1. Overview
This Privacy Policy describes how The Clark Technique ("we," "us," or "our") collects, uses, and protects your information when you create an account and use our platform ("Service").
By using the Service, you agree to the terms outlined in this policy. If you do not agree, please do not use the Service.
We do not sell, rent, or trade your personal information. Your data is used solely to operate and improve the Service for you.
2. Information We Collect
We collect the following categories of information:
a. Personal Information
- Full name (first and last)
- Email address
- Phone number
- Date of birth and biological sex (used for health metric reference ranges)
- Account login credentials (passwords stored using bcrypt hashing)
b. Health & Wellness Data
- Lab results and biomarker values you upload or manually log
- Body composition metrics (weight, body fat %, lean mass, measurements)
- Fitness assessments and performance data
- Nutrition logs and dietary information
- Wearable device data (heart rate, sleep, steps, HRV) synced to your account
- Health documents you upload for AI analysis (lab reports, wellness assessments, PT notes, chiropractic records)
- Coaching notes and session records created by your assigned coach
c. Usage Information
- Login activity and session timestamps
- Transactions, purchases, and credit activity
- Session and device data (IP address, browser type, user agent)
- HIPAA-required audit logs of health data access events
d. Communication Preferences
- SMS opt-in status, consent timestamp, and IP address at time of consent
- Email subscription and notification preferences
3. How We Use Your Information
We use your information strictly for the following purposes:
- To create and manage your account
- To deliver personalized coaching services and track your health progress over time
- To analyze uploaded lab reports and health documents using AI to extract metrics
- To provide health metric interpretation, reference ranges, and trend analysis
- To process transactions and manage your credit wallet
- To send important service-related notifications (booking confirmations, billing updates, account alerts)
- To provide customer support
- To improve platform functionality and user experience
- To comply with applicable legal and regulatory obligations, including HIPAA
We do not use your information for advertising, third-party marketing, or data profiling.
4. SMS and Email Communications
SMS Program: Account Notifications & Service Alerts Program
By creating an account and checking the SMS consent box during registration, you consent to receive SMS messages from The Clark Technique related to:
- Account activity and security alerts
- Booking confirmations, reminders, and changes
- Billing events and credit transactions
- Important service updates
Message Frequency
Message frequency varies based on your account activity.
Message & Data Rates
Standard message and data rates may apply depending on your mobile carrier and plan.
Opt-Out
You can opt out of SMS messages at any time by replying STOP to any message we send. You may also update your communication preferences in your account settings.
Help
For help, reply HELP to any SMS message or contact us at help@theclarktechnique.com.
Email Communications
We send service-related email communications including receipts, booking updates, and account notifications. These are transactional and not promotional unless explicitly stated.
Your consent to receive SMS messages is not a condition of purchase or account creation. Mobile numbers are not shared with third parties for marketing or promotional purposes.
5. Data Sharing Policy
We do not sell, rent, or share your personal information with third parties for marketing, advertising, or data resale. Your data is only shared when strictly necessary to operate the platform:
- Payment processors – solely to process transactions (e.g., Braintree/PayPal)
- Communication providers – to deliver SMS and email notifications (e.g., Twilio, SMTP providers)
- Cloud storage – encrypted document storage (AWS S3 with AES-256 server-side encryption)
- AI analysis providers – for lab document parsing only when a HIPAA Business Associate Agreement (BAA) is in place; PHI is transmitted only after BAA execution
- Infrastructure providers – for secure hosting and platform delivery
All third-party service providers are contractually required to maintain strict data protection standards.
6. Data Security
We implement industry-standard and HIPAA-required technical safeguards to protect your data:
- Encrypted data transmission (SSL/TLS) for all connections
- AES-256-GCM encryption for stored health data and lab report analysis results at rest
- Secure password hashing (bcrypt)
- Role-based access controls — coaches access only their assigned clients' data
- HIPAA audit logging of all PHI access, modifications, and disclosures (actor, timestamp, IP address)
- Session management: 8-hour inactivity timeout; no-cache and no-store headers on all PHI pages
- Presigned document access URLs expiring within 15 minutes
- Multi-factor authentication (MFA) support
- Rate limiting on sensitive endpoints (e.g., maximum 20 document uploads per hour)
- Explicit deletion of temporary files after processing to prevent PHI residue
While we take all reasonable precautions, no system is entirely secure. We encourage you to use a strong, unique password and to notify us immediately if you suspect unauthorized access.
7. HIPAA & Health Information Privacy
🏥 Protected Health Information (PHI). The Clark Technique handles health and wellness data — including lab results, body composition metrics, health history, and coaching notes — that may constitute Protected Health Information under the Health Insurance Portability and Accountability Act (HIPAA). We are committed to handling this data with the highest standards of confidentiality and security.
a. Types of Health Information We Handle
- Laboratory results and biomarker values (blood glucose, cholesterol, hormones, CBC, metabolic panels, etc.)
