Who We Are

This Privacy Policy explains how Highbar Physical Therapy (“we,” “us,” or “our”) collects, uses, shares, and protects personal data when you visit https://peaktherapy.com (the “Website”) and when you register and pay for continuing education through the Website.

Highbar Physical Therapy is the data controller for the processing described in this Privacy Policy.

Contact email: hello@highbarhealth.com
Address: 4 Richmond Square Suite 400, Providence, RI 02906
Tax ID: true

What Data We Collect

We collect the following categories of personal data through the Website:

Cookie consent preferences. We record your cookie choices (including the date/time of your choice and the categories you accepted or rejected) using our consent management system.

Device and technical data. This includes your IP address, device identifiers, browser type, operating system, approximate location derived from IP address, and technical information needed to load and secure the Website.

Continuing education registration data. This includes information you submit to register for continuing education, such as your name and contact details, and registration details related to the course or event you select.

Payment and billing information. When you pay for continuing education, we collect payment-related and billing details needed to process the transaction and maintain transaction records. Payment card details are handled by payment processors and are not intended to be stored by us unless explicitly provided through the payment flow.

Marketing email data. If you sign up to receive marketing emails, we collect your email address and your communication preferences, and we record unsubscribe requests.

Usage data through analytics (with your consent). If you allow analytics cookies, we collect information about how you use the Website, such as pages viewed, clicks, time spent, referring pages, and interactions, using cookies and similar technologies that create pseudonymous identifiers.

Advertising data (with your consent). If you allow advertising cookies, advertising partners may collect information about your visits and interactions to measure ad performance and support interest-based advertising, using cookies and similar technologies that create pseudonymous identifiers.

Social media integration data (with your consent). If you interact with embedded social media features or content (for example, videos or social media widgets), the relevant platform may collect data about your interaction and device, and may set cookies or similar technologies, depending on your settings and consent choices.

Sources of data:
We collect data directly from you when you submit forms, register for continuing education, or sign up for marketing emails.
We collect some data automatically when you access the Website (such as device and technical data).
We collect data from cookies and similar technologies when you choose to allow non-essential cookies through our consent tool.

Whether providing data is mandatory or optional:
Some data is required to provide the services you request (for example, registration and payment details for continuing education). Cookie choices and marketing sign-ups are optional. You can use the Website with non-essential cookies turned off, but some features (such as analytics-based improvements and interest-based advertising) will not operate without your consent.

How We Use Your Data

We use your personal data for the purposes below. For each purpose, we rely on one legal basis: consent, contract, or legitimate interests.

To register you for continuing education and provide related services (legal basis: contract).

To process payments and manage transactions for continuing education (legal basis: contract).

To respond to your requests and communicate with you about your registration or the services you request (legal basis: contract).

To send marketing emails when you sign up to receive them (legal basis: consent). You can unsubscribe at any time using the link in the email or by contacting us.

To collect analytics data to understand Website usage and improve the Website (legal basis: consent). Analytics cookies and similar technologies are not placed unless you choose to allow them.

To support personalized advertising and measure advertising performance (legal basis: consent). Advertising cookies and similar technologies are not placed unless you choose to allow them.

To operate, protect, and secure the Website, including detecting and preventing fraud, abuse, and security incidents (legal basis: legitimate interests). This includes using technical and security-related information necessary to maintain the integrity and availability of the Website.

Who We Share Your Data With

We share personal data only as needed to operate the Website, provide continuing education registration and payment processing, and run the services you choose to enable (such as analytics, advertising, and social media features). When we share data with service providers, they process it under their own privacy policies and, where applicable, under contractual obligations to protect the data.

We use our own consent management system (Trustwards) to record and manage your cookie preferences. This data is processed internally and not shared with third parties.

CookieYes. We use CookieYes to support cookie management and consent-related functionality on the Website, including presenting cookie choices and helping manage cookie settings. Data processed may include your cookie preferences and technical information needed to deliver the consent experience, and it is processed according to CookieYes’s privacy policy.

Google Analytics (Google). We use Google Analytics to measure Website usage and understand how visitors interact with the Website. This involves cookies and similar technologies that create pseudonymous identifiers, and it operates only when you consent to analytics cookies. Data is processed according to Google’s privacy policy.

Google Ads (Google). We use Google Ads to measure advertising performance and support interest-based advertising. This may involve cookies and similar technologies that create pseudonymous identifiers, and it operates only when you consent to advertising cookies. Data is processed according to Google’s privacy policy.

Microsoft. We use Microsoft services in connection with Website functionality and/or measurement and advertising-related services where enabled. Data processed may include device and usage information and pseudonymous identifiers, and it is processed according to Microsoft’s privacy policy.

