Last Edited And Put Into Effect On March 22, 2025.

IN CONTINUEING TO USE OUR WEBSITE OR SERVICES YOU AUTOMATICALLY AGREE TO THE FOLLOWING PRIVACY POLICY.

We reserve the right to modify this Privacy Policy at any time. Users will be notified of policy updates through the following methods:

1. Email notification to registered users

Users will receive notification at least 1 day before any material changes take effect, allowing time to review and understand the updates. Changes will become effective 1 days after the initial notification. We recommend that you periodically review this policy to stay informed about our data handling practices. Continued use of our services after the notification period constitutes your acknowledgment and acceptance of the updated policy.

Precision Equine Cryotherapy ("we," "our," "us") is committed to protecting and respecting your privacy in full compliance with the General Data

Protection Regulation (GDPR). We process your personal data on the following legal bases:

1. Consent: We obtain explicit consent for specific data processing activities, as required by applicable data protection laws.

2. Contractual Necessity: We process data necessary to perform our contractual obligations and provide our services.

3. Legal Obligation: We may process data to comply with legal and regulatory requirements.

4. Legitimate Interests: We may process data when it is necessary for our legitimate business interests, balanced against your privacy rights.

By using our website or services, you acknowledge and agree to these legal bases for data processing. We are committed to transparency and providing clear information about our data practices. Before obtaining consent, we explicitly outline the following key points:

1. Types of Personal Data Collected: We collect name, email, phone, address, state, country, credit card information if necessary for payment.

2. Purposes of Data Collection: Your data is used for delivering services, payment processing, communications.

3. Data Sharing Practices: We may share data with third parties under the following conditions:

a. When necessary to fulfill contractual obligations and or deliver services

b. To comply with legal and regulatory requirements

c. With explicit user consent

d. To protect our legal rights or safety

e. In connection with a business transfer or merger.

We expressly prohibit selling or monetizing user data to third parties for commercial purposes. Data sharing is strictly limited to necessary operational and legal requirements.

User Rights

You have the right to access, correct, and request deletion of your personal data. Upon successful deletion of your personal data, we will send you a written confirmation via email within 30 business days, verifying that your data has been completely removed from our systems. Some limited information may be retained so that we can maintain compliance for tax filing and financial purposes.

User Consent

Consent is obtained through an affirmative action, such as checking a consent checkbox during registration or first use of our services, which indicates your understanding and agreement to the terms outlined herein. This consent is freely given, specific, informed, and unambiguous.

We collect personal data for the following purposes:

• Providing and improving our services

• Processing payments

• Communicating with customers

• Personalizing user experience

• Marketing and promotional activities

Minor Data Collection

We are committed to protecting the privacy of minors. Before collecting any personal data, we implement the following age verification methods:

• Require users to confirm they are over 18 during account registration

• Implement age verification questions that cannot be easily bypassed

• For users who appear to be minors, we will request parental consent through a verified process

We do not knowingly collect personal data from individuals under the age of 18 and are fully compliant with the Children's Online Privacy Protection Act (COPPA). If we become aware that we have collected personal data from a minor without parental consent, we will take immediate steps to remove that information from our servers in accordance with COPPA guidelines. Parents or guardians who believe their child has submitted personal information can contact us to request deletion. Upon processing a valid deletion request, we will send a confirmation email to the user within 7 business days, verifying that their personal data has been completely removed from our systems.

HIPAA Compliance

We respect your right to control your personal data. We do not collect health information as part of our business. In the event that handling sensitive health information is necessary, we are fully committed to compliance with the Health Insurance Portability and Accountability Act (HIPAA). Our practices ensure the protection of Protected Health Information (PHI) in accordance with HIPAA regulations, including maintaining strict confidentiality, implementing robust security measures, and adhering to all relevant privacy and security standards. We provide separate explicit consent mechanisms for sensitive health information and ensure that all such data is processed with the highest level of privacy protection.

Data Collection Types & Usage

You can provide separate consent for different types of data collection and usage:

• Essential Data Collection: Mandatory for accessing our core services. Without providing essential personal data, you will not be able to use our core platform features.

