Chronic Health Wisdom (“we,” “us,” Cheri Sacks, RN) respects your privacy. This policy explains what information we collect, how we use it, and the choices you have — including when you use our secure member portal and Sanctuary tools. We design for strong privacy controls and align with GDPR principles and major U.S. state privacy laws where they apply.

Who we are (and what we are not)

We provide health coaching and education — alternative / integrative wellness support. We do not provide medical diagnosis or treatment, and using this site does not create a doctor–patient relationship. We are not treating the portal as a formal HIPAA-covered electronic medical record. Even so, we design and operate the portal with strong privacy and security controls (encryption, access limits, audit logging, consent) so your information is protected and so we can grow responsibly if regulatory requirements change later.

Information we collect

Contact and inquiry data. Name, email, phone (if provided), and messages you send via forms or email when you ask for a free chat or resources.
Account data. Email, optional name, marketing preferences, and app preferences (for example Sanctuary planner favorites) when you create a free portal account.
Portal health information (only with your consent). Metrics and notes you choose to log (such as glucose, blood pressure, weight, medications, and condition notes). We do not collect these until you explicitly opt in on the consent page.
Sanctuary engagement signals (only with insights consent). Allowlisted activity such as which Sanctuary tools you open, session counts, and game scores. These signals can have coaching value for Cheri and power dashboard recommendations. We do not store free-text health notes in this channel. Without insights consent, personalization stays local on your device or uses only coarse defaults.
Secure messages and documents. Messages you exchange in the portal and files you upload or that are shared with you there (only after relevant consent / sharing settings).
Usage information. Basic technical logs (security, rate limits). With your optional analytics consent: first-party site analytics (pages, clicks, funnels, device type, time spent, and signed-in portal identity) so we can improve the experience. With separate insights consent: Sanctuary engagement signals described above. For every visitor, Cloudflare, which delivers the site, counts page views and page-load times with its Web Analytics, without cookies and without tracking you across other websites. This site also uses Kief Studio’s self-hosted, cookieless analytics for security and site health.
Care-team relationships. If you accept a care-team invitation, we record that link and the limited permissions you grant (for example messaging or shared documents).

How we use your information

To respond to inquiries and provide coaching, education, and support you request.
To operate your portal account, Sanctuary tools, and (if consented) health logging and messaging.
With insights consent: to personalize your portal dashboard (suggested tools and blog reading), to suggest relevant content over time, to help place you on appropriate educational email lists, and so Cheri can review engagement patterns for coaching preparation.
To notify you of new portal messages — notification emails do not include clinical content.
To send marketing or tips only with your separate marketing consent.
To maintain security, prevent abuse, and improve the website.

Legal bases (GDPR / UK GDPR)

If you are in the European Economic Area, UK, or another region with similar rules, we process personal data under one or more of these bases:

Contract / steps prior to contract — providing the portal and coaching services you request.
Consent — health logging, secure messaging, Sanctuary insights, and marketing. You may withdraw consent at any time in Privacy & data or by contacting us (withdrawal does not affect processing already completed).
Legitimate interests — securing the site, preventing abuse, and basic product improvement, balanced against your rights.
Legal obligation — where we must retain records or respond to lawful requests.

Health-related data is processed only with your explicit consent or as otherwise permitted by applicable law. We are not currently operating as a HIPAA-covered entity for this portal, but we apply strong safeguards by design.

Your rights under GDPR

Where GDPR applies, you may have the right to:

Access a copy of your personal data (including the in-portal export tool).
Rectify inaccurate data.
Erase data (“right to be forgotten”), subject to legal retention limits.
Restrict or object to certain processing.
Data portability for data you provided.
Withdraw consent without affecting prior lawful processing.
Lodge a complaint with your supervisory authority.

Contact [email protected] to exercise these rights. We will respond within the timelines required by law.

U.S. state privacy rights

Residents of certain U.S. states (including California, Virginia, Colorado, Connecticut, Utah, and others with similar comprehensive privacy laws) may have rights to know, access, correct, delete, and opt out of certain processing of personal information, and to non-discrimination for exercising those rights.

We do not sell personal information and we do not share it for cross-context behavioral advertising as those terms are commonly defined.
Sensitive information (such as health data you log) is used only for the coaching purposes you consent to.
California residents may request disclosure of categories of personal information collected, sources, purposes, and third parties, and may request deletion or correction.
You may designate an authorized agent where state law allows; we may need to verify identity before fulfilling a request.

To submit a state privacy request, email [email protected] with the subject line “Privacy request” and your state of residence.

International transfers

Our hosting and service providers may process data in the United States or other countries. Where required, we use appropriate safeguards (such as contractual clauses) for cross-border transfers.

How we share information

We do not sell your personal information. We share it only with trusted service providers who help us run the site and communicate with you (for example hosting, content delivery and security by Cloudflare, email delivery, and authentication), only as needed for those services, or where required by law. If you accept a care-team member (such as a referring case manager), they see only what you and the permission settings allow — not a global list of other patients.

Health information & secure channels

Please use the secure portal for health logs and clinical-style conversations. Email and ordinary web contact forms are not ideal for sensitive medical details — they may be used for scheduling and general questions, but the portal is the protected place for health data and coaching messages.

Security measures (summary)

Separate staff and member access; staff sign-in uses strong authentication where configured.
Encryption for sensitive free-text fields and portal messages at rest.
Access controls so patients only see their own data; care-team access is relationship-based.
Consent records for health data and messaging; you can revoke in portal settings.
Audit logging of access to health records.

Your choices & rights

Export. Signed-in members can download a copy of their portal data from Privacy & data.
Revoke consent. You can turn off new health logging, messaging, or Sanctuary insights from the same settings page (history may be retained for coaching continuity unless you ask us to delete it).
Access, correction, deletion. Email us to request access, correction, or deletion of personal information we hold about you.
Marketing. Opt out of optional updates anytime via the link in emails or by contacting us.

Retention

We keep account and coaching-related records while your relationship is active and for a reasonable period afterward for continuity, legal, and security purposes. You may request deletion; some records (for example audit trails) may be retained longer where required for security or legal reasons.

Cookies

We use cookies and similar technologies as described in our Cookie Policy, including essential session cookies for the portal and staff admin.

Children

The site and portal are intended for adults. We do not knowingly collect information from children under 13.

Changes

We may update this policy as the portal and services evolve. The “updated” date at the top will change when we do. Continued use after updates means you accept the revised policy.

Contact

Questions about this policy? Email [email protected].

Privacy Policy