International Data Transfers

Some of our service providers are located outside the EU/EEA, specifically in the United States. Where required, we use appropriate safeguards for international transfers, such as adequacy mechanisms or contractual protections.

Our consent management system (Trustwards) is based in Spain (EU), so consent data is not transferred internationally.

Google (including Google Analytics and Google Ads). Transfers may occur to the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework (DPF).

Microsoft. Transfers may occur to the United States. Microsoft Corporation is certified under the EU-U.S. Data Privacy Framework (DPF).

In addition, you indicated that international transfers may occur to the United States involving the following providers used in connection with Website features and integrations: Google, Meta, Microsoft, Stripe, Neustar, Mixpanel, Hotjar, Crazy Egg, Klaviyo, Auto. Where these providers process personal data for us and an international transfer applies, we use appropriate safeguards such as the EU-U.S. Data Privacy Framework (where applicable) and/or Standard Contractual Clauses approved by the European Commission.

How Long We Keep Your Data

We keep personal data only for as long as needed for the purposes described in this Privacy Policy, unless a longer retention period is required by law. Retention periods for specific data types are as follows:

Account data: until account deletion.
Cookie consent records: 10 years.
Security logs/technical records: 12 months.
Tax and accounting records: 10 years (legal requirement).
Analytics, advertising/marketing tracking, marketing email, and social media integration data: retained until consent is withdrawn or unsubscribed.

Cookie consent records: 10 years (to demonstrate compliance and address potential claims within legal limitation periods).
Security logs and technical records: 12 months.
Tax and accounting records: 10 years (legal requirement).

Analytics data: until consent is withdrawn or according to the analytics tool retention settings.
Advertising/marketing tracking data: until consent is withdrawn.
Marketing email data: until consent is withdrawn or user unsubscribes.
Social media integration data: until consent is withdrawn.

Your Rights

Your rights depend on where you live and which laws apply, but we provide the rights described below to the extent applicable to you.

For EU/EEA, UK, and Switzerland users, you may have the right to access your personal data, correct inaccurate data, delete your data, restrict processing, receive a portable copy of certain data, object to processing, withdraw consent at any time, and not be subject to automated decision-making or profiling that produces legal effects or similarly significantly affects you.

For California consumers, you may have the right to know what personal information is collected, used, shared, or sold; the right to delete personal information; the right to opt-out of the sale or sharing of personal information through “Do Not Sell or Share My Personal Information”; the right to correct inaccurate personal information; the right to limit the use and disclosure of sensitive personal information; and the right to not be discriminated against for exercising these rights.

For Brazilian data subjects, you may have the right to confirmation of processing and access, correction of incomplete, inaccurate, or outdated data, anonymization/blocking/deletion of unnecessary data, data portability, deletion of personal data processed with consent, information about shared data, and withdrawal of consent.

For Canadian individuals, you may have the right to access your personal information, challenge the accuracy and completeness of information and have it corrected as appropriate, withdraw consent (subject to legal or contractual restrictions and reasonable notice), and complain to the Privacy Commissioner of Canada.

How to exercise your rights:
To submit a request, contact us at hello@highbarhealth.com. We may ask for information to verify your identity and to understand your request. We will respond within one month where required under GDPR/LGPD, within 45 days for CCPA/CPRA requests (with the possibility of an additional 45 days where permitted with notice), or within 30 days where applicable under PIPEDA.

Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you.

Children's Privacy

Our services are not directed at children under 16 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

Data Security

We implement appropriate technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. No method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security, but we take reasonable precautions to protect the personal data we process.

Data Breach Notification

We maintain procedures to detect, report, and investigate security incidents. If a personal data breach occurs that poses a high risk to your rights and freedoms, we will notify you without undue delay and provide information about the nature of the breach, the likely consequences, and the measures taken or proposed to address it. If you suspect a security issue involving the Website, please contact us at hello@highbarhealth.com.

How to Lodge a Complaint

We encourage you to contact us first so we can try to resolve your concern. Depending on where you live, you may also have the right to lodge a complaint with the relevant authority.

For EU/EEA, UK, and Switzerland users, you may complain to the competent authority in your jurisdiction.

For California consumers, you may contact the California Privacy Protection Agency (CPPA): https://cppa.ca.gov/

For Brazilian data subjects, you may contact the ANPD (Autoridade Nacional de Proteção de Dados): https://www.gov.br/anpd/

For Canadian individuals, you may contact the Office of the Privacy Commissioner of Canada (OPC): https://www.priv.gc.ca/

Updates to This Policy

We review and update this Privacy Policy periodically to reflect changes to our practices, technologies, or legal requirements. The “Last updated” date at the top of this Privacy Policy indicates when it was last changed. If we make significant changes, we will provide notice by email or by a prominent notice on the Website. Changes take effect from the date indicated at the top of this Privacy Policy. Where processing is based on consent, we will request new consent when required.

