Privacy Policy

This Privacy Policy explains how Yushen MGT Incorporated ("NurtureCore Studio," "we," or "us") collects, uses, and shares information when you use the NurtureCore Studio platform at nurturecorestudio.com and related services (collectively, the "Services"). By using the Services you agree to the practices described here.

NurtureCore Studio is a wellness marketplace. We are not a healthcare provider and we do not provide medical care. Sessions delivered through NurtureCore Studio are movement coaching sessions led by licensed physiotherapists; they are not medical treatment.

1. Information we collect

Information you give us

• Account information: name, email address, password (hashed), country, phone number (optional).
• Profile information for clients: health goals you choose to share, optional notes you write to your physio.
• Profile information for physiotherapists: professional license number, NPI or provincial provider number, malpractice insurance details, tax identification (last four digits stored), clinic address, profile photo (required), bio, sample videos.
• Booking information: the sessions you book, attend, or cancel, including the time, length, and price.
• Reviews and feedback you submit.
• Communications you send to us.

Information collected automatically

• Usage data: pages you visit, links you click, browser type, device type, approximate location derived from IP address.
• Cookies and similar technologies: small data files used to keep you signed in, remember preferences, and measure how the Services are used. See "Cookies" below.

Information from third parties

• Payment processor (Stripe): we receive transaction confirmations, the last four digits of your card, and relevant Stripe identifiers. NurtureCore Studio does not store full card numbers.
• OAuth providers (e.g., Google): if you sign in with a third-party provider, we receive the basic profile information that provider chooses to share.

2. How we use information

• Operate, maintain, and improve the Services.
• Process bookings, payments, refunds, and payouts.
• Verify the identity, license, and credentials of physiotherapists.
• Send transactional communications (booking confirmations, reminders, receipts, claim status updates if you opt into insurance billing, password resets).
• Provide customer support.
• Detect and prevent fraud, abuse, and security incidents.
• Comply with legal obligations.

3. Sharing of information

We share information only as needed to provide the Services or as required by law. The categories of recipients are:

• Service providers (sub-processors): Supabase (database, auth, storage), Stripe (payments), Daily.co (video sessions), SendGrid (email), and Vercel (hosting).
• Physiotherapists you book: we share your name, the goals/notes you choose to share, and your booking time.
• Insurance clearinghouse (only if you opt into direct insurance billing): we share the minimum information required to submit a claim under CPT and ICD-10 codes.
• Legal and safety: when required by law, court order, or to protect rights, property, or safety.
• Business transfers: if NurtureCore Studio is acquired or merged, your information may be transferred as part of that transaction.

We do not sell your personal information.

4. Cookies and analytics

We use first-party cookies that are strictly necessary to keep you signed in and to remember your preferences. We use a small number of privacy-respecting analytics cookies to understand aggregate usage; you can decline these in the cookie banner shown on your first visit.

We honor "Do Not Track" signals where applicable.

5. Your rights

You have the following rights with respect to your information:

• Access: request a copy of the personal information we hold about you.
• Correction: ask us to fix information that is inaccurate.
• Deletion: ask us to delete your account and personal information, subject to limited retention obligations (e.g., tax records).
• Portability: request an export of your data in a machine-readable format.
• Withdraw consent: withdraw consent for processing where we rely on consent (e.g., marketing emails).
• Lodge a complaint: contact your local data protection authority.

To exercise any of these rights, email privacy@nurturecorestudio.com.

6. Data retention

We retain your personal information for as long as your account is active, plus a reasonable period afterward to comply with legal, accounting, and reporting obligations. Booking and payment records are typically retained for seven years to satisfy tax requirements.

7. Security

We use industry-standard technical and organizational measures to protect your information, including encryption in transit and at rest, role-based access controls, and audit logging. No system is perfectly secure, however; please use a strong, unique password and notify us immediately if you believe your account has been compromised.

8. International transfers

NurtureCore Studio operates in the United States and Canada. If you access the Services from outside these countries, you understand that your information may be transferred to and processed in countries with data protection laws different from your own.

9. Children

NurtureCore Studio is intended for adults 18 and older. We do not knowingly collect personal information from anyone under 18. If you believe we have, please contact us so we can delete it.

10. Region-specific notices

California (CCPA / CPRA)

California residents have the right to know what categories of personal information are collected, the purposes for which they are used, and the categories of third parties with whom they are shared, as well as the right to deletion and the right to non-discrimination. We do not sell or "share" personal information for cross-context behavioral advertising as those terms are defined under the CCPA.

Canada (PIPEDA)

We follow the principles of the Personal Information Protection and Electronic Documents Act (PIPEDA): accountability, identifying purposes, consent, limiting collection, limiting use and retention, accuracy, safeguards, openness, individual access, and challenging compliance.

EEA / UK (GDPR)

Where the GDPR or UK GDPR applies, our lawful bases for processing are: contract (to deliver the Services you book), legitimate interests (security, fraud prevention, service improvement), consent (where required), and legal obligation. You have the rights to access, rectification, erasure, restriction, portability, objection, and to withdraw consent at any time.

11. Changes to this policy

We may update this policy from time to time. If the changes are material, we will notify you by email or by a notice in the Services. The "Last updated" date at the top of this page indicates when the latest changes were made.

12. Contact

Questions or requests regarding this Privacy Policy can be sent to privacy@nurturecorestudio.com or by mail to: Yushen MGT Incorporated, 548 Market St #62628, San Francisco, CA 94104, United States.