Privacy Policy

Northwest Recovery is an assisted stretching and recovery business serving Yakima, Washington. This policy explains how we handle information through thenorthwestrecovery.com, our client and staff portals, event signups, and connected business services. Effective date: November 5, 2026.

Account and contact information may include your name, email address, phone number, account identifiers, and sign-in information. Client and event records may include appointments, attendance, membership and reward activity, coupon redemption, and communications you send us.

Intake, assessments, body maps, signed consents, session updates, and practitioner notes can include health history, pain or mobility concerns, activity, goals, restrictions, findings, signatures, and optional media-release choices. Please provide only information relevant to your visit. Do not put detailed health information in ordinary email or public social messages.

Payments may include customer and transaction identifiers, purchases, amounts, tips, tax and fee information, refunds, subscriptions, and invoices. Donations can include an optional name and note. Card entry takes place through Stripe-hosted payment services; our payment records use transaction information rather than a copy of your full card number.

Website analytics can record page paths, referrers, campaign parameters, visitor and session identifiers, device/browser information, language, time zone, screen size, time on page, scroll activity, clicks, and form-start field names. The current tracker does not read the values you type into form fields. Links and referrers may contain information in their URLs, so avoid placing private details in URLs.

We use information to maintain accounts, arrange and manage appointments, prepare for and document sessions, review safety information and consent, provide recovery plans, manage memberships and rewards, process payments, and respond to requests. Staff access supports scheduling, record review, and business administration.

We also use operational records and website analytics to understand demand, improve the website, measure campaign links, reconcile income, and protect against misuse or duplicate redemptions. The website tracker is designed to exclude staff and portal activity.

Contact details provided at events may be used to follow up about our services. An event signup or service consent is not, by itself, consent to receive promotional text messages. Automated SMS campaigns and contact-form email/CRM delivery are not currently connected in the website. The public contact form currently resets after submission without transmitting its contents; email us directly to reach the business.

We use providers to operate the website and business services. Supabase supports accounts, database records, and file storage. Lovable and its hosting infrastructure support website delivery, and Google Fonts supplies website fonts. Providers may receive technical connection information when their services load.

Cal.com receives information you provide when booking, cancelling, or rescheduling and supports appointment management. Stripe processes payments and receives the information needed for checkout, customer records, invoices, subscriptions, and donation notes. Payment reconciliation can copy transaction details and income breakdowns into the business's Google Sheet.

Email you send to thenorthwestrecovery@gmail.com is handled through Google's email service. Our business telephone service uses Retell AI. Information you provide in a call is also handled by that telephone service; ask us about its current recording and transcription settings before discussing sensitive details. The website does not establish those settings.

Staff have an optional AI note-writing tool. When configured and deliberately used, it sends the staff member's dictation, any supplied existing notes, and selected modalities through Lovable's AI service to an OpenAI model to draft a SOAP note. Browser voice dictation may also use the browser or device provider's speech-recognition service. These tools are not automatic processing of every client record, and their presence does not establish a provider retention period or a healthcare compliance agreement.

Authorized staff can access records needed for their roles. We may disclose information when needed to respond to a legal obligation, protect people or our services, or act on your request. Provider services and external websites have their own privacy notices and account controls. We do not represent that information never leaves Northwest Recovery.

The site uses browser storage to keep sign-in sessions, save recovery-assessment drafts, and remember interface settings. Visitor identifiers and analytics-exclusion preferences may remain in local storage; session identifiers use session storage. Social account connection attempts use a short-lived cookie to associate the authorization response with the browser that started it.

First-party website analytics currently runs on public pages without an analytics consent banner. This policy does not mean that a consent-management system or advertising opt-out has been installed. We have not identified a Meta Pixel or Google Ads conversion tag in the current website implementation; connecting an Instagram business account is a separate activity from tracking website visitors for advertising.

You can block cookies or clear site storage through your browser. This can sign you out, remove locally saved drafts and preferences, and affect connected-service or booking functionality. Clearing browser storage does not delete records already held by the business or its providers. Contact us about analytics information or other privacy choices.

