Privacy policy

Last updated: April 20, 2026. Counsel-review draft. This policy is intended as a starting point for review by qualified legal counsel before being relied upon publicly. The substance is in good faith but should be confirmed against applicable jurisdictions and Acupuncturing's actual operational practices.

Who we are

Acupuncturing.com ("Acupuncturing," "we," "us") is a directory service that helps patients find licensed acupuncturists. The service is operated by ToteRental Inc., based in Ontario, Canada. References below to "the service" mean acupuncturing.com and any related subdomains.

What this policy covers

This policy explains what information we collect about you when you use the service, how we use it, when (and to whom) we share it, how long we keep it, and what choices and rights you have. It applies to information we collect from website visitors, patients submitting inquiries, and practitioners listed in our directory.

Information we collect

1. Information you provide directly

• Patient inquiries. When you submit a contact form, search a practitioner's profile, or send a message to a practitioner, we collect what you submit (typically: name, email, optional phone, location, condition or interest, and your message).
• Practitioner listings. When you create or claim a listing, we collect your professional information (name, credentials, license number and issuing jurisdiction, practice address, phone, email, website, services, photos, and bio).
• Account information. If you create a practitioner account, we collect login credentials (email and a hashed password) and any account preferences.
• Payment information. Practitioners who upgrade to paid tiers provide payment information directly to our payment processor (e.g., Stripe). We do not see or store full payment card numbers; we receive only the limited tokenized information required to manage your subscription.
• Communications. If you contact us by email, we retain those messages and our responses.

2. Information we collect automatically

• Usage data. Pages visited, time spent, search queries, click-throughs, referrer URL, and session timing.
• Device data. Browser type and version, operating system, screen size, and device type.
• Approximate location. Derived from IP address — typically city or metro level. We do not collect precise GPS location.
• Cookies and similar technologies. See our Cookie Policy for details on what we set, why, and how to control them.

3. Information we receive from third parties

• License verification. We confirm practitioner licensure with state acupuncture boards and the NCCAOM. The information returned (active status, license issue/expiry dates) is added to the practitioner's verification record.
• Analytics. Our analytics provider (currently Plausible Analytics, which is privacy-respecting and does not track individual users across sites) provides aggregated traffic data.

How we use information

We use the information we collect to:

• Provide the service — display listings, route inquiries to practitioners, deliver search results, and operate features you request
• Verify practitioner credentials
• Communicate with you about the service (account notices, listing status, transactional emails)
• Improve the service — analyze usage, prevent abuse, debug issues, and develop new features
• Comply with legal obligations
• Protect the rights, safety, and property of users, practitioners, and Acupuncturing

We do not use your information to:

• Sell, rent, or trade it to third parties
• Target advertising to you on other sites or services
• Build a profile of your health conditions for advertising or insurance purposes
• Train AI models without your explicit consent

When we share information

With practitioners (for inquiries you submit)

When you submit a contact form on a practitioner's profile, the message — including your name, contact information, and what you wrote — is delivered to that practitioner. The practitioner is independently responsible for handling your information once received. Acupuncturing is not a HIPAA-covered entity; our role is to facilitate the introduction, not to manage your care.

With service providers (data processors)

We work with third parties who help us operate the service, including:

• Hosting (Netlify)
• Form delivery (Netlify Forms)
• Email delivery (transactional emails — currently Postmark)
• Email marketing for opted-in users (currently Loops)
• Analytics (currently Plausible Analytics)
• Payment processing for practitioner subscriptions (Stripe)
• Customer support tooling

These providers are bound by contract to use your information only to perform the services we've engaged them for, and to keep it confidential and secure.

For legal reasons

We may disclose information if we believe in good faith that disclosure is required by law, legal process, or governmental request; to enforce our terms; to protect the rights, safety, or property of Acupuncturing, our users, or others; or in connection with a corporate transaction such as a merger or asset sale (in which case we will require the recipient to honor this privacy policy or notify you of changes).

With your consent

In any other case, we'll only share your information with your explicit consent.

How long we keep information

• Patient inquiry messages: 24 months by default, then deleted unless retention is required by law.
• Practitioner listings: For as long as the listing is active, plus 24 months after the listing is closed (for re-activation purposes), then archived in anonymized form.
• Account data: For as long as the account is active, plus 36 months after closure.
• Analytics data: Aggregated and retained indefinitely; individual session data is retained no longer than 14 months.
• Backup and audit data: Retained as required by our backup retention schedule (typically up to 90 days for routine backups).

Your rights and choices

For everyone

• Access. Request a copy of the information we have about you.
• Correction. Ask us to correct inaccurate information.
• Deletion. Ask us to delete your information, subject to legal retention requirements.
• Opt-out of marketing email. Every marketing email includes an unsubscribe link. You'll continue to receive transactional emails (account notices, security alerts).
• Cookie controls. Manage cookies through your browser settings or our Cookie Policy.

For California residents (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act and California Privacy Rights Act. These include the right to know what personal information we have collected, the right to request deletion, the right to opt out of any "sale" or "sharing" of personal information (we do not sell personal information), and the right not to be discriminated against for exercising these rights. To exercise these rights, contact us at the address below.

For European Economic Area, UK, and Swiss residents (GDPR / UK GDPR)

If you are in the EEA, UK, or Switzerland, you have rights under the GDPR (or equivalent UK or Swiss law) including access, rectification, erasure, restriction of processing, data portability, and the right to object to processing. You also have the right to lodge a complaint with a supervisory authority. Our lawful basis for processing is typically (a) the legitimate interests of operating the service, (b) performance of a contract with you, or (c) your consent.

For Canadian residents (PIPEDA)

If you are a Canadian resident, you have rights under the Personal Information Protection and Electronic Documents Act. These include access to your personal information and the right to challenge its accuracy.

To exercise any of these rights, email privacy@acupuncturing.com. We will respond within 30 days (45 days for some California requests).

Security

We use industry-standard technical and organizational measures to protect information from unauthorized access, loss, misuse, and alteration. These include encryption in transit (HTTPS), access controls, audit logging, and regular review of our security practices. No system is perfectly secure, however, and we cannot guarantee the security of information you transmit to us.

Children

Acupuncturing is not intended for children under 16. We do not knowingly collect information from children under 16. If you believe we have collected information from a child under 16, please contact us and we will delete it.

International data transfers

We are based in Canada and our service providers may be located in the United States, the European Union, or elsewhere. By using the service you understand that your information may be transferred to, stored in, and processed in countries other than your country of residence. We use appropriate safeguards (such as standard contractual clauses) where required by applicable law.

Changes to this policy

We may update this policy from time to time. When we do, we'll update the "last updated" date at the top. Material changes will be notified to account holders via email and announced on the site at least 30 days before they take effect.

Contact us

For questions about this policy or to exercise any of your rights:

Email: privacy@acupuncturing.com
Postal mail: ToteRental Inc., [postal address to be confirmed], Ontario, Canada