a clinician, your clinical record, test results, and messages in your patient portal | Notice of Privacy Practices |
| Billing and payment information related to your care | Notice of Privacy Practices |
| Your name, delivery address and order details for a product bought without any clinical involvement | This policy |
| Your account details, your saved preferences, and your marketing choices | This policy |
| What you do on the public parts of our website | This policy, and the Cookie and Tracking Notice |
| Health related information about someone who is not a patient, for example inferred from browsing the store | Consumer Health Data Privacy Notice |
3What we collect
3.1 What you give us
- Contact details. Your name, email address, postal address and telephone number.
- Order details. What you ordered, where it went, and what you paid. Your card details are entered directly with our payment processor and we do not store your card number.
- Account details. Your sign-in details, your saved addresses, and your preferences.
- What you write to us. What you write to our support team, and what you post publicly such as a product review.
- Your choices. Whether you want marketing email, and on what channels you agreed to be reached.
3.2 What we observe
When you use the site we record ordinary technical information: which pages were requested, the general type of device and browser, and what we need to keep the site secure and working.
We use advertising and analytics technology from Google and from Meta on our public store, and only if you allow it. None of it runs on the patient portal, the doctor portal or a consult session. The Cookie and Tracking Notice names what is set, what those companies receive, and how to refuse.
3.3 What we get from elsewhere
We receive information about your order from the companies that help us complete it: our payment processor, the carrier that delivers your parcel, and a fraud prevention service. We never receive or store your full card number. We do not buy personal information about you from data brokers.
4Why we use it
| Purpose | Examples |
|---|---|
| To do what you asked | Take an order, ship it, take payment, give you access to something you bought, answer your question |
| To run your account | Sign you in, show your order history, save your preferences, let you claim a guest order |
| To keep the service safe | Detect and prevent fraud, protect accounts, investigate misuse, keep records of security events |
| To meet legal obligations | Tax and accounting records, product safety obligations, responding to lawful requests |
| To improve what we offer | Understand which parts of the store are hard to use, fix problems, plan what to stock |
| To tell you about things, where you asked us to | Marketing email you signed up for, and messages about an order you placed |
| To advertise the store, if you allow it | Measure whether our advertising works, and reach people who might want what we sell. Never using anything about your care |
We do not use information about your care to decide what to advertise to you, and we do not use a purchase to infer a health condition and then market to that.
5Who we share it with
We share personal information only with the categories below, only what they need, and only for the work we engaged them to do. We require anyone handling information on our behalf to protect it, to use it for nothing else, and to be bound by a written agreement.
- Payment processing. To take your payment and to prevent fraud.
- Shipping and fulfillment. To pick, pack, ship and deliver your order, and to handle a return.
- Email delivery. To send the emails you receive from us.
- Customer support tooling. To let our support team see and answer your message.
- Hosting. The infrastructure providers who host the service.
- Advertising and analytics. Google and Meta, if you allow advertising. They receive a record of your visit to our public store and can connect it to what they already know about you. They receive nothing from the patient portal, the doctor portal or a consult session, and nothing about your care.
- Professional advisers. Our accountants, auditors and lawyers, where they need it to advise us.
- Legal and safety. Where the law requires it, where valid legal process compels it, or where it is necessary to protect someone's safety. We require proper legal process and we tell the person affected where we are permitted to.
- A change in the business. If the business is sold or reorganized, information may transfer as part of it. We will tell you, and the same commitments will continue to apply.
We do not sell your personal information for money. If you allow advertising, we do share it for advertising, which state privacy law treats as sharing and in some states as a sale. Refusing is the default. We never disclose anything about your care to an advertising platform, whatever you have allowed.
6How long we keep it
We keep information for as long as we need it for the purpose we collected it, and then for as long as the law requires. There is no single period, because different records answer to different rules.
| What | How long |
|---|---|
| Orders, invoices, payments, refunds and tax records | Seven years, for accounting and tax |
| Your account and preferences | While your account is open, and a short period afterwards |
| Records of a marketing opt-out | Permanently, because forgetting an opt-out would resubscribe you |
| Email delivery records | Two years |
| Product safety and recall records | As long as product safety obligations require, which can be a long time |
| Medical records | As set out in the Notice of Privacy Practices, under the law of the state where you were treated |
7Your choices and your rights
Depending on where you live, you may have some or all of the rights below. We apply them to anyone who asks, wherever they live, except where doing so would break another law.