• Marketing Communications: Mandatory consent to receive updates, promotions and communications including updates to this agreement.

• Analytics and Tracking: Mandatory consent for website performance tracking is built into our services and cannot be opted out of.

• Sensitive Health Information: (We do not collect this but if we did...) Separate explicit consent required, with full HIPAA compliance guarantees

Please note that while consent for non-essential data collection is voluntary, certain personal data is required to provide and maintain our core services. You can manage your consent preferences at any time by:

• Updating your account settings

• Contacting our privacy team at [email protected]

• Using the opt-out links in our communications or replying STOP to SMS

Withdrawing consent for certain non-essential data collection will not affect your ability to use our core services.
Data Processing Restriction Requests: You have the right to request restriction of processing your personal data under the following conditions:

• When you contest the accuracy of your personal data

• When the processing is unlawful, and you oppose erasure

• When we no longer need the data, but you require it for legal claims

• When you have objected to processing pending verification of our legitimate grounds

Data Restrictions

To request a restriction on data processing, please contact our privacy team at [email protected] with a detailed explanation of your request. We will respond within 30 days and provide clear information about the status of your request.

We implement strict access control measures to ensure that only authorized personnel can access personal data. Access is granted on a need-to-know basis, with role-based access controls limiting employee access to only the specific data required for their job functions. All data access is logged and monitored to prevent unauthorized use.

Key Data Practice Highlights

• We collect personal and sensitive information through various methods

• Your data may be used for service provision, communication, and marketing

We vet all third-party service providers to ensure the highest standards of data protection and privacy. We utilize Standard Contractual Clauses (SCCs) and, where applicable, Binding Corporate Rules (BCRs) to ensure legal compliance in international data transfers, strictly adhere to adequacy decisions issued by the European Commission, comply with the California Consumer Privacy Act (CCPA), and are fully compliant with the Personal Information Protection and Electronic Documents Act (PIPEDA) for all personal information collected from Canadian residents.

International Data Transfers

Users who have concerns about international data transfers may submit a formal complaint through our dedicated data protection contact channel. We provide a clear grievance mechanism that includes:

a) A formal complaint submission process

b) Acknowledgment of complaint within 7 business days

c) A comprehensive investigation and response within 30 days

d) Potential remedies including data correction, deletion, or compensation where appropriate

We do not actively engage in international data transfers. If international transfers are necessary we will do our best to implement the following specific safeguards:

a) Encryption of data during transmission

b) Anonymization or pseudonymization of personal data where possible

c) Strict access controls for international data processing

d) Regular third-party audits of international data transfer practices

e) Comprehensive data protection agreements with international partners

Security Training

We conduct in house training for all employees to ensure they understand their responsibilities in protecting sensitive information and maintaining data integrity.

We implement robust security measures to protect your sensitive information, including:

a) Advanced firewall protection to prevent unauthorized network access

b) Regular antivirus and malware scanning

c) Intrusion detection systems to monitor and prevent potential security threats

f) Secure access controls and security audits

Types of Data We Collect

1. Personal Identification Information (name, contact details)

2. Payment Information

3. Sensitive Health Data

4. Technical and Browsing Information

How We Use Your Data

• Service Delivery

• Communication

• Personalization

• Marketing (with your consent)

• Legal Compliance

By continuing to use our services, you acknowledge that you have read and understood these data practices. We will retain your personal data for the following specific durations:

• Personal Identification Information: Retained for the duration of your active account plus 2 years after account closure

• Payment Information: Retained for 7 years for accounting and tax purposes

• Technical and Browsing Information: Retained for 1 year from the date of collection

You can choose not to provide certain information, but this may limit your ability to use some of our services or features.

