Privacy Policy

Who we are

Rooted In W3llness is a private wellness coaching and community service operated by Andrea Wellness Co. This policy explains what information the app collects, how it is used, and the choices available to members.

Information we collect

• Account information: first name, email address, membership and access status, login records, and communications preferences.
• Wellness information: non-negotiables, daily completion history, Sunday Check-Ins, optional weight entries, food logs, nutrition goals, progress photos, notes, and private coach messages.
• Connected workout information: when a member optionally connects Strava, activity name, type, date, duration, distance, and elevation. Rooted does not import Strava routes or heart-rate data.
• Crew activity: posts, photographs, comments, reactions, and whether a post was submitted anonymously.
• Technical information: security, diagnostic, request, and device information produced by our hosting, authentication, storage, and communication providers.

How we use information

• Provide the member app, wellness tracking, coaching, community, and support.
• Show authorized coaches and admins the information needed to support a member.
• Manage membership access, respond to requests, prevent abuse, secure the service, and troubleshoot problems.
• Comply with applicable legal obligations and protect members, the business, and the public.

We do not sell member wellness information or use private wellness records for targeted advertising.

What is private and what is shared

Sunday Check-Ins, non-negotiables, private coach messages, food and weight logs, progress photos, and imported workout history are available only to the member and authorized Rooted admins or coaches. They are not posted to Crew automatically.

Crew posts, comments, reactions, and attached photos are visible to authenticated Crew members. Choosing “anonymous” hides the member’s displayed name, but the content or photo itself may still reveal identity. Rooted admins can identify an account when needed for safety, moderation, or legal reasons.

Service providers

We use service providers to operate the app, including Supabase for authentication, database, and file storage; Vercel for hosting; Mailgun for transactional email delivery; HighLevel when connected for membership automation or communications; USDA FoodData Central for optional nutrition estimates; and Strava when a member chooses to connect workout history. Strava authorization tokens are stored server-side and are not exposed in the member app. These providers process information on our behalf under their own contractual and security obligations. We may also disclose information when required by law, to protect safety or legal rights, or as part of a business transfer.

Progress photos and sensitive wellness data

Progress photos are optional and require separate, versioned consent before the first upload. Photos are resized and location metadata is removed before upload. They are stored in private storage and accessed through time-limited links. Rooted will not use progress photos for marketing, testimonials, social media, or public before-and-after content without separate written permission.

Retention and deletion

We retain account and wellness information while membership is active and as reasonably needed to provide the service, resolve disputes, maintain security, and meet legal obligations. Members can delete individual progress-photo sets, weight entries, food entries, workouts, and Crew posts where the app provides a delete control. Disconnecting Strava stops future imports; already imported workouts remain until the member removes them or requests deletion. Members may request account deletion or a copy of their information by contacting us. Some limited records may be retained when required for legal, fraud-prevention, payment, or security purposes.

Security

We use access controls, private storage, row-level database protections, encrypted network connections, and restricted admin tools. No internet service can guarantee absolute security. If an incident affects protected information, we will investigate and provide notices required by applicable law.

HIPAA and health-app laws

This is a wellness coaching platform, not an emergency service or a medical record system, and it is not represented as HIPAA compliant unless Andrea Wellness Co. enters a separate written arrangement that requires it. HIPAA coverage depends on the parties and services involved. Other privacy, consumer-protection, and health-breach laws may apply even when HIPAA does not.

Your choices and rights

Members may choose not to use optional progress photos, weight tracking, food logging, or connected workout imports. Strava can be disconnected from the workout history screen at any time. Depending on location, members may have rights to request access, correction, deletion, or restriction of certain information. We will verify identity before fulfilling a request.

Age requirement

The app is intended for adults age 18 and older. We do not knowingly collect personal information from children through this service.

Changes to this policy

We may update this policy as the app or legal requirements change. Material changes will be posted in the app with a new effective date, and renewed consent will be requested when appropriate.

Contact us

Questions, privacy requests, or consent withdrawals can be sent to coach@andreawellnessco.com.