This Privacy Policy describes how the platform Holistic RAD, accessible at holistic-rad.com, operada por Holistic RAD, com sede em/no United Kingdom (“Plataforma”, “nós”, “nosso”), recolhe, utiliza, armazena e protege os dados pessoais dos seus utilizadores.

This policy applies to all users of the Platform: Therapists, Partners (affiliates), and website visitors. For information on the processing of personal data of Clients of therapy sessions, please refer to the Privacy Policy presented on each Therapist's mini-site.

By using the Platform, the user declares that they have read, understood, and accept this Privacy Policy.

1. Data Controller

1.1. A Holistic RAD é a data controller dos dados pessoais recolhidos diretamente pela Plataforma, nomeadamentand thedos de Terapeutas, Parceiros e visitantes do website.

1.2. Regarding the personal data of Clients of therapy sessions:

• O Terapeuta is the data controller (controller) of their Clients' data, determining the purposes and means of processing.
• A Plataforma acts as subcontratante (data processor), providing the technological infrastructure for the collection, storage, and management of data on behalf of the Therapist.

1.3. The Platform does not access the content of therapy sessions, clinical records, applied protocols, or treatment data. These data are managed exclusively by the Therapist.

1.4. For questions related to data protection, contact us via: [email protected]

2. Personal Data Collected

The Platform collects different categories of data according to the type of user:

2.1. Therapist Data

Collected during registration and use of the Platform:

• Identification and contact data: full name, email address, phone number, city, country, specialty
• Professional data: biography, profile picture, logo, social media links
• Subscription data: subscribed plan, billing period, start and expiration dates, account status
• Payment data: selected payment method, transaction identifiers (Stripe Session ID). Credit/debit card data are processed directly by Stripe and are never stored on the Platform's servers.
• Configuration data: mini-site appearance preferences, availability, configured payment methods (IBAN, PayPal, PIX, MB WAY), email signature, mini-site slug
• Interaction data with the virtual assistant (Alma): questions submitted to the assistant, conversation history, and feedback on responses. These data are used exclusively to provide contextualised assistance to the Therapist in using the Platform.

2.2. Partner (Affiliate) Data

• Identification and contact data: full name, email address, phone number
• Payment data: IBAN or PIX data (PIX key, CPF/CNPJ, account holder's name) for receiving commissions
• Activity data: referral code, referred therapists, generated commissions, programme status

2.3. Website Visitor Data

• Browsing data: pages visited, duration of visit, device used, operating system, browser
• Cookies and similar technologies: as described in our Cookie Policy
• Referral data: partner code (when applicable), stored in a functional cookie

2.4. Therapist Client Data

The Platform stores, as a processor on behalf of the Therapist, the following data provided by Clients through the scheduling form:

• Full name, email address, phone number (optional), date of birth (optional), notes or observations (optional)

These data are the responsibility of the Therapist. For more information on how each Therapist processes their Clients' data, please refer to the Privacy Policy presented on the respective Therapist's mini-site.

3. Purposes of Processing

3.1. Personal data is processed for the following purposes:

3.2. The Platform does not sell, assign, or share personal data with third parties for commercial or advertising purposes.

4. Data Sharing with Third Parties

4.1. Personal data may be shared only with the following categories of third parties, strictly for the indicated purposes:

4.2. The Platform does not share data with other categories of third parties, except when required by law or court order.

4.3. Regarding the virtual assistant Alma:

• Questions and answers are processed by third-party language models (OpenAI and/or OpenRouter) to generate contextualised responses
• No personal data of Therapist Clients are sent to these providers
• The data sent is limited to the Therapist's question and operational context information (Therapist's name, subscribed plan, current page)
• The information about dowsing provided by the assistant is of a general nature and does not replace professional training — it is the responsibility of the Therapist, with appropriate training, to verify the accuracy of the information

4.4. Regarding backups via Google Sheets:

• The data is synchronised exclusively for data recovery purposes in case of server failure
• Access to the spreadsheet is restricted to the Platform administrator
• No third party has access to this data

4.5. For more information about the privacy practices of our technology partners:

• Stripe: https://stripe.com/privacy
• Wise: https://wise.com/privacy-policy
• OpenAI: https://openai.com/privacy
• Google: https://policies.google.com/privacy

5. International Data Transfers

5.1. Os dados pessoais são armazenados em secure servers located in the United Kingdom.

5.2. Some of our service providers (Stripe, Wise) may process data in jurisdictions outside the user's country of residence, including the United States of America.

5.3. When data is transferred to jurisdictions outside the European Economic Area (EEA) or the United Kingdom, the Platform ensures that appropriate safeguards are applied, namely:

• Providers adhering to recognised adequacy programmes
• Standard Contractual Clauses (SCCs) approved by the European Commission, where applicable
• Additional technical and organisational measures

5.4. For users residing in Brazil, international data transfers are carried out in accordance with Chapter V of the LGPD (Law No. 13,709/2018).

