Privacy Policy

Who we are, and what this policy covers

NutriClient™ is a practice-management platform for health and wellness professionals, operated by Effect Wellness, Inc., a corporation formed in the State of Delaware, United States, whose registered office is at 16192 Coastal Highway, Lewes, Delaware 19958.

This policy covers two different kinds of information, and the difference matters more than anything else in this document:

• Information about you as a practitioner or practice — your account, your practice settings, your billing. We decide how this is used, and we answer for it.
• Information about your clients — including their health information. Your practice holds that record and answers for it. We hold it on your behalf, under your instructions. We do not use it for our own purposes, and we do not sell it.

Everything below is organised around that split.

One company, several products

Effect Wellness, Inc. makes NutriClient™ and several other practice-management products for other professions. They share one platform, one company, and this one privacy policy.

Two things follow that are worth knowing:

• Your practice's data is not shared between products, or between practices. Each practice's records are separated from every other practice's, whichever product you use.
• If you ask us to stop sending you marketing email, we stop across all of our products — not only the one you asked through. That is deliberate: one request should not have to be made more than once.

Information we collect about you

• Account and profile — name, email, credentials you choose to record, practice details, professional information you enter.
• Usage — how you use the platform: features opened, actions taken, errors encountered. Used to run and improve the service.
• Billing — handled by our payment processor. We hold transaction records; we do not store full card numbers.
• Communications — messages you send us, and your marketing-communication preferences.
• Website measurement — see section 11.

Information your practice records about clients

Where you record client information — including health information, assessments, notes and measurements — your practice is the custodian or controller of that information, and is responsible for the lawful basis on which it is collected and used. We process it on your instructions, to provide the platform.

Access is limited by the treating relationship, and it is enforced in the database rather than by screens alone: a clinical record is reachable by the practitioner in a care relationship with that client. Administrative roles handle billing and practice operations and do not carry a general right to browse clinical content. Where an administrative action does cross into records, that crossing is recorded.

Where your practice bills clients through the platform, the client’s payment details are handled directly by our payment processor; we hold the transaction record, and we do not store full card numbers.

Client information is never used to train AI models — not ours, and not our AI provider's. We do not use client clinical information for our own analytics or for marketing, and we do not sell it. Where a practice uses our outcome-reporting features, those report on that practice's own clients, for that practice.

United States — HIPAA

Some of our customers are covered entities under HIPAA. Where a customer is a covered entity and we handle protected health information on its behalf, we are that customer's business associate, and we will enter into a business associate agreement with it. That status follows from what we do with the information — it is not something either of us chooses.

As a business associate we are directly responsible for the HIPAA Security Rule safeguards, for using and disclosing protected health information only as the agreement and the law permit, for holding written agreements with any subcontractor that handles it, and for notifying the covered entity of a breach within the time the rule requires.

Whether HIPAA applies to your practice depends on how you bill and transact. Many cash-pay practices are not covered entities. Where a customer is not a covered entity, HIPAA does not apply to that practice's records, and the protections in this policy and in your agreement with us apply instead.

If your practice requires a Business Associate Agreement, email privacy@effectwellness.com and we will sign one with you.

Canada — PIPEDA and the provincial health information acts

In Canada, our handling of personal information is governed by PIPEDA, and by the substantially similar private-sector laws of Alberta, British Columbia and Quebec where they apply.

Where your discipline makes you a custodian (or trustee) under a provincial health information act — Alberta's Health Information Act, Ontario's PHIPA, and the equivalent statutes in the other provinces — you hold the record and the duty, and we act as your service provider under a written agreement that carries the obligations those statutes require of that role. Where your discipline is not designated a custodian, the same information is protected under PIPEDA or the applicable provincial private-sector law, and our obligations to you are the same in substance.

Accountability. Bryan Pachal, our Privacy Officer, is responsible for our compliance with this policy and can be reached at privacy@effectwellness.com.

