Privacy Policy

This Privacy Policy explains how RedGen Annapolis ("RedGen", "we", "us") collects, uses, and protects your information when you use the RedGen mobile app or book with us at app.redgenannapolis.com (together, the "Services").

If you do not agree with this policy, please do not use the Services.

1. Information We Collect

Information you give us

• Account information — your name, email address, phone number, and password. Passwords are stored only as a one-way cryptographic hash; we never store or see your password itself.
• Booking information — the services you book, the practitioner you book with, appointment dates and times, appointment status, and any notes you add to a booking.
• Intake and consent forms — answers to any intake, consent, or waiver form attached to a service you book. Depending on the service, these forms may ask about your health, medical history, or physical condition. See Section 6.
• Membership and package records — the plan or package you hold, sessions used and remaining, billing period, and pause or cancellation history.

Information we collect automatically

• Push notification tokens — if you allow notifications, we store the push token issued by Apple or Google for your device, together with the device platform (iOS or Android), so we can send you appointment reminders and updates. This token identifies a device installation, not you personally, and is deleted when you delete your account.
• Log and technical data — IP address, request timestamps, and error logs generated by our servers in the normal course of operating and securing the Services.

Payment information

Payment for services is collected in person at our studio, not inside the app. When you pay us, card processing is handled by Square. RedGen receives a record that a payment occurred — amount, date, and status — but we do not receive or store your full card number, CVV, or bank credentials. Square's handling of your payment data is governed by Square's Privacy Notice.

2. How We Use Your Information

We use the information above only to run our business and serve you. Specifically, to:

• create and maintain your account and authenticate you when you sign in;
• schedule, confirm, change, and cancel your appointments;
• send appointment confirmations, reminders, and changes by push notification, email, or text message;
• track membership and package sessions, and apply them correctly to your bookings;
• keep the service records and consent forms our practitioners need to treat you safely;
• respond to your questions and support requests;
• keep the Services secure, detect abuse, and meet our legal and recordkeeping obligations.

We do not sell your personal information. We do not share it with advertisers, data brokers, or any third party for their own marketing purposes. We do not use it for targeted advertising or cross-app tracking.

3. Push Notifications

Push notifications are optional. We ask for your permission before sending any, and you can turn them off at any time in your device settings — on iOS under Settings › Notifications › RedGen, and on Android under Settings › Apps › RedGen › Notifications. Turning them off does not affect your ability to book; you will still receive appointment confirmations by email.

4. How We Share Information

We share your information only with the service providers we need to operate, and only as far as each one needs:

• Our practitioners and staff — so they can prepare for and deliver your appointment.
• Square — payment processing for services rendered in the studio.
• Twilio — delivery of appointment text messages, where you have given us your phone number.
• Apple Push Notification service and Google Firebase Cloud Messaging, via Expo — delivery of push notifications to your device.
• Google Calendar — our practitioners may sync their own work schedules to their business calendars. Where that happens, the calendar entry contains the appointment time, service, and your name.
• Our hosting and email providers — to run our servers and deliver transactional email.

We may also disclose information if we are legally required to do so, or where we reasonably believe disclosure is necessary to protect the safety of a person, prevent fraud, or enforce our Terms of Service.

5. Data Retention

We keep your account and booking records for as long as your account is open, and afterwards only as long as we are required to for legal, tax, insurance, or health-recordkeeping reasons. Push notification tokens are removed when you delete your account or uninstall the app. Server logs are retained for a limited period and then rotated out.

6. Health Information

Some of our services involve intake or consent forms that ask about your health. We treat those answers as confidential and make them available only to the practitioners involved in your care and to the staff who administer our booking records. We do not use health information for marketing, and we never sell it.

RedGen Annapolis is a wellness studio. Unless we have told you otherwise in writing, we do not operate as a HIPAA-covered entity, and the information you provide is not personal health information subject to HIPAA. It is still protected under this policy and under Maryland law.

7. Your Choices and Rights

• See and correct your information. Your name, email, and phone number are visible and editable in the app under Profile. For anything else on your record, email us and we will provide or correct it.
• Delete your account. You can delete your account and personal information yourself, from inside the app, at any time — see Account Deletion for exactly what happens and for a way to request deletion without the app.
• Turn off notifications. See Section 3 above.
• Stop text messages. Reply STOP to any text we send.

Depending on where you live, you may have additional rights to access, port, or restrict the processing of your information. Email info@redgenannapolis.com and we will honor any right you are entitled to. We will not discriminate against you for exercising it.

8. Security

All traffic between the app and our servers runs over encrypted HTTPS connections. Your login token is stored on your device in the operating system's secure keystore — the iOS Keychain or the Android Keystore — not in ordinary app storage. Passwords are hashed and never stored in readable form. Access to client records is restricted to authorized staff.

No system is perfectly secure. If we ever learn of a breach affecting your information, we will notify you as required by law.

9. Children

The Services are not directed to children under 13, and we do not knowingly collect personal information from them. Clients under 18 must have a parent or guardian book on their behalf and complete any consent forms. If you believe a child has given us information, email us and we will delete it.

10. Changes to This Policy

If we change this policy, we will update the date at the top of this page. If the change is significant, we will tell you in the app or by email before it takes effect.

11. Contact Us