Who We Are

Joint Ventures is operated by Highbar Physical Therapy, which is the data controller for the personal data described in this Privacy Policy.

Data Controller: Highbar Physical Therapy
Email: hello@highbarhealth.com
Address: 4 Richmond Square Suite 400, Providence, RI 02906

What Data We Collect

We collect the following categories of personal data when you use our website to learn about our physical therapy services and to register and pay for continuing education:

Cookie consent preferences, including your choices about which cookies and similar technologies you allow.
Device and technical information, including IP address, browser type, device identifiers, operating system, and information needed to load and secure the website.
Registration and account data, including your name, email address, and details you submit when registering for continuing education.
Transaction and payment-related data, including billing details and information needed to process your payment (payment processing is handled by payment processors; we do not need to store full payment card details to complete a transaction).
Marketing contact data, including your email address and your marketing preferences when you sign up to receive marketing emails.
Usage data collected through analytics technologies, such as pages viewed, interactions, and approximate location derived from IP address, where you have provided consent for analytics cookies or similar technologies.
Advertising and measurement data, including pseudonymous identifiers and information about interactions with ads, where you have provided consent for advertising cookies or similar technologies and where sharing occurs for cross-context behavioral advertising.
Social media and embedded content data, including data processed when you interact with social media features or view embedded videos (for example, YouTube), which may involve cookies or similar technologies depending on your settings and consent choices.

Sources of data:
Directly from you when you submit forms, register for continuing education, make a purchase, or sign up for marketing emails.
Automatically from your device when you access the website (for example, IP address and technical logs).
From cookies and similar technologies, where you have provided consent for non-essential cookies.

Providing certain data is necessary to register for and purchase continuing education (for example, registration and transaction details). Providing marketing and non-essential cookie data is optional, and you can choose whether to consent.

How We Use Your Data

We use your personal data for the purposes below, and we rely on the legal basis listed for each purpose (depending on your location and the applicable law):

To provide our services and administer continuing education registration, including creating and managing your registration or account and providing customer support related to your registration (legal basis: contract).
To process payments and complete transactions for continuing education (legal basis: contract).
To send marketing emails where you have signed up to receive them, and to manage your marketing preferences and unsubscribe requests (legal basis: consent).
To measure and understand how our website is used through analytics technologies that use cookies or similar identifiers, where you have provided consent (legal basis: consent).
To deliver and measure advertising and to support cross-context behavioral advertising where enabled, including sharing data for advertising measurement and targeting where you have provided consent (legal basis: consent).
To protect our website and users, including detecting, preventing, and responding to security threats, abuse, and fraud, and maintaining the reliability of our systems (legal basis: legitimate interest).
To produce aggregated statistics from technical logs that do not rely on cookies or similar technologies that require consent, for example to understand overall traffic volumes and system performance (legal basis: legitimate interest).

Who We Share Your Data With

We share personal data with service providers and partners to operate the website, deliver continuing education registration and payment, and support analytics, advertising, and embedded content. These recipients process personal data under their own privacy policies and, where applicable, under contractual terms with us.

We use our own consent management system (Trustwards) to record and manage your cookie preferences. This data is processed internally and not shared with third parties.

Mixpanel (analytics): used to understand how users interact with our website and improve user experience; data is shared when you consent to analytics technologies.
Google Analytics (analytics): used to measure website usage and performance; data is shared when you consent to analytics technologies.
Microsoft (analytics/advertising and related services): used for website measurement and related services; data is shared when you consent to the relevant cookies or similar technologies.
Google Ads (advertising network): used to deliver and measure advertising and support cross-context behavioral advertising where enabled; data is shared when you consent to advertising technologies and where sharing occurs for behavioral advertising.
Google (supporting services for analytics/advertising and website functionality): used to provide services that support analytics, advertising, and website delivery; data is shared as needed for those services based on your consent choices and our configuration.
YouTube (embedded video/social media platform): used to display embedded video content; YouTube may collect data through cookies or similar technologies depending on your settings and consent choices.

International Data Transfers

Some of our service providers are located outside the EU/EEA, specifically in the United States. This means that, depending on your location, your personal data may be transferred internationally and processed in countries that may not provide the same level of data protection as your home jurisdiction.

Transfers related to our consent management system (Trustwards) are not international transfers because Trustwards is based in Spain (EU).

We may transfer personal data to the United States in connection with the following providers and categories you may encounter through our website and configuration: Google (including Google Analytics and Google Ads), Microsoft, Mixpanel, YouTube, Meta, Stripe, Neustar, Hotjar, Crazy Egg, Klaviyo, and Auto.

Where applicable, we use recognized transfer mechanisms. For providers that participate in the EU-U.S. Data Privacy Framework, we rely on their certification for relevant transfers, including Google LLC and Microsoft Corporation. For other U.S.-based providers where certification cannot be confirmed for the specific service, we rely on Standard Contractual Clauses approved by the European Commission and, where required, additional safeguards.

How Long We Keep Your Data

Account data: until account deletion.
Cookie consent records: 10 years.
Security logs/technical records: 12 months.
Tax and accounting records: 10 years (legal requirement).
Analytics, advertising/marketing tracking, marketing email, and social media integration data: retained until consent is withdrawn or unsubscribed.

Cookie consent records: 10 years (to demonstrate compliance and address potential claims within legal limitation periods).
Security logs and technical records: 12 months.
Tax and accounting records: 10 years (legal requirement).

Analytics data: until consent is withdrawn or according to the analytics tool retention settings.
Advertising/marketing tracking data: until consent is withdrawn.
Marketing email data: until consent is withdrawn or user unsubscribes.
Social media integration data: until consent is withdrawn.

