Legal
Privacy notice
1. Who we are
Veda Detox ("we", "us") runs vedadetox.com and the Veda Detox client portal. Contact for all privacy questions and requests: privacy@vedadetox.com. Veda Detox is not yet a registered company. Once it is registered, the operator will be Veda Detox LLC, and we will update this notice.
Laura Elisa Villalobos Lopez, B.A.M.S. (India), Ayurveda & Wellness Educator, provides Ayurvedic wellness education. This is not medical care. We are not a health care provider covered by HIPAA, and this notice is not a HIPAA notice.
2. Who this notice covers
This notice is for clients in the United States, who must be 18 or older. Clients in Mexico will get a separate aviso de privacidad under Mexican law. Until it is published, features that need it (including the year-of-birth question) stay off for clients in Mexico.
3. What we collect and why
| What | Why |
|---|---|
| Contact and account details: name, email, phone, language, time zone, state or country | To create your account, book and run sessions, send receipts and service messages |
| Intake and wellness answers, tongue photos, and any lab results you choose to share | To prepare Laura's wellness assessment and your education plan (health information) |
| Year of birth (optional) | See below |
| Assessment grade suggestions that our software makes from your answers using fixed rules | To help Laura prepare your plan. Laura reviews and can change every value. Suggestions are never shown to you or used without her review |
| Consent and acknowledgment records: what you agreed to, the version, the date and time | To show what you agreed to and when |
| Payment records (manual payments) | Accounting and tax |
| Technical and security data: sign-in events, error reports, password-safety checks | To keep the service working and secure |
| Maha chat usage counts (which answer was shown, the language, a random chat ID) | To improve Maha's approved answers. Maha does not keep your IP address, device details or account ID |
Year of birth (optional). If you provide it, we use it only to tailor your wellness assessment to your stage of life and to choose a formal or informal form of address in Spanish. We do not use it to set prices, decide eligibility, or for marketing. We keep it with your intake record under the same retention and deletion rules. We never ask for your full date of birth.
4. Features that are off today
These features are off. We will update this notice, and ask for your consent where needed, before turning any of them on: - Recording or transcribing video sessions. Sessions run on Zoom, and recording and transcription stay off. - Sending your intake, answers or session content to outside AI services. - Saving the text of your Maha questions.
5. What we do not do
- We do not sell your personal data or consumer health data.
- We do not share your data for targeted or cross-context advertising, and we do not use ad pixels.
- We do not try to re-identify de-identified data, and we require anyone who handles it for us to make the same commitment.
6. Who handles data for us
Service providers process data only on our instructions, to run the service: Supabase (database and sign-in), Cloudflare (portal hosting), Google Gmail (sign-in and service emails), Zoom (video sessions, with recording and transcription off), Sentry (error reports), Netlify (public website), and Mailgun (email forwarding for vedadetox.com addresses). Some are in the United States, so your data may be stored there. Otherwise, we disclose data only when the law requires it, or to protect someone's safety.
7. How long we keep it
- Client records (intake, assessments, plans, session notes): 5 years after your last service, or longer where a law requires it.
- Disclosure acknowledgments and consent records: at least 3 years, and as long as the records they relate to.
- Accounting records: as long as tax law requires.
- Maha usage counts: 12 months. When a period ends, we delete the data, or de-identify it so it can no longer be linked to you.
8. Your rights
You can ask to see, get a copy of, correct or delete your data, or withdraw a consent. Email privacy@vedadetox.com. We will verify your identity before acting, and we will not treat you differently for using your rights. Withdrawing a consent stops future use. Some records may be kept where a law requires it.
Minnesota, Rhode Island and New Mexico clients: you may request your records in writing by emailing privacy@vedadetox.com. An email request counts as a written request. We will verify your identity and send copies free of charge within 30 days.
9. Washington and Nevada: Consumer Health Data Privacy Policy
This section is our consumer health data privacy policy under Washington's My Health My Data Act (RCW 19.373) and Nevada's SB 370 (NRS chapter 603A). It is also posted as its own page at vedadetox.com/health-data-privacy, linked from our homepage. - Consumer health data we collect: intake and wellness answers, tongue photos, lab results you share, assessment grade suggestions, and year of birth when it is given with your intake. - Why: to provide the wellness education and plan you ask for, as described in section 3. - Source: you. - Shared with: only the service providers in section 6, acting on our instructions. We do not sell it, and we do not share it with third parties or affiliates. - Consent: we collect it only with your consent, given by ticking a separate box, or as necessary to provide the service you request. - Your rights: confirm whether we collect it, access it, get a list of the providers we share it with, delete it, and withdraw consent. Email privacy@vedadetox.com. If we deny a request, you may appeal by replying to our decision with "Appeal". We will answer the appeal in writing. If you are not satisfied, you may contact your state Attorney General.
10. Security
Access is limited to Laura and authorized staff, and staff sign-in uses two-factor authentication. No system is perfectly secure. If a breach affects your data, we will notify you as the law requires.
11. Children
Our services are for adults 18 and older. If we learn that we hold data from someone under 18, we will close the record and delete the data except where a law requires us to keep it.
12. Changes
We will post changes here with a new version and effective date. If a change affects something you agreed to, we will ask you again before the change applies to you.