- Know and access. Find out whether we hold information about you, and get a copy.
- Correct. Have something inaccurate about you fixed.
- Delete. Ask us to delete information, subject to what we are required to keep.
- Portability. Get your information in a portable form.
- Opt out of sale or sharing. Tell us not to sell or share your information. We do not do either, so there is nothing to opt out of, but you may still tell us and we will record it.
- Opt out of marketing. Stop marketing email at any time, with no effect on anything else.
- Appeal. Ask us to reconsider if we say no. We will explain how.
- No penalty. We will not deny you a service, charge you a different price, or give you a worse experience for exercising any of these.
7.1 How to make a request
Write to support@sleepbalanceacademy.com and tell us what you want. There is no self-service privacy portal today, so a person handles your request by hand.
- Tell us what you are asking for, and which email address or order the request relates to.
- We will confirm we received it, and we may ask you a question or two to make sure we are giving your information to you and not to somebody else. We ask for the least we can.
- We aim to respond within 45 days. If we need longer, we will tell you before that runs out and explain why.
- If we cannot do all of what you asked, we will tell you what we did, what we could not do, why, and when the rest becomes possible.
Someone can make a request on your behalf if they are authorized to. We will check that they are.
7.2 What deletion actually does
When we delete, we remove information from our live systems. Copies in our backups expire on the backup cycle rather than being reached into and edited, so there can be a period where a copy still exists in a backup that nobody is using. We would rather tell you that than promise something instant that we cannot deliver.
Some things survive a deletion request because the law requires it: medical records within the retention period for your state, financial and tax records, product safety and recall records, an entry on our marketing opt-out list, evidence that we honored a request, and anything subject to a legal hold. Where we keep something, we tell you what and why, and we stop using it for anything else.
8Global Privacy Control
If your browser or an extension sends a Global Privacy Control signal, we treat it as a request to opt out of any sale or sharing of your personal information for the browser it came from. Since we do not sell or share, this changes nothing in practice today, and we would honor it if that ever changed.
9Security
We protect information in transit and at rest with encryption, we limit access to people whose work requires it, we keep records of access to clinical information, and we review our security regularly. Clinical information is kept apart from ordinary commerce information.
No system is perfectly secure, and we will not tell you otherwise. If something happens that affects your information, we will tell you and tell you what to do. You can help by using a password you do not use anywhere else and by telling us quickly if you think someone else has been in your account.
10Children
The store and the public site are not directed to children under 13 and we do not knowingly collect their information there. If you believe a child has given us information, write to us and we will delete it.
That is separate from care. A parent or legal guardian can arrange care for a minor, and information about that care is a medical record governed by the Notice of Privacy Practices and by the law of the state where the patient is located.
11Where we operate
We provide services and ship within the United States, and we store and process information in the United States. If you are contacting us from elsewhere, please know that your information will be handled here.
12Other sites
Our site links to other places on the internet. Those are not ours and this policy does not cover them. Read theirs before giving them anything.
13Changes to this document
We update this document when what we do changes, when the law changes, or when we find wording that is unclear. Every version is kept, and each one records the date it took effect.
How you find out depends on how much changed. A correction that does not change your rights is simply published. A change that does affect your rights is announced before it takes effect. A change that materially alters what you agreed to is not applied to you by silence: we ask you to accept it, and continuing to browse the site is not treated as acceptance.
If you want a copy of an earlier version, or want to know what changed and when, write to support@sleepbalanceacademy.com and we will send it to you.
14How to reach us, and how to complain
If you are unhappy with how we handled your information, tell us first and give us a chance to fix it. You can also complain to your state attorney general. If the complaint is about your health information, you can complain to the US Department of Health and Human Services Office for Civil Rights, and you do not have to come to us first.
- Health information
- Read the Notice of Privacy Practices, which sets out your HIPAA rights and how to exercise them.
- Cookies and tracking
- Read the Cookie and Tracking Notice, which lists what is actually set on this site.
- Health information outside HIPAA
- Read the Consumer Health Data Privacy Notice, which covers health related information about people who are not our patients.
