Privacy policy

1. Who is responsible for your information

Zento operates the platform and is responsible for the personal information collected through it. For privacy questions, contact us at hi@getzento.com.

For the health and personal information you provide to a specific acupuncturist in connection with an appointment, that acupuncturist is independently responsible for the information for the purpose of the care they provide. The platform also processes that information on the acupuncturist's behalf.

2. Information we collect

Identity and contact details

• Full name and phone number (also used for one-time code sign-in)
• Email address, when provided
• For acupuncturists: clinic details, the conditions you treat, and business details needed for invoicing

Health information: sensitive information

When you book, an acupuncturist may ask you to complete an intake form that includes health questions. These answers are sensitive personal information. They are stored and linked to you and to your appointments, and are used by the acupuncturist to provide care. We are not a covered entity or business associate under HIPAA unless an acupuncturist has a separate agreement with us that says otherwise.

Appointment history and activity

• Appointments you booked, dates and times, the service chosen, cancellations, and no-shows
• Signatures, terms acceptances, and consents (including the time and IP address of the acceptance)
• Reviews, ratings, and messages you have written

Payment data (metadata only)

We do not collect or store your card number. Card details go directly to a PCI-compliant payment processor (Stripe). We retain only an encrypted token and payment metadata (amount, date, status, and invoice number), which allows future charges without exposing your card details.

Technical information collected automatically

• IP address, browser and device type, operating system
• Pages viewed, session times, and general usage data
• Click data from marketing links (see the cookies and analytics section)

3. How we use information

We use information for the following purposes:

• Running the platform and booking and managing appointments: to perform our agreement with you and provide the service
• Passing health information to your acupuncturist so they can provide care: on the basis of your consent
• Processing payments, storing payment methods, charging cancellation or no-show fees, and issuing invoices
• Sending reminders, confirmations, and review requests by email
• Authentication, security, and preventing abuse
• Improving the service and statistical analysis
• Meeting legal obligations, including tax and recordkeeping requirements

We rely on your consent, on the necessity of processing to perform our agreement with you, on legal obligations, and on our legitimate interest in operating and securing the service.

4. Public profiles and reviews

Acupuncturists who create a profile agree that certain information is shown publicly: name, specialties, clinic location, published professional content, and reviews and ratings. Reviews posted by users may display the reviewer's name and be publicly visible. We may remove content that does not meet our platform guidelines.

5. Sharing information with third parties

We do not sell personal information. We share it only as needed to run the service, with the following parties:

• The acupuncturist you booked with: receives the contact details, appointment details, and intake answers needed to provide care.
• Payment processors: Stripe, for processing payments and issuing invoices.
• Communication providers: The Mailgun email service, for sending verification codes, reminders, confirmations and review requests on our behalf.
• Infrastructure and storage providers: hosting, server, and cloud file storage services that run the platform.
• Analytics tools: as described in the cookies and analytics section.
• Authorities and litigants: where required by law or to protect our rights or the rights of our users.

Some providers operate outside the United States. Where that is the case, we take the steps required by applicable law for transferring information across borders.

6. Cookies, analytics, and tracking

The site uses cookies and measurement tools to operate, remember preferences, secure the service, and analyze usage, including:

• Google Tag Manager and Google Analytics (GA4) for usage and performance analysis (loaded in production only).
• A dedicated cookie named rt_attr that links a marketing message you received to a signup you completed. It is httpOnly, expires after 90 days, and is not shared with third parties.
• Click tracking on marketing links sent to you by email: we record the click so we can attribute it, and we do not use it to build an advertising profile.

You can control cookie settings through your browser. Blocking cookies may break some parts of the service.

7. How long we keep information

We keep personal information for as long as it is needed for the purposes it was collected for: during your use of the service and afterwards, as required to meet legal obligations (such as retaining accounting records), resolve disputes, and enforce rights. Marketing tracking data is deleted after 12 months. Once the retention period ends, information is deleted or anonymized.

8. Your rights

Depending on where you live, privacy laws such as the California Consumer Privacy Act may give you the following rights:

• The right to know what personal information we hold about you and to request a copy
• The right to have inaccurate, incomplete, or outdated information corrected
• The right to request deletion, subject to records we are legally required to keep
• The right to withdraw consent and to be removed from marketing lists

To exercise these rights, use the contact details at the end of this document. We will not discriminate against you for exercising them. For health information you provided to an acupuncturist, you may also need to contact that acupuncturist directly, since they are independently responsible for it.

9. Information security

We take reasonable measures to protect information, including encrypting payment tokens, restricting access, using security protocols, and hardening our servers. No system can guarantee absolute security for information transmitted over the internet.

10. Minors

The service is intended for people aged 18 and over. We do not knowingly collect information about minors without a guardian's consent. Care for a minor is arranged through a guardian, who provides the information. If you believe information about a minor was provided without authorization, please contact us so we can remove it.

11. Links to external sites

The site may link to other websites. This policy does not apply to them, and we recommend reviewing their privacy policies.

12. Changes to this policy

We may update this policy from time to time. The updated version will be posted on this page and applies from the date it is published.

13. Privacy contact

For questions, requests, or to exercise your rights, contact us at hi@getzento.com or through our contact page.