Effective May 1, 2026.

1. Introduction

Body Reset Recovery and Wellness ("Body Reset," "we," "us," or "our") is committed to protecting the privacy and security of the personal information you share with us. This Privacy Policy explains what information we collect, how we use it, who we share it with, and what rights you have regarding your data.

This policy applies to all information collected through our website at bodyresetrecovery.com, our booking and scheduling systems, our marketing communications, and through in-person interactions at our studio in Clinton, Maryland.

By using our website, booking a session, or becoming a client of Body Reset, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use our services or website.

2. Information We Collect

We collect the following categories of personal information:

Identity and Contact Information Full name, email address, phone number, mailing address, and date of birth. This information is collected when you create a booking account, contact us, or sign up for communications.

Health and Medical Information Prior to receiving services, clients complete a health history and medical intake form — available in both digital and paper format. This may include information about existing medical conditions, injuries, medications, pregnancy status, cardiovascular health, and other health factors relevant to safe service delivery. This is among the most sensitive information we collect and is governed by heightened protections described in Section 5.

Payment Information When you purchase services or memberships, payment information is collected and processed by Square and PayPal. Body Reset does not store full credit card numbers or financial account details on our own systems. Please review the privacy policies of Square (squareup.com) and PayPal (paypal.com) for information on how they handle your payment data.

Booking and Session History Records of services booked, sessions attended, membership status, and visit history. This information is maintained through our booking platform, Vagaro.

Communications If you contact us by email, phone, or through our website contact form, we retain records of that correspondence.

Marketing Preferences If you opt in to email or SMS communications, we collect and store your contact information and marketing preferences through Klaviyo.

Website Usage Data When you visit our website, we automatically collect certain technical information including your IP address, browser type, device type, pages visited, time spent on pages, and referring URLs. This data is collected through cookies and tracking technologies described in Section 7.

Signed Consent Documents Clients sign physical waivers and consent forms prior to their first session. Copies of these documents are retained as part of your client record.

3. How We Use Your Information

We use the information we collect for the following purposes:

• To schedule, confirm, and manage your bookings and sessions

• To process payments for services and memberships

• To assess health and safety considerations before delivering services

• To communicate with you about your appointments, membership, and account

• To send marketing emails and SMS messages to clients who have opted in

• To improve our website, services, and client experience

• To comply with applicable laws and regulations

• To protect the safety of our clients, staff, and business

• To serve targeted advertising to website visitors through Meta and TikTok platforms

We do not use your health or medical information for marketing purposes under any circumstances.

4. Third-Party Services

We work with the following third-party service providers. Each operates under its own privacy policy, which we encourage you to review:

Vagaro — Booking, scheduling, and client management platform. Client profile data, session history, and health intake forms submitted digitally are stored within Vagaro's cloud-based system. Visit vagaro.com/privacy for their privacy policy.

Square — Payment processing for in-person and online transactions. Visit squareup.com/us/en/legal/general/privacy for their privacy policy.

PayPal — Payment processing for online transactions. Visit paypal.com/us/legalhub/privacy-full for their privacy policy.

Klaviyo — Email and SMS marketing platform. If you opt in to marketing communications, your contact information and communication preferences are stored and managed through Klaviyo. Visit klaviyo.com/legal/privacy for their privacy policy.

Google Analytics — Website analytics service provided by Google LLC. Google Analytics collects website usage data using cookies to help us understand how visitors interact with our website. Visit policies.google.com/privacy for Google's privacy policy. You may opt out of Google Analytics tracking at tools.google.com/dlpage/gaoptout.

Meta (Facebook and Instagram) — We use the Meta Pixel on our website to measure the effectiveness of our advertising and to serve targeted advertisements to visitors on Facebook and Instagram. Visit facebook.com/privacy/policy for Meta's privacy policy.

TikTok — We use the TikTok Pixel on our website to measure advertising performance and to deliver targeted content to users on TikTok. Visit tiktok.com/legal/privacy-policy for TikTok's privacy policy.

We do not sell your personal information to any third party. We do not share your health or medical information with any third-party service, advertiser, or partner.

5. Health and Medical Information

We take the collection and handling of health and medical information seriously and apply heightened care to this data.

Health intake information is collected solely to evaluate whether services are appropriate and safe for each individual client. This information is used by Body Reset staff only for the purpose of service delivery and safety assessment.

Your health and medical information is:

• Never sold or transferred to third parties

• Never used for advertising or marketing targeting

• Never shared with employers, insurers, or other organizations

• Accessible only to Body Reset staff who require it for service delivery purposes

• Stored in cloud-based systems maintained by Vagaro, which employs industry-standard security measures

Paper health intake forms are stored securely at our facility with restricted access. We retain health intake information for as long as you remain an active client and for a reasonable period thereafter in accordance with applicable record-keeping standards.

