Privacy
What this site collects, and what happens to it.
I practice from Oregon and work virtually elsewhere. Health information has a separate policy of its own, and the link to it is a little way down this page.
The short version.
This is a small practice. There is no marketing department behind the website, no advertising network embedded in it, and no data broker anywhere in the arrangement. I have never sold anyone’s information and I am not planning to start.
Almost everything the site holds about you is something you typed into a form and sent me on purpose, plus the ordinary record any web server keeps of the visits it receives. The site runs on a server owned by a family member rather than on a commercial host, which is unusual for a business this size and worth telling you about, because it means the list of people who could reach the database is short.
Who you are dealing with.
brennamay.com is run by May Creative and Consulting LLC, an Oregon limited liability company established in 2011, trading as Brenna May Wellness and, on the practitioner side, as May Practice Frameworks. One company owns all of it, and I am the only person who reads what comes in.
Write to me at brenna@brennamay.com about anything on this page. Privacy requests, corrections and deletions all come to the same inbox, and they come to me rather than to a support queue.
Health information, and what does not protect it.
I do not bill health insurance and I am not a HIPAA covered entity, which means HIPAA does not cover anything you send me through this website. Most people assume the opposite about a health-adjacent site, so I would rather say it plainly here than let you find out later.
The forms on this site run on WPForms. It is not HIPAA-compliant, there is no business associate agreement behind it, and entries land in the website database and in my email.
I practice from Oregon, and some of the people I work with live in Washington. Washington’s My Health My Data Act follows the person rather than the business, so it reaches what these forms collect from a Washington resident even though the practice sits across the river. That law is where health information sent through this site gets most of its protection, and I apply the same handling to everyone instead of sorting people by state.
Please keep lab results, diagnoses and medication lists out of the website forms. Tell me enough to know whether we are a fit for each other. The rest belongs in the secure channel I set up once we are working together, and I will not think less of an inquiry for being brief.
Read the Consumer Health Data Privacy Policy, which is a separate page covering health information specifically, including how to withdraw consent and how to have it deleted.
What the forms ask, and why.
There are four forms on the site. Each one sends what you write to my email and stores a copy in the website database.
- Contact. Your name, your email and your message. I use it to answer you.
- Work with me. Your name, your email, which offer you are asking about, whether you have had recent blood work, and two open questions about what is going on and what you would want me to know. This is the form most likely to carry health information, because that is what the open questions invite, and it is the reason the separate health data policy exists.
- Groundwork interest list. Your name, your email, how familiar you already are with this work, and what you have tried before. I use it to decide what the program needs to cover and to tell you when a cohort opens.
- Practitioner waitlist. Your professional details, so I know who is waiting and what they practice.
Nothing from a form is added to the newsletter list unless you asked for that separately, and nothing from a form is used to advertise to you anywhere else.
Everything else that collects something.
The newsletter
The newsletter runs on Substack, which holds your email address and records whether you opened an issue and what you clicked. Substack is the one making those records rather than me, and its own privacy policy governs them. Every issue carries an unsubscribe link, and you can also write to me and I will remove you myself.
Payments and memberships
Purchases go through WooCommerce, and payment is processed by Stripe. Your card number never reaches me and is never stored on this site. What I can see is the order, the amount, the name and the billing details attached to it. Memberships are handled by Paid Memberships Pro, which records which level you hold and when it started.
The client portal
Current one-to-one clients use NutriQ, a portal run by the Nutritional Therapy Association, for intake, assessments and food and mood journals. That is the most detailed information I hold about anyone, and it sits in NutriQ rather than on this website. I am moving off that platform. When the move happens I will tell every affected client where their records are going and what is being deleted rather than migrated, and nobody will find out by logging in one day to an empty account.
Logs, cookies and counts
Jetpack counts visits and page views for the site as a whole. A login security plugin records the IP address behind repeated failed login attempts, which is the only place the site keeps IP addresses on purpose. Google Search Console shows me which searches led here, in aggregate and without identifying anyone. WooCommerce sets cookies so a cart survives a page change, and Gravatar may load an avatar image where a profile picture appears.