- Body composition metrics (weight, body fat %, lean mass, measurements)
- Fitness and wellness assessments from documents you upload
- Physical therapy, chiropractic, or other wellness provider records you choose to upload
- Wearable device data (heart rate, HRV, sleep, SpO₂)
- Coaching session notes and performance assessments created by your coach
b. Technical Safeguards (HIPAA §164.312)
- Access Control — Unique user IDs, role-based permissions, coach access restricted to formally assigned clients. Endpoints fail closed on DB error.
- Audit Controls — Every PHI access, upload, view, correction, and disclosure event is written to an audit log with actor, action, timestamp, and IP address.
- Encryption at Rest — Lab report AI analysis results stored using AES-256-GCM encryption with a per-organization key.
- Encryption in Transit — All data transmitted over HTTPS/TLS. Document access links expire within 15 minutes.
- Session Authentication — 8-hour inactivity timeout; PHI pages served with
Cache-Control: no-storeandX-Frame-Options: DENY. - Minimum Necessary — Staff and coaches access only the minimum data required to deliver your services.
c. Business Associate Agreements (BAA)
Where required by HIPAA, we maintain Business Associate Agreements with third-party vendors who process PHI on our behalf, including AI analysis providers. AI-powered lab report parsing is only enabled after a BAA is fully executed with the applicable provider.
d. Your HIPAA Rights
Where applicable, you have the right to:
- Access and receive a copy of your health records held on our platform
- Request corrections to inaccurate health information
- Request an accounting of disclosures of your PHI
- Request restrictions on certain uses or disclosures of your PHI
- File a complaint with the U.S. Department of Health & Human Services if you believe your privacy rights have been violated
- Receive this notice in an alternative format upon request
To exercise your HIPAA rights, contact us at help@theclarktechnique.com.
e. Breach Notification
In the event of a breach of unsecured PHI, we will notify affected individuals in accordance with the HIPAA Breach Notification Rule (45 CFR Part 164, Subpart D) within the timeframes required by law.
f. Scope Limitation
The Clark Technique is a wellness coaching platform and is not a covered healthcare provider, health plan, or healthcare clearinghouse under HIPAA. Our HIPAA compliance obligations arise in the context of handling health data on behalf of our users. Health data you provide is used solely to deliver coaching services and is not shared with or transmitted to any healthcare providers without your explicit consent.
8. Health Data Disclaimer
⚠️ Not Medical Advice. All health metrics, lab interpretations, reference ranges, nutrition data, body composition data, and wellness assessments provided through The Clark Technique platform are for educational and general wellness purposes only. This information is not intended to diagnose, treat, cure, or prevent any disease or medical condition, and is not a substitute for professional medical advice, diagnosis, or treatment.
Always consult a qualified healthcare provider before making significant changes to your diet, exercise routine, or health practices — particularly if you have or suspect a medical condition, are pregnant, nursing, or taking prescription medications.
AI-generated lab interpretations and nutritional estimates are approximations based on general reference ranges and may not account for your individual medical history, medications, or clinical context. Reference ranges displayed on our platform may differ from those reported by your laboratory.
9. Data Retention
We retain your personal data only as long as necessary to:
- Maintain your active account
- Fulfill legal and regulatory obligations
- Resolve disputes and enforce agreements
Specific retention periods:
- SMS consent logs — retained indefinitely as required for carrier and regulatory compliance
- HIPAA audit logs — retained for a minimum of 6 years in accordance with HIPAA documentation requirements (45 CFR §164.530)
- Health records and lab documents — retained for the duration of your account and for a minimum period required by applicable law after account closure
- Payment records — retained as required by tax and financial regulations
If you request account deletion, we will remove your personal data subject to the applicable legal retention requirements above.
10. Your Rights
You have the right to:
- Access the personal data and health records we hold about you
- Request corrections to inaccurate information
- Request deletion of your account and associated personal data (subject to legal retention requirements)
- Withdraw SMS consent at any time (reply STOP or update account settings)
- Request an accounting of disclosures of your Protected Health Information
- Object to certain processing of your data
- Lodge a complaint with the U.S. Department of Health & Human Services regarding health information privacy
To exercise any of these rights, contact us at: help@theclarktechnique.com
11. Cookies & Tracking
We use session cookies necessary to maintain your authenticated session. We do not use tracking cookies, advertising pixels, or third-party analytics that identify you personally. Cookie data is not shared with any third parties for marketing purposes.
You may configure your browser to refuse cookies, however this will prevent you from logging into the Service.
12. Children's Privacy
The Service is intended for individuals 18 years of age or older. We do not knowingly collect personal information from children under 18. If we become aware that we have inadvertently collected information from a minor, we will delete it promptly. If you believe a minor has provided us with personal information, please contact us at help@theclarktechnique.com.
13. Updates to This Policy
We may update this Privacy Policy periodically to reflect changes in our practices or applicable law. Changes will be posted on this page with a revised effective date. Where changes are material — particularly those affecting how health data is handled — we will provide notice via email or platform notification.
Continued use of the Service after changes are posted constitutes your acceptance of the updated policy.