Designed to Heal 360 — Privacy Notice

1. Who we are

Designed to Heal 360 is operated by Lea Curley (trading as Designed to Heal 360), based in the State of Texas, United States.

Lea Curley is the data controller for personal information collected through the Designed to Heal 360 application and website, and decides how and why that information is processed.

You can reach us with any privacy question at designedtoheal360@outlook.com.

2. Information we collect

Depending on how you use Designed to Heal 360, we may collect:

• Account information — your email address, name or display name, password credentials (stored in hashed form by our authentication provider), and sign-in method.
• Profile and personalization — the pathway you choose (health, faith or both), conditions or sensitivities you record, allergen exclusions, reminder times and preferences.
• Wellness content you create — check-ins, symptom and lifestyle ratings, journal entries, reflections, saved Scriptures, prayer requests, meal plans, favourites and course progress.
• Community content — posts, comments, prayer reactions and kindness offers you choose to share in a circle.
• Posts, replies, kindness offers and stories explicitly submitted for sharing are visible to the owner for review. Private stories are not sent to the owner or prayer team. Content becomes visible to other eligible members only after owner approval.
• Support and correspondence — messages you send us, including reports of content or copyright concerns.
• Technical and usage data — IP address, device and browser type, approximate location derived from IP, pages viewed, error/diagnostic logs, and push notification device tokens, if you turn on notifications.
• Purchase records — the membership plan, subscription status, billing period and payment provider identifiers. We do not collect or store your card number.

3. Why we use it, and our legal basis

Providing your account, saving your check-ins, journal and other content, and delivering the features you have selected — performance of our contract with you.

Personalizing your experience (meal suggestions, learning content, pathway-aware daily content) — performance of our contract with you.

Processing memberships, renewals, cancellations and refunds through our payment provider — performance of our contract with you and compliance with legal obligations such as tax and accounting.

Security, fraud prevention, abuse and moderation of community areas — our legitimate interests in keeping the service and its members safe.

Improving and troubleshooting the service using aggregated or diagnostic data — our legitimate interests in operating a reliable product.

Sending optional reminders, product updates or marketing where you have opted in — your consent, which you can withdraw at any time.

Meeting legal, regulatory or law-enforcement obligations — compliance with a legal obligation.

Health-related information you enter is treated as sensitive. We process it only to provide the tracking and reflection features you have chosen to use — that is, on the basis of your explicit consent, given by choosing to record it. You may delete individual entries or your whole account at any time.

4. Who we share it with

We do not sell your personal information. We share it only with:

• Paddle.com Market Ltd — our Merchant of Record and payment processor. Paddle handles checkout, payments, subscription billing, sales tax, invoicing, returns and payment-related customer service, and acts as an independent controller for that data. See paddle.com/legal/privacy.
• Hosting and infrastructure providers, including Supabase (database, authentication and storage) and Cloudflare (hosting and content delivery), acting as our processors.
• Google Firebase Cloud Messaging — used to deliver push notifications you choose to turn on. It receives a device token and the notification content, acting as our processor.
• AI service providers used for optional Companion reflections, only after you explicitly agree to send the selected check-ins. Those check-ins may include symptoms and food, movement and stress notes. Journal excerpts are excluded unless you separately choose to include up to eight recent entries, limited to 600 characters each. No logs are sent merely by opening the page or writing in Journal; account credentials are never sent to AI.
• Email delivery providers used for account, security and reminder messages.
• Professional advisers such as legal and accounting advisers, where necessary.
• Authorities or third parties where required by law, or to protect the rights, safety or property of Designed to Heal 360, our members or the public.
• A successor entity, if the business is transferred, merged or acquired.

5. International transfers

Designed to Heal 360 is operated from the United States, and our providers may process data in the United States and other countries.

Where personal information is transferred from the United Kingdom or European Economic Area, we rely on appropriate safeguards such as Standard Contractual Clauses or an applicable adequacy decision.

6. How long we keep it

Account, profile and wellness content is kept for as long as your account remains open, so your history stays available to you.

If you delete your account, your personal content is deleted or anonymised, ordinarily within 30 days, except where we must keep records longer.

Purchase and tax records are retained for the period required by law (generally up to 7 years).