Contact Us

Tax ID: true
Email: hello@highbarhealth.com
Address: 4 Richmond Square Suite 400, Providence, RI 02906
Data Controller: Highbar Physical Therapy

California Privacy Rights (CCPA/CPRA)

This section applies to California consumers and supplements the rest of this Privacy Policy.

Notice at Collection (categories collected in the last 12 months):
Identifiers and contact information (such as name and email address) when you register for continuing education or sign up for marketing emails.
Internet or other electronic network activity information (such as interactions with the Website) when you consent to analytics and advertising cookies.
Device and technical information (such as IP address and browser information) when you access the Website.
Payment and transaction information when you purchase continuing education.
Inferences drawn from online activity to support interest-based advertising, where enabled through advertising cookies and similar technologies.

Business or commercial purposes for collection and use:
To provide and administer continuing education registration and related services, including processing payments and maintaining transaction records.
To communicate with you about your registration and respond to your requests.
To send marketing emails when you opt in.
To operate, maintain, and secure the Website.
To measure Website performance and improve the Website (with consent where required).
To measure advertising performance and support interest-based advertising (with consent where required).

Sale and sharing of personal information:
We do not sell personal information.
We share personal information for cross-context behavioral advertising. This sharing occurs through advertising cookies and similar technologies when you allow advertising cookies.

Categories of personal information sold or shared:
We do not sell personal information. The categories of personal information shared for cross-context behavioral advertising are not specified.

Your right to opt-out (“Do Not Sell or Share My Personal Information”):
You can opt out of sharing for cross-context behavioral advertising by using our cookie settings to reject advertising cookies. You may also submit an opt-out request by contacting hello@highbarhealth.com.

Global Privacy Control (GPC):
Where we detect a valid Global Privacy Control signal, we treat it as a request to opt out of sharing for cross-context behavioral advertising for the browser or device that sends the signal.

Right to limit the use and disclosure of sensitive personal information:
If we collect sensitive personal information as defined by California law, you may have the right to request that we limit its use and disclosure to what is necessary to provide the services or as otherwise permitted by law. You can submit a request at hello@highbarhealth.com.

How to submit requests and verification:
You can submit requests to know, delete, correct, opt out, or limit by emailing hello@highbarhealth.com. To protect your information, we will take steps to verify your identity before fulfilling certain requests, which may include confirming information associated with your prior interactions with us. If you use an authorized agent, we may request proof of authorization and may still need to verify your identity directly.

Response timing and non-discrimination:
We respond to verifiable consumer requests within 45 days, and we may extend this period by an additional 45 days when permitted, with notice. We do not discriminate against you for exercising your CCPA/CPRA rights.

Brazilian Data Protection (LGPD)

This section applies to Brazilian data subjects and supplements the rest of this Privacy Policy.

Legal bases:
Depending on the purpose, we process personal data based on consent (for example, analytics, advertising cookies, marketing emails, and social media integrations), contract (for example, continuing education registration and payment processing), and legitimate interests (for example, protecting the Website and preventing fraud and security incidents).

Your LGPD rights include confirmation of processing and access, correction, anonymization/blocking/deletion of unnecessary data, portability, deletion of data processed with consent, information about sharing, and withdrawal of consent. You also have the right to petition the ANPD regarding our processing of your personal data.

To exercise your rights or contact our Data Protection Officer, email hello@highbarhealth.com.

Canadian Privacy Rights (PIPEDA)

This section applies to Canadian individuals and supplements the rest of this Privacy Policy.

Accountability:
We are responsible for personal information under our control and we have policies and practices designed to help protect it and handle it appropriately.

Meaningful consent:
We seek meaningful consent for the collection, use, and disclosure of personal information, including consent for non-essential cookies and for marketing emails. You can manage cookie choices through our cookie settings and you can unsubscribe from marketing emails at any time.

Access and accuracy:
You may request access to your personal information and request corrections if you believe it is inaccurate or incomplete. We may need to verify your identity before providing access or making changes.

Withdrawing consent:
You may withdraw consent, subject to legal or contractual restrictions and reasonable notice. Withdrawing consent may affect our ability to provide certain features (for example, analytics and advertising cookies, or marketing emails).

Complaints:
If you have concerns about our privacy practices, contact us at hello@highbarhealth.com. You may also complain to the Office of the Privacy Commissioner of Canada (OPC): https://www.priv.gc.ca/