Quebec

Quebec's Act respecting the protection of personal information in the private sector applies to personal information about people in Quebec. We publish here:

• the person in charge of the protection of personal information — Bryan Pachal, Privacy Officer, privacy@effectwellness.com;
• our governance policies, in clear and simple language — see our governance page;
• that personal information is communicated outside Quebec (section 12), and who assesses that communication as the Act requires: your practice for its client records, using the assessment pack we provide, and us for the information we are responsible for ourselves;
• your rights of access, correction, portability, de-indexing and withdrawal, and how to exercise them (section 15);
• how to complain to us, and that you may also complain to the Commission d'accès à l'information (section 17).

French. Separately from the privacy law above, Quebec's language legislation governs the language of contracts, invoices and commercial documents. Where you are in Quebec, the French version of an agreement is provided to you before you agree to it, and you are never charged for it.

Why we use information, and on what basis

Our outcome-reporting features let a practice see how its own clients are doing in aggregate. That is the practice's own quality-assessment activity on its own records, and we name it as a purpose rather than assume it. It never pools one practice's clients with another's.

Service providers

We use a small set of vetted providers to run the platform — hosting and storage, payments, email, telehealth video, push notifications, error monitoring, product usage measurement, and optional AI features. We are accountable for information we transfer to them, and we require each to use it only to provide its service to us. Where a provider handles production client information, a written data-processing agreement covers it. For most of our providers that agreement is part of their standard terms. Where a provider asks for a separate acceptance or signature, we complete it before that provider handles any client information. If you need to know where a specific provider stands, ask us and we will tell you.

The current list, with each provider's purpose and location, is at our providers page. We update it before adding any provider that will handle production client information.

Optional integrations and optional AI

Some features send information to a partner only when your practice turns them on, and are disclosed at the point you enable them.

Optional AI features help draft notes, plans and summaries. They run on Anthropic's Claude models through Amazon Bedrock, a service of Amazon Web Services, and they process information in the United States. Amazon Bedrock does not keep what is sent to it once the request is answered, Anthropic never receives it, and client information is never used to train AI models. When these features are on, client information is excluded by default and included only where your practice turns it on. A practitioner reviews every draft before it becomes part of any record — nothing enters a client record without a human decision.

Telehealth sessions can be recorded and transcribed only with the consent of everyone in the session, with a visible indicator while recording runs.

Website measurement and cookies

Our marketing sites measure visits with PostHog, hosted in the United States, only if you agree in the cookie banner. With your agreement it counts visits, where they came from and where people click and scroll; session recordings run only if you turn them on separately, and what you type is never recorded. Until you choose, and if you choose Reject all or your browser sends a Global Privacy Control or Do Not Track signal, none of it loads. We do not use advertising pixels or remarketing, and we do not sell or share information for advertising. You can change your choice at any time from Cookie settings at the bottom of every page.

In the authenticated application we use what is necessary to keep you signed in and the service working, and we measure how practitioners use the product — which features are opened and which actions are taken — so that we can improve it. That measurement is the usage information described in section 3, and it never includes client clinical content. The full list is on our cookies page.

Where information is held, and cross-border handling

Client records, clinical files and backups are held in our database in the United States (Oregon). Other kinds of information are handled where the provider that handles them runs: live telehealth video travels over a global network and may be routed outside the United States, while session recordings and transcripts are stored in the United States, and optional AI features process information in the United States without keeping it. Each provider is listed with its location on our providers page.

Because information is held outside Canada, it may be accessed by the courts, law enforcement and national security authorities of the United States. Each provider that handles client information is bound by a written data-processing agreement with protections comparable to those in this policy.

Quebec. Personal information about people in Quebec is communicated and kept outside Quebec. Section 17 of the Act respecting the protection of personal information in the private sector requires whoever is responsible for that information to assess the privacy risks before it leaves Quebec. For client records, that is your practice. The practice is responsible for its clients' information, so the assessment is the practice's to make. We give every practice in Quebec an assessment pack with the facts it needs: where each kind of information is held, which providers handle it, and the protections that bind them. For the information we are responsible for ourselves, such as practitioner account details, we make that assessment before the information leaves Quebec. Each provider is bound by a written data-processing agreement.