There is no advertising tracker on this site, no Facebook pixel, and no third-party analytics beyond what is named above. Your browser settings can block or clear cookies, and nothing on the site will break badly if you do.
Affiliate and dispensary links
A number of links on this site are affiliate or practitioner links, covering water and air filtration, sauna and light devices, skincare, household goods, food and drink, and a practitioner dispensary. If you buy through one I may earn a small commission or referral credit at no extra cost to you, and the company at the other end can see that you arrived from here.
What I do not do is watch which links you click and draw conclusions from it. Nobody gets tagged as interested in a condition because of a product they looked at, and no email list here is segmented on that basis. The exception is a practitioner dispensary or a laboratory test, where you register an account or place an order under my practice and I can see who you are. Those two are covered in the Consumer Health Data Privacy Policy.
Who else touches your information.
These are the companies whose software the site depends on. None of them is buying anything from me and none of them is being paid to profile you.
- The host. The site sits on a private server owned by a family member. The hardware and network underneath that server belong to a third-party infrastructure provider, so a technical operator does hold the machine even though no hosting company is reading the database.
- Automattic. WordPress.com and Jetpack, for the site software, the visit counts and the security layer.
- WPForms. The form software, which stores entries in the site’s own database.
- Stripe. Payment processing, including the card details that never reach me.
- Substack. The newsletter list and its open and click records.
- Nutritional Therapy Association. NutriQ, the client portal, for current one-to-one clients.
- Google. Workspace for my email, and Search Console for aggregate search data.
- Practitioner dispensaries, laboratory testing providers, and affiliate platforms. Fullscript, Designs for Health, CellCore and LifeWave for dispensary and testing, and a range of affiliate and referral networks for the product links described above.
If that list changes I will change this page, and if a change affects health information I will ask before it takes effect rather than after.
How long any of it is kept.
- Form entries. Twenty-four months, then deleted from the website database. If we start working together, the relevant part moves into your client record and the rest goes.
- Newsletter. Until you unsubscribe or ask me to remove you.
- Orders and payment records. Seven years, as tax rules require me to be able to produce them.
- Client records. Seven years after our work ends, which is the standard I hold myself to rather than one imposed on me, and then deleted.
- Security logs. Weeks rather than months. They exist to stop a login attack and have no other use.
You can ask for any of it sooner. A deletion request is not an argument, and I will not ask you to justify it.
What you can ask me to do.
Whatever the law where you live says about this, the practical answer is the same. Write to brenna@brennamay.com and tell me what you want. You can ask for a copy of what I hold, ask me to correct something wrong, ask me to delete it, or withdraw a consent you gave earlier. I answer these myself and I aim to do it within 45 days, which is the deadline several of these laws set.
I will not charge you for asking, and I will not treat you differently for having asked. If I need to confirm you are who you say you are before I hand over records, I will ask for the least I can get away with rather than for a copy of your passport.
Where you are matters
Oregon, where I practice, gives residents access and deletion rights under its Consumer Privacy Act, and California and several other states do the same. Washington residents have further rights over health information under the My Health My Data Act, including consent, withdrawal and deletion, and those are set out on the separate health data page. People in the United Kingdom and the European Union have rights under the UK and EU General Data Protection Regulation, and people in Canada and Australia have rights under their own national privacy laws. I work with clients in several of these places, so rather than sort you into a category, I will honor the request in front of me.
Security, children, and the parts I cannot promise.
The site runs over an encrypted connection, the number of people holding a login is very small, and a plugin locks out repeated failed attempts and records the address they came from. No website is perfectly secure and I am not going to tell you otherwise. If something is breached I will say so, to the people affected, in plain terms, rather than by posting a notice and hoping.
This site is not built for children and I do not knowingly collect information from anyone under sixteen through it. I do work with families, and when a child’s information reaches me it comes through a parent inside the client relationship rather than through a form on a public page.
A note on this page