Body Reset is a wellness studio, not a healthcare provider, and is not subject to HIPAA. However, we voluntarily apply the principle of minimum necessary access to all health information we collect.

6. Minors

Body Reset accepts clients under the age of 18 with the documented consent of a parent or legal guardian. For minor clients:

• A parent or legal guardian must be present and must sign all consent and waiver documents on the minor's behalf

• Health intake information for minors is subject to the same heightened protections described in Section 5

• We do not knowingly collect personal information from individuals under the age of 13 through our website without verifiable parental consent

• If you believe we have inadvertently collected information from a minor without appropriate consent, please contact us immediately using the information in Section 11 and we will promptly address it

Parents and guardians may request access to, correction of, or deletion of their minor child's records by contacting us directly.

7. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies to operate the site, understand visitor behavior, and deliver targeted advertising.

Types of cookies we use:

Essential cookies — Required for the website to function. These cannot be disabled.

Analytics cookies — Used by Google Analytics to collect anonymous data about how visitors use our website. This helps us improve the site experience.

Advertising and retargeting cookies — Used by Meta Pixel and TikTok Pixel to track website visits and serve targeted advertisements on Facebook, Instagram, and TikTok to people who have previously visited our site.

Your choices:

You may manage cookie preferences through your browser settings. Note that disabling certain cookies may affect website functionality.

To opt out of Google Analytics tracking, visit: tools.google.com/dlpage/gaoptout

To opt out of Meta ad targeting, visit your Meta Ad Preferences at facebook.com/ads/preferences or use the Digital Advertising Alliance opt-out tool at optout.aboutads.info

To opt out of TikTok ad targeting, visit your TikTok account settings under "Ads" or visit tiktok.com/legal/privacy-policy for instructions.

8. Marketing Communications

If you have opted in to receive emails or SMS messages from Body Reset, we use Klaviyo to manage and deliver those communications.

You may opt out of marketing emails at any time by clicking the "Unsubscribe" link at the bottom of any email we send. You may opt out of SMS messages by replying STOP to any text message from us. Opting out of marketing communications does not affect transactional messages such as booking confirmations or appointment reminders.

9. Data Retention and Security

We retain your personal information for as long as you are an active client and for a reasonable period thereafter to fulfill the purposes described in this policy, resolve disputes, and comply with our legal obligations.

We implement reasonable administrative, technical, and physical safeguards to protect your personal information from unauthorized access, disclosure, alteration, or destruction. These include access controls on client management systems, restricted access to paper records, and use of established third-party platforms with their own security certifications.

No method of data transmission or storage is completely secure. We cannot guarantee the absolute security of your information, but we are committed to protecting it using appropriate and reasonable measures.

10. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal information:

• Access — The right to request a copy of the personal information we hold about you

• Correction — The right to request correction of inaccurate or incomplete information

• Deletion — The right to request deletion of your personal information, subject to certain legal and operational limitations

• Opt-out of marketing — The right to opt out of marketing emails and SMS messages at any time

• Opt-out of sale — We do not sell personal information. No action is required on your part.

To exercise any of these rights, please contact us using the information in Section 11. We will respond to verified requests within 30 days.

11. Virginia Consumer Data Protection Act (VCDPA)

If you are a resident of Virginia, you have additional rights under the Virginia Consumer Data Protection Act effective January 1, 2023.

These rights include:

• The right to confirm whether we are processing your personal data and to access that data

• The right to correct inaccuracies in your personal data

• The right to delete personal data you have provided to us or that we have collected about you

• The right to obtain a copy of your personal data in a portable and usable format

• The right to opt out of the processing of your personal data for purposes of targeted advertising

• The right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects

To opt out of targeted advertising: Contact us directly using the information in Section 12 and we will process your request. You may also use the browser and platform opt-out tools described in Section 7.

We will not discriminate against you for exercising your VCDPA rights. We will respond to verified VCDPA requests within 45 days. If we require an extension, we will notify you within the initial 45-day period.

If you believe we have failed to respond to your request appropriately, you have the right to appeal our decision by contacting us at the address below. If your appeal is denied, you may submit a complaint to the Virginia Attorney General at oag.state.va.us.

12. Contact Us

If you have questions, concerns, or requests related to this Privacy Policy or your personal information, please contact us at:

Body Reset Recovery and Wellness Clinton, Maryland Email: info@bodyresetrecovery.com Phone: 240.444.1460 Website: bodyresetrecovery.com

We will make every reasonable effort to respond to privacy-related inquiries within 30 days.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or applicable law. When we make material changes, we will update the "Last Updated" date at the top of this page. We encourage you to review this policy periodically. Your continued use of our website or services after changes are posted constitutes your acceptance of the updated policy.