Information We Collect

We may collect and process the following data about you through various methods, including:

• Website forms

• Online purchases

• Cookies and tracking technologies

• Direct interactions

• Third-party services: We may share your personal data with carefully selected third-party service providers for the following purposes:

• Payment processing

• Customer support

• Website analytics

• Marketing and advertising

• Service improvement

These third-party providers are contractually obligated to:

• Use your data only for the specified purposes

• Maintain strict confidentiality

• Implement appropriate data protection measures

• Not sell or distribute your personal information without consent

• Personal Identification Information:

• Name

• Email address

• Mailing address

• Phone number

• Payment information (processed through secure, PCI-DSS compliant payment gateways)

Sensitive Data

We may if necessary collect sensitive personal health information in connection with our cryotherapy services, and we comply with all applicable health information privacy laws, including but not limited to sector-specific regulations governing the protection of personal health information. We will:

• Provide a clear explanation of the specific sensitive data we are collecting

• Explain the purpose for collecting such data

• Obtain your explicit written or digital consent

• Give you the option to decline providing sensitive information

We implement robust security measures to protect such sensitive information, including:

• Encryption of sensitive data

• Restricted access to sensitive information

• Compliance with HIPAA privacy and security regulations

• Regular security audits and assessments

Non-Personal Identification Information:

• IP address

• Browser type

• Operating system

• Browsing behavior on our website

Implicit Data Collection

We may use cookies, web beacons, and similar tracking technologies to automatically collect certain information when you visit our website. This may include IP address, browser type, operating system, device identifiers, and browsing behavior. These technologies help us understand user interactions, improve our services, and provide a more personalized experience.

How We Use Your Information

Automated Decision-Making: We do not currently use automated decision-making or profiling that significantly affects you. If we implement such practices in the future, we will provide clear information about the logic involved and your rights to object.

We use the information we collect in the following ways:

• To process transactions: To process your purchases and provide the products and services you request.

• To improve our website: To enhance your experience on our website by understanding your preferences.

• To send periodic emails: To provide updates, promotions, and information related to our services. You can opt-out of receiving these communications at any time by following the unsubscribe instructions in the email.

• To provide customer support: To respond to your inquiries and offer support.

To exercise these rights, including opting out of data collection and sharing, please contact us at [email protected]. You can submit a comprehensive opt-out request, and we will:

1) Cease all non-essential data collection and sharing within 10 business days of receiving your request

2) Provide a confirmation of your opt-out status

3) Offer multiple methods to withdraw consent, including:

a) Email request to [email protected]

b) Written request to our official mailing address

c) Online opt-out form on our website

4) You have the right to withdraw consent partially or completely, and we will honor your preferences promptly and transparently.

5) As tracking is integrated into our systems you may not be able to access certain systems if you wish to opt out. We will inform you of what systems cannot be accessed based on your request.

Sharing Your Information

If we have to share information with international service providers, we fully comply with the EU General Data Protection Regulation (GDPR) for all data transfers from the EU. Our safeguards include:

1. Standard Contractual Clauses compliant with GDPR requirements

2. Encryption protocols for data in transit

3. Strict confidentiality agreements

4. Regular security audits to ensure GDPR-level protection of personal data across borders

We do not sell, trade, or otherwise transfer to outside parties your Personal Identification Information except in the following circumstances:

• With service providers: We may share information with third-party service providers who assist us in operating our website, conducting our business, or servicing you, as long as those parties agree to keep this information confidential.

• For legal purposes: We may disclose your information if required by law or in response to valid requests by public authorities.

In exceptional circumstances, we may retain personal data beyond standard periods, including:

• Ongoing legal proceedings

• Regulatory investigations

• Fraud prevention

• Protection of legal rights

• Compliance with statutory record-keeping requirements

In such cases, we will limit data retention based on the following criteria:

1. For legal and regulatory matters, data will be retained until the conclusion of proceedings or investigations, with periodic review not exceeding 12 months.

2. For fraud prevention, data will be retained for the duration of the investigation plus a reasonable period for potential future reference.

3. For protection of legal rights, data will be kept for the applicable statute of limitations period.

4. For compliance with record-keeping requirements, data will be retained for the minimum period mandated by relevant statutory regulations.