6. Storage and Security

6.1. The Platform implements appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or destruction, including:

• Encryption in transit: communications protected by SSL/TLS (HTTPS)
• Encryption at rest: sensitive data (API keys, banking data) encrypted with AES-256-CBC + HMAC-SHA256
• Restricted access: only authorised personnel have access to the data, with different levels of permission
• Protection against attacks: protection against CSRF (nonce tokens), XSS (input sanitisation), SQL injection (prepared statements)
• Backups: regularly performed by the hosting provider
• Payment data: processed directly by Stripe (PCI DSS Level 1 certification) — card data never passes through the Platform's servers

6.2. Despite the measures implemented, no system is 100% secure. The Platform commits to notifying affected users and the competent authorities in the event of a personal data breach, as required by the GDPR (Articles 33 and 34) and the LGPD (Article 48).

7. Retention Period

7.1. Personal data is retained for the period strictly necessary for the purpose for which it was collected:

7.2. After the retention period, the data will be securely deleted or irreversibly anonymised.

7.3. Data may be retained beyond the indicated periods when required by legal obligation, judicial process or fraud investigation.

8. Data Subjects' Rights

8.1. In accordance with the General Data Protection Regulation (GDPR — Regulation (EU) 2016/679) and the Brazilian General Data Protection Law (LGPD — Law No. 13,709/2018), the user has the following rights:

8.2. To exercise any of these rights:

• Therapists and Partners: Podem exercer o direito de acesso e portabilidade diretamente através do painel de gestão (exportação dand thedos). Para eliminação ou outros direitos, contacte [email protected].
• Clients of Therapists: Should contact the Therapist responsible for their data directly. The Therapist can request the Platform to delete the data from its servers.

8.3. The Platform commits to responding to requests to exercise rights within a maximum period of 30 (thirty) days, as required by applicable legislation.

8.4. The user has the right to lodge a complaint with the competent data protection authority in their country of residence. Examples:

• United Kingdom: Information Commissioner’s Office (ICO) — ico.org.uk
• Portugal: National Data Protection Commission (CNPD) — cnpd.pt
• Brazil: National Data Protection Authority (ANPD) — gov.br/anpd

9. Minors

9.1. The Platform is intended for users aged 18 (eighteen) years or older. By registering, the user declares they are at least 18 years old.

9.2. The Platform does not intentionally collect personal data from minors. If we become aware that data from a minor has been collected without the consent of the respective legal guardian, we will proceed with its immediate deletion.

9.3. Regarding the treatment of minors by Therapists: Therapists may attend to Clients under 18 years old, provided the appointment is made by the respective legal guardian. This responsibility lies solely with the Therapist, as per the Privacy Policy presented on their mini-site.

10. Therapeutic Session Data

10.1. The services provided by Therapists through the Platform fall within the scope of complementary and holistic therapies. They do not constitute medical services, clinical diagnoses or conventional health treatments.

10.2. The Platform provides technological tools (radionic charts, biometers, rates, protocols) that are used exclusively by the Therapist, under their full responsibility.

10.3. The Platform does not access, analyse, monitor or make decisions based on therapeutic session data. These data are encrypted and stored on the Platform's servers exclusively on behalf of the Therapist.

10.4. The Platform allows the Therapist, at their initiative and option, to share with their Client a treatment tracking link. The activation of this feature is entirely voluntary and the responsibility of the Therapist. When activated:

• A unique and exclusive token is generated, associated with the tracking link
• An email is automatically sent to the Client with the link to track treatment progress
• The link only displays progress information that the Therapist has chosen to share
• The link does not require Client registration or authentication
• The link is excluded from search engine indexing
• The Therapist can deactivate the link at any time
• Automatic deactivation for security: after the treatment is concluded, the link is automatically deactivated within 7 (seven) calendar days. After this period, the Client no longer has access to the tracking link

11. Virtual Assistant and Artificial Intelligence

11.1. The Platform provides a virtual assistant called “Alma”, integrated into the management panel, which uses artificial intelligence technology (language models — LLM) to assist Therapists in using the Platform.

11.2. The Alma assistant has the exclusive purposes of:

• Guiding Therapists in navigating and using the Platform's features
• Answering questions about the service's operation
• Providing general introductory information about dowsing and complementary practices

11.3. The Alma assistant DOES NOT:

• Accesses personal data of Therapists' Clients
• Makes automated decisions that produce legal effects or significantly affect users
• Performs profiling or recommendations based on behavioural profiles
• Replaces professional training in dowsing or complementary therapies

11.4. The assistant's responses about dowsing and complementary practices are general and informative. The accuracy and applicability of this information are the sole responsibility of the Therapist, who must have adequate training to assess its truthfulness.

11.5. Conversations with the assistant are stored for 6 (six) months to ensure continuity of assistance context, being automatically deleted after this period.

11.6. The Platform may, in the future, provide a text-to-speech functionality for reading the assistant's responses, with the aim of facilitating understanding. If this functionality is activated, users will be informed and this Policy will be updated accordingly.Text-to-speech) for reading the assistant's responses, with the aim of facilitating understanding. If this feature is enabled, users will be informed and this Policy will be updated accordingly.

12. Changes to the Privacy Policy

12.1. This Privacy Policy may be updated at any time to reflect changes in our data processing practices or applicable legislation.

12.2. Significant changes will be communicated to registered users by email. We recommend periodically checking this page.

12.3. The date of the last update is indicated at the beginning of this document.

13. Contact

For questions related to personal data protection or to exercise your rights:

📧 Data Protection Email: [email protected]
📧 Support Email: [email protected]
🌐 Website: holistic-rad.com

For questions related to personal data of Clients from therapy sessions, contact the responsible Therapist directly through the contacts provided on the respective mini-site.