Alberta. We use service providers outside Canada, in the United States, to store and process personal information in order to provide the service. To ask about our policies and practices on service providers outside Canada, contact our Privacy Officer, Bryan Pachal, at privacy@effectwellness.com.

How long we keep information

We keep information for as long as it is needed for the purpose it was collected for, and then delete it — except where a professional or legal record-keeping obligation requires us to keep it longer, in which case we keep it for that period and no longer.

Closing your account is not the same as deleting records. Clinical records are subject to retention floors set by your profession and your jurisdiction — often many years, and longer for records of minors. Where a floor applies, the record is retained under those rules and is not deleted on request. Where no floor applies and no other purpose requires it, information is deleted.

Export and cancellation

You can export your practice's data when you cancel. The export remains available for the export window, after which we stop making the export available.

Note that this is about the export, not about the records: the retention rules described in section 13 continue to apply to clinical records regardless of the export window.

Your rights

Depending on where you are, you may ask us to: access the information we hold about you · correct it · delete it · give you a copy in a portable form · withdraw consent · de-index information about you where the law provides for it · object to a use, or ask us to stop.

Write to privacy@effectwellness.com. We will verify who you are before acting, and respond within the time the applicable law allows.

If your request is about a client record held by a practice, we will direct you to that practice, which holds the record — and we will help the practice respond.

Marketing communications

We send marketing email to practitioners only where we have a lawful basis to, always name the sender and our mailing address, and include an unsubscribe link in every message. One unsubscribe stops marketing email from us across all of our products (section 2).

Service and billing messages about your account are not marketing and continue while you have an account — they also carry an unsubscribe link where the law requires one.

Complaints

If you are unhappy with how we have handled your information, write to privacy@effectwellness.com and we will investigate.

You may also complain to a regulator: the Office of the Privacy Commissioner of Canada, your provincial privacy commissioner (including the Commission d'accès à l'information in Quebec, and the Information and Privacy Commissioners of Alberta, British Columbia and Ontario), or, in the United States, your state Attorney General.

Security

Client data is encrypted in transit, and encrypted at rest in our database and file storage. Telehealth session recordings and transcripts, which our telehealth provider holds for us, are encrypted at rest too. Access to clinical records is controlled by role- and relationship-based permissions enforced at the database layer. Administrative access, disclosures and exports of clinical records are recorded as part of the action. We maintain a documented incident-response process, and we notify affected practices and regulators when the law requires it.

More detail is on our security page.

Breaches

If a breach of security safeguards creates a real risk of significant harm — or meets the notification threshold of any law that applies to it — we will notify the affected people and the relevant regulators within the time that law requires. We keep a record of every breach, including those we determine are not notifiable.

California

California's Confidentiality of Medical Information Act treats a business that offers software maintaining medical information as a provider of health care. We handle medical information under that Act, and we disclose it only as the Act permits or as the practice directs. We do not disclose medical information for marketing.

We are not currently a "business" subject to the CCPA and CPRA thresholds. If that changes, this policy will be updated before it does.

Washington, Nevada and consumer health data

Washington's My Health My Data Act and Nevada's equivalent apply to consumer health data. Our Consumer Health Data Privacy Policy — a separate document, as those laws require — describes what consumer health data we collect, where it comes from, who we share it with, and how to exercise your rights.

We do not sell consumer health data.

Children

NutriClient™ is a professional tool and is not directed to children as consumers. A practice may record information about a minor client under its own authority and consent obligations; that information is handled as client information under section 4, and the practice is responsible for it.

Changes to this policy

We will post any change here and update the date at the top. Where a change is significant, we will tell account holders before it takes effect.

Contact

privacy@effectwellness.com · Effect Wellness, Inc. · registered office: 16192 Coastal Highway, Lewes, Delaware 19958, United States