We will conduct an annual review to ensure data is not retained beyond its necessary period, with immediate deletion of any data that no longer serves a legitimate business, legal, or regulatory purpose. Upon expiration of these retention periods, data will be permanently and securely deleted through methods including secure digital destruction (e.g., cryptographic erasure, secure file shredding) and physical destruction of any hard copies, ensuring complete and irretrievable removal of personal information. We will maintain strict confidentiality and security measures throughout the retention period.

Data Security

We conduct reviews and updates on an annual basis, with additional ad-hoc reviews triggered by significant technological changes, emerging security threats, or regulatory updates. These reviews ensure our security protocols remain current, effective, and aligned with the latest industry best practices and technological advancements.

We implement appropriate technical and organizational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These security measures are reviewed and updated at least annually, or immediately in response to emerging security threats or technological changes.

Cookies

We use cookies and similar tracking technologies to track the activity on our website and hold certain information. Cookies are files with a small amount of data which may include an anonymous unique identifier. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent.

Third-Party Links

Our website may contain links to third-party websites. We do not control these third-party websites and are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party websites you visit.

Your Rights

We maintain records of all user consents, including the specific permissions granted. These consent records are securely stored and can be referenced or updated upon user request.

Depending on your location, you may have the following rights regarding your personal data:

• Data Processing Restriction: You have the right to request restriction of processing of your personal data in the following circumstances:

• When you contest the accuracy of your personal data, for a period allowing us to verify the data's accuracy

• When the processing is unlawful, and you oppose the erasure of the data and request restriction instead

• When we no longer need the data for processing purposes, but you require the data for establishing, exercising, or defending legal claims

• When you have objected to processing pending verification of whether our legitimate grounds override your interests

To exercise any of these rights, please contact our Data Protection Officer by email at [email protected] or by writing to our official address at 131 South Stage Rd, Medord OR 97501. Requests will be processed within 30 days, and we may require verification of your identity to protect your personal information.

• Data Portability: You can request to receive your personal data in a structured, commonly used, and machine-readable format, and have the right to transmit this data to another service provider.

• Access: You can request access to your personal data and ask how it is used.

• Rectification: You can request corrections to any inaccurate personal data.

• Erasure: You can request the deletion of your personal data.

• Objection: You can object to the processing of your personal data.

To exercise these rights, please contact us at [email protected]. We will respond to your request within 30 calendar days of receipt, in compliance with data protection regulations. In cases where we use automated decision-making or profiling, we will provide clear information about the logic involved, the significance, and potential consequences of such processing, and you have the right to request human intervention, express your point of view, and contest the decision.

• Security Incident Reporting: We take data security seriously and provide multiple channels for reporting potential security incidents:

• For employees: Internal reporting through our dedicated security reporting platform

• For external parties: Report any suspected security incidents or data breaches to [email protected]

• Urgent security concerns can also be reported by phone at 541-351-7414

We investigate all reported incidents promptly and take appropriate corrective actions.

Changes to This Privacy Policy

We will notify users of any material changes to our data retention policy via email to the address associated with your account and through a prominent notice on our website. Such notifications will be provided at least 30 days before any significant changes take effect, allowing you time to review and understand the modifications.

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page. We encourage you to review this Privacy Policy periodically for any changes. In particular, we will provide clear notification of any modifications to our international data transfer practices, including changes in data protection mechanisms, transfer locations, or compliance frameworks.

Contact Us

If you have any questions about this Privacy Policy, please contact us:

Our Privacy Officer is responsible for handling all privacy-related inquiries. If you have any questions or concerns about our privacy practices, please contact our Privacy Officer directly.

• Hours of Availability: Monday to Friday, 9:00 AM to 5:00 PM Pacific Time

• Response Time: We aim to respond to all privacy inquiries within 7 business days.

• Contact Information for Privacy Inquiries

• Mailing Address: Precision Equine Cryotherapy Attn: Privacy Officer (Location Below)

• Direct Phone: 541-351-7414

• By email: [email protected]Global Footer

• By mail: 131 South Stage Rd, Medford, OR, 97501, USA