Security and diagnostic logs are typically retained for up to 12 months.

7. Your rights

Subject to the law where you live, you may request access to the personal information we hold about you, correction of inaccurate information, deletion, restriction of or objection to processing, a portable copy of information you provided, and withdrawal of any consent you gave.

You can edit or delete most of your content directly in the app, and delete your whole account from the You page.

To exercise any right, email designedtoheal360@outlook.com or use the You page in the app. We aim to respond within one month.

If you are in the UK or EEA, you also have the right to complain to your local supervisory authority. Residents of some US states, including Texas and California, have similar rights and will not be discriminated against for exercising them.

8. Security

We use appropriate technical and organisational measures, including encryption in transit, encrypted storage, row-level database security so members can only reach their own records, role-restricted administrative access and audit logging of administrative actions.

Administrators cannot read your private journal entries or private health records.

No method of transmission or storage is completely secure, so please use a strong, unique password and avoid posting information publicly that you would not want other members to see.

9. Cookies and similar technologies

We use strictly necessary cookies and local browser storage to keep you signed in, remember your preferences and keep the service secure. These are required for the app to work.

Our payment provider may set cookies needed to operate the checkout and prevent fraud.

We do not use advertising cookies. If we later add analytics or marketing cookies, we will ask for your consent first and provide controls to manage them. You can also clear or block cookies in your browser, though signing in may then stop working.

10. Children

Designed to Heal 360 is not directed at children. You must be 16 or older to create an account. We do not knowingly collect personal information from children under 13 (consistent with the U.S. Children's Online Privacy Protection Act) or from anyone under 16. If you believe a child has provided information to us, email designedtoheal360@outlook.com and we will delete it.

11. Changes to this notice

We may update this notice as the service evolves. When we make material changes, we will update the date above and, where appropriate, notify you within the application.

12. Health information and HIPAA

Designed to Heal 360 is not a healthcare provider, health plan or clearinghouse. Your entries are personal wellness records, not a healthcare portal. Member access controls protect your journal, check-ins, symptoms, medications, private prayer requests and private stories. Administrators cannot access them through owner tools. If you explicitly request an AI reflection or send a prayer to the team, only the information you choose is processed for that purpose.

If a breach of your health-related information ever occurs, we will notify you and the appropriate authorities as required by the U.S. FTC Health Breach Notification Rule and applicable state law.

13. We never sell your data

We do not sell or rent personal information, do not share it for advertising, and do not use your health, journal or prayer entries to target ads. We do not show third-party advertising.

14. Location

Location (GPS) is used only on the Emergency Help page, only after you allow it, and only to show nearby emergency numbers on your device. It is never required to call for help, and it is not stored or sent to us. Exact locations of members are never shown publicly.

15. Deleting your account and data

You can delete your account at any time on the You page (scroll to “Delete my account”). This permanently removes your profile, check-ins, journal, prayer requests, stories, saved items and preferences, and cancels any active membership. You can also request deletion by emailing designedtoheal360@outlook.com. Full steps are at designedtoheal360.com/delete-account.

16. Genetic information

Our genetics pages are educational. We never ask for genetic test results and never diagnose or calculate risk. If you choose to save a genetics page or write questions for your clinician, those notes are private to your account, never sold, never used for advertising, never shared, and are deleted when you delete them or your account.

We do not collect genetic test results, DNA samples or raw genetic data, and we do not share genetic or health information with insurers, employers, data brokers or advertisers.

17. Consumer health data rights (including Washington and Nevada)

Some U.S. state laws, such as Washington’s My Health My Data Act and Nevada’s consumer health data law, give you specific rights over consumer health data. We collect health-related information only to provide the features you choose. We do not sell it or use it for advertising. Hosting providers store it on our behalf. Optional AI reflections and prayer-team email process only the information you explicitly choose to send; content submitted for community sharing is reviewed by the owner before publication.

You may confirm what health data we hold, access it, withdraw consent, or delete it at any time on the You page or by emailing designedtoheal360@outlook.com. We respond within 45 days. If we decline a request, you may appeal by replying to our response.

18. Contact

Email designedtoheal360@outlook.com · Website designedtoheal360.com