Our staff marketing tools use connected TikTok account and video metadata, such as account statistics, video identifiers, captions, hashtags, timestamps, cover images, links, and performance information, for analytics and planning. Staff can supply an original MP4 for a cross-posting job; a thumbnail is not treated as the original video.

Instagram/Meta authorization is an owner or manager business connection, not client social sign-in. When authorized and configured, Meta provides an access token, granted permissions, and assigned Instagram account information. The requested access supports reading basic Instagram account information and publishing business content. We use credentials only for the connected business account's verification, connection maintenance, and authorized publishing workflow, not to obtain clients' private social accounts.

Google Drive authorization is separate from TikTok or Instagram authorization. When connected, we receive the Google account identity, access credentials and, where issued, a refresh token. The integration verifies the intended business account and upload permission for the designated Posted folder. Its purpose is to back up authorized original MP4 files, with captions or related file metadata, and retain actual upload receipts.

Connection credentials are handled by server-side connection functions and are not shown as part of public website content. The workflow retains connection status, source metadata, uploaded originals, job stages, provider identifiers, receipts, and failure history to manage processing and avoid duplicates. Connections need provider authorization and completed setup. Instagram and Drive publishing adapters are implemented, but automatic social publishing remains OFF; Facebook and YouTube publishing are not connected. A visible destination toggle does not mean that content is being published.

If an authorized publishing or backup operation is enabled and tested, the destination receives the original video, caption or description, and information needed to perform that operation. Published content can become public according to the destination account's settings. Client intake, health records, and payment records are not inputs to this cross-posting workflow.

Different records serve different purposes: session history and signed forms document services and consent; financial records support reconciliation; social job history supports recovery and duplicate prevention. We have not established one deletion schedule for all record types or an automatic account-wide cleanup process. We review deletion requests in light of the information's purpose, applicable recordkeeping obligations, unresolved transactions, and legitimate operational needs.

The application uses account sign-in and role-based access controls, and connection credentials are handled on the server. These measures do not make any service risk-free. Avoid sharing passwords, coupon possession links, or private account access. We do not claim HIPAA certification or compliance, a security certification, or guaranteed protection against every incident.

To request access, correction, deletion, or information about how we use your data, email thenorthwestrecovery@gmail.com with the subject Privacy request or Data deletion request. Identify the account email or phone number you used and describe the records or connected account involved. Do not send passwords, access tokens, full card numbers, or detailed medical history. We may ask for reasonable information to verify that the records belong to you or that you are authorized to act for the business account.

For Meta/Instagram data deletion, use the same email address and specify Instagram/Meta data deletion, the connected Instagram account name, and whether you want connection credentials, stored account/video metadata, uploaded originals, or job history reviewed for deletion. You do not need a Northwest Recovery login to email this request. We will explain any information that must be retained and any additional steps needed; we do not promise an unverified deletion deadline.

An authorized manager can open Admin > Marketing > Social and use Disconnect for Instagram or Google Drive. Disconnect removes the locally stored connection credentials and pending authorization states and attempts provider-side revocation. If revocation fails or is uncertain, remove the app's access in your Meta/Facebook connected-app or business-integration settings, or in your Google Account's third-party connections settings. You can also revoke access directly with the provider without first using our website.

Disconnecting does not automatically delete previously stored video metadata, job logs, uploaded originals, Instagram posts, or Google Drive files. Request deletion of business-held copies by email; review or remove destination copies in the relevant provider account. Revoking a TikTok connection should be done through the TikTok account's connected-app controls and the business's connection administrator.

To stop promotional contact, reply using the unsubscribe option where one is provided or email us to request that promotional contact stop. Service-related communications and required records may still be needed. Depending on your location and applicable law, you may have additional privacy rights; contact us to exercise them.

Northwest Recovery, Yakima, Washington. Website: thenorthwestrecovery.com. Privacy contact: thenorthwestrecovery@gmail.com. Telephone: (509) 267-6088. Visits are by appointment only.

We may update this policy when our practices or connected services change. Updates will appear on this page with a revised effective date. This notice is issued by Northwest Recovery, not by a platform as a certification of our practices.