Privacy Policy

Kneadly ("Kneadly," "we," "us," or "our") provides booking, scheduling, and practice-management software for massage therapy and wellness businesses ("Businesses") and their clients ("Clients"). This Privacy Policy explains what information we collect, how we use it, and the choices available to you.

Kneadly does not currently meet the requirements of the Health Insurance Portability and Accountability Act (HIPAA). We have not signed Business Associate Agreements (BAAs) with our infrastructure or service providers, and we are not representing Kneadly as a HIPAA-compliant platform for the storage or transmission of Protected Health Information (PHI).

If your practice is subject to HIPAA or similar health-privacy regulations, you are responsible for evaluating whether Kneadly is an appropriate tool for your use case, and for limiting what health-related information you enter into the platform accordingly. We are actively working toward HIPAA compliance; this policy will be updated if and when that status changes.

Account and business information

Name, email address, phone number, business name, address, and billing information for Businesses and their staff members.

Client information

Names, contact information (email, phone), appointment history, and any information a Business chooses to record about a Client, which may include:

• Health-related information — Intake form responses, health histories, contraindications, and treatment notes (SOAP notes) that a Business enters at its own discretion. This information is entered and controlled by the Business, not by Kneadly, and is treated as sensitive information within our systems.
• Body-map and treatment documentation — Visual or written treatment notes a therapist records during a session.

Voice and audio data

If a Business uses Kneadly's voice documentation feature, spoken notes are captured temporarily and sent to a third-party transcription service (OpenAI's API) to convert speech to text. Kneadly does not store or retain the raw audio recording after the transcription request completes; only the resulting text transcript (and, if the therapist chooses to save it, a generated note draft) is retained in our system. OpenAI's handling of the audio during transcription, and any applicable abuse-monitoring retention, are governed by OpenAI's own API data controls, which may include retention of content in abuse-monitoring logs for up to 30 days unless an approved data-retention control applies to the account.

Calendar data

If a Business connects a Google Calendar (or other third-party calendar) account, we access calendar event data (including busy/free times and, where applicable, event details) solely to manage appointment availability and prevent double-booking. We do not use calendar data for advertising or any purpose unrelated to scheduling.

Payment information

Payment card details are processed directly by Stripe, our payment processor; Kneadly does not store full card numbers on our own servers.

Communications

Emails and SMS messages sent through the platform (appointment confirmations, reminders, marketing messages a Business chooses to send), including delivery and engagement data (e.g., whether a message was delivered or opened).

Push notifications

If you enable push notifications, we store a device token used to deliver notifications to you. Notification content may reference appointment details.

Usage and analytics data

We use Google Analytics (GA4) and Meta Pixel to understand how our marketing website and application are used, including pages visited, general engagement metrics, and traffic sources. This data is used in aggregate to improve our product and marketing, not to build individual health profiles.

Device and log information

Standard technical information such as IP address, browser type, and device information, collected automatically when you use our services.

We use the information above to:

• Provide, operate, and maintain the Kneadly platform.
• Process bookings, payments, and appointment-related communications.
• Enable Businesses to manage their clients, staff, and schedules.
• Sync with connected third-party services (e.g., Google Calendar, Stripe).
• Transcribe voice notes when a Business uses that feature.
• Send transactional and, where opted in, marketing communications.
• Analyze and improve our website and product.
• Comply with legal obligations and enforce our terms.

We do not sell personal information. We share information with:

• Service providers who help us operate the platform, including Supabase (database/infrastructure), Stripe (payments), Twilio (SMS), Resend (email), OpenAI (voice transcription), and Google (calendar integration), each of which processes data solely to provide their respective service to us.
• The Business a Client interacts with — a Client's information is visible to the Business (and its staff) they book appointments with.
• Legal or safety reasons, if required by law or to protect the rights, property, or safety of Kneadly, our users, or others.

We retain information for as long as an account is active or as needed to provide services, unless a longer retention period is required by law. Businesses may request deletion of their data, and Clients may request deletion of their personal information from a Business by contacting that Business directly, or by contacting us.

• Access and correction — You may request access to or correction of your personal information by contacting us.
• Deletion — You may request deletion of your account and associated data, subject to any legal retention requirements.
• Marketing communications — You may opt out of marketing emails and SMS at any time using the unsubscribe/STOP options provided in those messages.
• Push notifications — You may disable push notifications through your device settings.
• Calendar disconnection — You may disconnect a connected Google Calendar account at any time from your account settings; doing so revokes Kneadly's access to that calendar data.

Kneadly is not directed to individuals under 18, and we do not knowingly collect personal information from children.

We use industry-standard measures, including encryption in transit and at rest, to protect information stored on our platform. No system can be guaranteed 100% secure, and we cannot guarantee absolute security of information transmitted to us.

Kneadly is operated from the United States. If you access our services from outside the United States, your information will be transferred to and processed in the United States.

We may update this Privacy Policy from time to time. We will update the "Last updated" date above when we do, and, for material changes, will provide additional notice as appropriate.

If you have questions about this Privacy Policy or how we handle your information, contact us at support@getkneadly.com.