Privacy Policy

We collect the following categories of information:

• Account information: your name, email, password (stored hashed by our identity provider), phone number, and role (customer or provider).
• Profile & location: your address or city, which we geocode into coordinates to power search; for providers, your service area, modes (in-person/virtual), licensed states, bio, and credentials.
• Bookings: services booked, dates and times, notes, and status.
• Payments: processed by Stripe. We do not store full card numbers; we retain payment metadata such as amounts, status, and identifiers needed to manage your bookings and payouts.
• Messages: content of chats you exchange with providers or customers through the Services.
• Usage & device data: log data, approximate location (from IP), device and browser information, and interactions with the Services.

• To provide, operate, and improve the Services, including search and matching.
• To facilitate bookings, payments, payouts, reminders, and communications.
• To personalize results and surface relevant providers and content.
• To send transactional notifications (confirmations, reminders, receipts) and, with consent, updates.
• To maintain security, prevent fraud and abuse, and comply with legal obligations.

We share information only as needed to run the Services, with the following categories of recipients:

• Between customers and providers: when you book or message, the other party sees the information necessary to deliver the service (e.g., your name and booking details). Customers’ precise coordinates are not shared with providers.
• Payment processing: Stripe, Inc., to process payments and provider payouts under its own terms and privacy policy.
• Cloud infrastructure: Amazon Web Services, specifically for hosting and data storage (DynamoDB, S3), sign-in (Cognito), address lookup (Location Service), and sending email (SES) and SMS (SNS) notifications.
• Messaging: Twilio, for WhatsApp message delivery where you’ve opted into that channel.
• Sign-in & calendar: Google, Apple, and Facebook, if you choose to sign in or connect a calendar using one of those accounts.
• Legal & safety: when required by law, to enforce our Terms, or to protect rights, safety, and property.
• Business transfers: in connection with a merger, acquisition, or sale of assets.

We do not sell your personal information.

Our infrastructure runs in the United States. If you are located in the European Economic Area, the United Kingdom, or Switzerland, using the Services means your information is transferred to, stored, and processed in the United States, which may not have the same data protection laws as your home country. Where required, these transfers rely on the Standard Contractual Clauses or an equivalent safeguard offered by each service provider named in Section 3.

We use the location you provide (address, city, or device GPS when you grant permission) to find providers near you, calculate distances, and apply licensing rules for virtual services. You can change or remove your location at any time in your profile.

Essential cookies (e.g., keeping you signed in) are required for the Services to function and don’t require consent. We also use Google Analytics to understand site usage, but only after you accept analytics cookies in the banner shown on your first visit. It does not load until you say yes, and you can decline or change your choice at any time. We do not use advertising cookies or sell information to ad networks.

We use industry-standard safeguards including encryption in transit (TLS) and at rest, scoped access controls, and secrets managed in a secure parameter store. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

When you delete your account, we remove your profile and, immediately, data that serves no purpose once your account is gone (notifications, point-transaction history, saved preferences). Some records are kept but de-identified rather than deleted outright. For example, a booking or support ticket has your name and contact details removed but the underlying record (amounts, dates, status) is kept, because deleting it outright would also erase the other party’s (the provider’s or customer’s) own record of that transaction, and because financial records may need to be kept to meet tax and accounting obligations. [Retention periods for de-identified financial and booking records: to be confirmed with counsel/an accountant and stated here as a specific duration.]

• Access, correct, or update your profile information at any time in the app.
• Download a copy of your data at any time from your profile settings (Download my data), or request one by contacting us.
• Delete your account at any time from your profile settings. This is immediate for most of your data; see Data Retention above for what’s de-identified and kept rather than deleted outright, and why.
• Opt out of non-essential notifications in your notification preferences, and of analytics cookies via the cookie banner.
• If you’re in the EEA, UK, or Switzerland, you have rights under the GDPR to access, rectify, erase, restrict, or object to our processing of your information, and to data portability. To exercise any of these, use the in-app controls above or contact us at the email below.
• Depending on your location, you may have additional rights under other laws such as the CCPA/CPRA.

Some information you share (e.g., booking notes or messages) may relate to your health or wellbeing. We treat this information as sensitive and limit access to what is necessary to provide the Services. Kosha Wellness is a marketplace and is not a healthcare provider; see our Terms of Service.

The Services are not directed to children under 18, and we do not knowingly collect their information. If you believe a child has provided us information, please contact us so we can remove it.

We may update this Policy from time to time. We will post the updated version with a new “Last updated” date and, for material changes, provide additional notice.

Questions about this Policy? Email us at support@kosha.life.