Privacy Policy

1. Who We Are

Sanatori Co, LLC, which trades under the Sanatōri brand ("we", "us", "our"), is an on-site massage company operating in Los Angeles County, California. This Privacy Policy explains how we collect and use personal information when you interact with our website (sanatori.co) or engage our services. This policy is written to align with the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA).

If you have any questions about this policy, please contact us at hello@sanatori.co.

2. Information We Collect

We collect personal information in the following ways:

• Enquiry form: When you submit an enquiry via our website, we collect your name, company name, work email address, team size, and package interest.
• Careers applications: When you apply for a position, we collect your name, email, phone number, years of experience, licences held, specialisations, and any information you include in your personal statement.
• Employee booking data: When employees of client companies self-book sessions, we collect their name, preferred service, and appointment time. We may also collect brief intake information (areas of concern, relevant health notes) shared with the treating therapist. This intake information is medical information under California's Confidentiality of Medical Information Act (CMIA), and we handle it accordingly (see Section 4).
• Website usage data: We may collect anonymised analytics data about how visitors use our website, including pages visited, time on site, and referring sources.

3. How We Use Your Information

We use the information we collect for the following purposes:

• To respond to enquiries and communicate with prospective clients
• To plan, schedule, and deliver on-site sessions
• To process career applications and communicate with candidates
• To ensure the safe and appropriate delivery of therapeutic sessions
• To send follow-up communications related to your booking (e.g. feedback requests)
• To improve our website and services through anonymised analytics

We do not sell or share your personal information as those terms are defined under the CCPA, and we do not use cookies or trackers for cross-context behavioral advertising. We do not use your personal information for unsolicited marketing purposes.

4. Health Information

We treat any health-related information shared by employees during session intake assessments with the utmost care and confidentiality, consistent with California's Confidentiality of Medical Information Act (CMIA). This information is used solely to ensure the safe and effective delivery of the therapeutic session. It is not shared with the client company, not stored beyond 30 days after the session date, and never used for any purpose other than direct care.

5. Data Sharing

We do not sell your personal data. We may share information with:

• Our therapists: Booking and intake information is shared with the treating therapist to prepare for and deliver sessions.
• Service providers: We may use trusted third-party tools for scheduling, email, or analytics. These providers are contractually required to handle data securely and only for the purposes we specify.
• Legal requirements: We may disclose information if required to do so by law or in response to valid legal process.

6. Data Retention

We retain client and booking data for up to three years following the booking date for accounting and legal purposes. Career application data is retained for up to twelve months. Session intake notes are deleted within 30 days of the session date. You may request deletion of your data at any time by contacting us.

7. Your California Privacy Rights

If you are a California resident, the CCPA (as amended by the CPRA) gives you the following rights over your personal information:

• Right to Know — request the categories and specific pieces of personal information we've collected about you, and the purposes for collecting it
• Right to Delete — request deletion of personal information we've collected, subject to certain legal exceptions
• Right to Correct — request correction of inaccurate personal information
• Right to Opt-Out of Sale or Sharing — we do not sell or share personal information, so there is nothing to opt out of. We do not use trackers for cross-context behavioral advertising.
• Right to Limit Use of Sensitive Personal Information — request that we limit use of sensitive personal information (such as health-related intake notes) to what is necessary to deliver the service
• Right to Non-Discrimination — we will not deny services, charge different prices, or provide a different level of service because you exercised any of these rights

Do Not Sell or Share My Personal Information: We do not sell or share personal information, as those terms are defined under the CCPA. No action is needed to opt out.

To exercise any of these rights, please contact us at hello@sanatori.co. We will verify your identity before fulfilling a request and will respond within 45 days, as required by the CCPA. You may also designate an authorized agent to submit a request on your behalf.

8. Cookies

Our website may use cookies and similar tracking technologies to understand how visitors use the site. These are used for analytical purposes only. You can control cookie preferences through your browser settings. We do not use cookies to serve advertising.

9. Security

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The current version will always be available on our website. We will notify clients of any material changes by email where appropriate.

11. Contact

For any questions, concerns, or data requests related to this Privacy Policy, please contact us at hello@sanatori.co or write to us at Sanatori Co, LLC, 2108 N St, Ste N, Sacramento, CA 95816.