Privacy Policy — Harmony Pain Alliance

Plain-English summary: We collect what you type into our form (name, email, phone, what you'd like help with, and a few optional details), plus a small amount of technical information about the submission (which page and language you used, and the country the request came from). We use it to follow up with you and, if you asked for a specific clinic, to pass your request to that clinic. We don't sell your data and we don't track you across the web. You can ask us to delete your information at any time by emailing [email protected]; we handle these requests by hand.

1. Who We Are

Harmony Pain Alliance ("HPA," "we," "us," or "our") is a service operated by Harmony TCM International Group LLC, a Florida limited liability company based in Winter Garden, Florida. HPA is a connecting platform — we help patients in North America get in touch with independently operated acupuncture clinics. We do not provide, supervise, or evaluate medical services; all clinical care is delivered by the clinic you choose.

2. Information We Collect

Information you give us through the form. When you submit a request through our form, we collect what you enter:

Required: your name, email address, and phone number
Your preferred language (English, Spanish, or Chinese)
The primary concern you select from a list, and — if you fill them in — how long you have had it, whether this would be your first acupuncture treatment, whether this would be your first visit to the clinic (on some pages), your preferred appointment time, the type of insurance you have (a category you choose from a list — we do not ask for policy or member numbers), how you heard about us, and anything you write in the notes box (up to 2,000 characters)
If you submitted the form from a specific clinic's page: the name of that clinic
Your confirmation that you agree to our Terms of Use and this Privacy Policy, and — if you submitted from a specific clinic's page — your authorization for us to pass your request to that clinic. We record which version of the Terms and of this Policy you agreed to and when.

Information recorded automatically with your submission. Our systems also record: the date and time of your submission; the language of the page you used; the page and button you submitted from; and the country the request came from, as reported by our hosting provider (Cloudflare). We do not record your IP address, city, or region with your submission.

Anti-spam check. The form includes a hidden field that people cannot see. Submissions that fill it in are treated as automated and are not stored.

Clinic partnership applications. If you apply to list a clinic, our application form (hosted by Google Forms) asks for: clinic name; contact name; email; phone; clinic address as you would like it shown to patients; license type and license number; the year you began practicing under that license; whether you carry professional liability insurance; your three most common conditions by patient volume; the areas your clinic treats; the languages you can treat in; and a free-text description of what your practice does differently. Responses are stored in Google Forms under our Google Workspace account.

In your browser. We store a small piece of data in your browser ("localStorage") to remember your language preference. This stays on your device and is not sent to us. We do not use third-party advertising cookies, retargeting pixels, or cross-site tracking. Our hosting provider may set cookies needed to run the site securely.

3. How We Use Your Information

We use the information you provide to:

Follow up with you about your request, by email or phone, in the language you chose
If you asked for a specific clinic: pass your request to that clinic so it can contact you
If you asked to be matched: contact you first, and then — with your agreement — share your request with a clinic that may fit what you told us
Keep a record of requests we have handled
Understand how the Service is used, in aggregate, so we can improve it

We do not use your information for advertising, and we do not sell or rent it.

4. How We Share Your Information

We share your information only as described here:

The clinic you asked for. If you have requested a specific clinic, we forward your information to that clinic so it can contact you and arrange your visit. The clinic handles what you share with it under its own privacy practices and the laws that apply to the clinic.
A clinic we suggest, after we talk to you. For general match requests, HPA follows up with you first before connecting you with a clinic. We share your request with a clinic only after that follow-up and with your agreement.
Service providers that store or transmit our data. Your submission is processed and stored by Cloudflare (which runs the form's back end and stores a copy of each request) and by Google (which stores our request log in Google Sheets and delivers our notification emails through Google Workspace). These providers process the data for us under their data-processing terms and are not permitted to use it for their own purposes.
The clinic's booking website. If you choose to open a clinic's own booking page after submitting a request, anything you enter there goes to that website and the clinic, not to HPA, and their privacy policy applies.
Legal compliance. We may disclose information if required by law, subpoena, or court order, or to protect the rights, property, or safety of HPA, our users, or others.

We do not sell or rent your personal information, and we do not share it with anyone for their marketing.

5. Health Information

What we ask you to share. Our form asks only for the general area you would like help with and gives you an optional notes box. Please do not submit detailed medical records, test results, or other sensitive health information through the form — share those directly with the clinician you visit.

How we treat what you do share. We understand that even a short description of your concern is sensitive. We store it only as described in this Policy, we share it only with the clinic as described in Section 4, and we do not use it for any other purpose.

HPA's role. HPA is not a health-care provider: we do not diagnose or treat anyone, and we do not submit claims to health plans. The clinic you visit is responsible for handling your health information under the laws that apply to the clinic.

6. Data Retention

Your submission is kept in three places, for different lengths of time:

Our form back end (Cloudflare): each request is kept for 365 days and then expires automatically.
Our request log (Google Sheets): kept for 365 days after the request is handled, then deleted.
Our notification email (Google Workspace): kept for 365 days, then deleted.

If you ask us to delete your information (Section 7), we remove it from all three places by hand, usually within 7 days and in any case within 30 days. Deletion requests are handled by a person, not by an automated process. Information a clinic has already received from us is held by that clinic under its own retention practices; when you ask us to delete your information, we will also tell that clinic that you have asked for deletion.

7. Your Rights

Wherever you live, you may ask us to:

Tell you what information we hold about you and give you a copy
Correct information that is inaccurate
Delete your information
Stop contacting you

To make a request, email [email protected] from the email address you used on the form, or tell us the name and approximate date of your submission so we can find it. We will respond within 30 days. Requests are handled by a person; we may ask you for enough information to confirm that the request is yours. If we cannot fulfil a request (for example, because the law requires us to keep a record), we will tell you why.

8. Security

We take reasonable measures to protect your information. Data travels to us over HTTPS/TLS, is stored with providers (Cloudflare and Google) that encrypt it on their systems, and can be accessed only by the person who operates HPA, through password-protected accounts. No method of transmission or storage is completely secure, and we cannot promise absolute security. If a breach affects your information, we will notify you as required by applicable law, including Florida's data-breach law.

9. Children's Privacy

Forms on our Service are to be submitted by adults (18 or older). A parent, legal guardian, or caregiver with appropriate authority may submit a form on behalf of a minor or another person (see our Terms of Use, Section 1.2). We do not knowingly accept a form submitted directly by anyone under 18; if you believe that has happened, email us and we will delete the submission.

10. International Users

HPA is operated from the United States. If you access our service from outside the U.S., your information will be transferred to, processed in, and stored in the United States.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last Updated" date at the top of this page and, for material changes, post a conspicuous notice on the Service. Changes apply from the date shown and do not expand how we may use or share information you already gave us unless you agree.

12. Contact Us

Questions about this Privacy Policy? Reach us at:

Harmony TCM International Group LLC
Email: [email protected]
Winter Garden, Florida, USA