Your Rights

Depending on where you live and which law applies, you may have the following rights regarding your personal data:

Access: request access to the personal data we hold about you.
Correction: request that we correct inaccurate or incomplete personal data.
Deletion: request that we delete your personal data in certain circumstances.
Restriction: request that we limit how we use your personal data in certain circumstances.
Data portability: request a copy of certain personal data in a portable format and, where applicable, ask that it be transferred to another organization.
Objection: object to certain processing, including where we rely on legitimate interests.
Withdraw consent: where we rely on consent, you can withdraw it at any time (this will not affect processing that occurred before you withdrew consent).
Automated decision-making: the right not to be subject to automated decision-making or profiling that produces legal effects or similarly significantly affects you.

California consumers may also have the right to know what personal information is collected, used, shared, or sold; the right to opt-out of the sale or sharing of personal information; the right to limit the use and disclosure of sensitive personal information; and the right to non-discrimination for exercising privacy rights.

Brazilian data subjects may also have the right to confirmation of processing and access; correction; anonymization, blocking, or deletion of unnecessary data; portability; deletion of personal data processed with consent; information about sharing; and the right to withdraw consent.

Canadian individuals may also have the right to access their personal information, challenge the accuracy and completeness of information, withdraw consent (subject to legal or contractual restrictions), and complain to the Privacy Commissioner of Canada.

To exercise your rights, contact us at hello@highbarhealth.com. We may need to verify your identity before responding.

Response timing depends on the law that applies to your request:
For GDPR and LGPD requests, we generally respond within one month.
For CCPA/CPRA requests, we generally respond within 45 days (and may extend by an additional 45 days with notice).
For PIPEDA requests, we generally respond within 30 days.

Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you.

Children's Privacy

Our services are not directed at children under 16 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

Data Security

We implement appropriate technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. No method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security, but we take reasonable precautions to reduce risk.

Data Breach Notification

If we become aware of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay as required by applicable law. Our notification will describe, where appropriate, the nature of the breach, the likely consequences, and the measures taken or proposed to address it. We maintain procedures to detect, report, and investigate security incidents. If you suspect a security issue, contact us at hello@highbarhealth.com.

How to Lodge a Complaint

We encourage you to contact us first so we can try to resolve your concern. Depending on your location, you may also have the right to lodge a complaint with a supervisory authority or regulator.

For EU/EEA/UK/Switzerland individuals, you may lodge a complaint with the competent authority in your jurisdiction.
For California consumers, you may contact the California Privacy Protection Agency (CPPA) at https://cppa.ca.gov/ or the California Attorney General.
For Brazilian data subjects, you may contact the ANPD (Autoridade Nacional de Proteção de Dados) at https://www.gov.br/anpd/.
For Canadian individuals, you may contact the Office of the Privacy Commissioner of Canada at https://www.priv.gc.ca/.

Updates to This Policy

We review and update this Privacy Policy periodically to reflect changes to our practices, technologies, or legal requirements. The “Last updated” date at the top shows when this policy was most recently revised. If we make significant changes, we will provide notice by email or through a prominent notice on our website. Where processing is based on consent, we will request new consent when required.

Contact Us

Email: hello@highbarhealth.com
Address: 4 Richmond Square Suite 400, Providence, RI 02906
Data Controller: Highbar Physical Therapy

California Privacy Rights (CCPA/CPRA)

This section applies to California consumers.

Notice at Collection (categories collected in the last 12 months):
Identifiers, such as name, email address, IP address, and online identifiers (including cookie identifiers where enabled).
Personal information categories listed in California law, such as contact information and billing information.
Internet or other electronic network activity information, such as interactions with our website, collected through analytics and advertising technologies where enabled.
Commercial information, such as records of continuing education registrations and purchases.
Geolocation data at a general level, such as approximate location derived from IP address.

Business and commercial purposes for collection and use:
To provide and administer continuing education registration and related services, including processing payments and providing support.
To operate, maintain, and secure our website and systems.
To measure website performance and improve our services through analytics where you enable those technologies.
To send marketing emails where you have opted in.
To deliver and measure advertising and support cross-context behavioral advertising where enabled.

Sale and sharing:
We do not sell personal information.
We share personal information for cross-context behavioral advertising.
Categories of personal information sold or shared: Not specified.

Your rights:
Right to know what personal information we collect, use, share, or sell.
Right to delete personal information (subject to exceptions).
Right to correct inaccurate personal information.
Right to opt-out of the sale or sharing of personal information: you can exercise this right by using a “Do Not Sell or Share My Personal Information” choice available through our cookie and tracking preference controls, and by enabling opt-out signals where supported.
Right to limit the use and disclosure of sensitive personal information: if we use or disclose sensitive personal information beyond what is permitted without offering this right, you may request that we limit such use and disclosure.
Right to non-discrimination for exercising your CCPA/CPRA rights.

Submitting requests:
You can submit a request by contacting hello@highbarhealth.com. We will verify your request by asking for information that matches what we maintain in our records and by taking steps appropriate to the sensitivity of the data and the nature of the request. Authorized agents may submit requests on your behalf, and we may request proof of authorization and verification of your identity.

Timing:
We generally respond within 45 days. If we need more time, we may extend by an additional 45 days and will notify you of the reason for the extension.

Global Privacy Control:
Where required, we treat Global Privacy Control (GPC) signals as valid requests to opt-out of sharing for cross-context behavioral advertising for the browser or device that sends the signal.

Brazilian Data Protection (LGPD)

This section applies to Brazilian data subjects.

Legal bases:
We process personal data under LGPD legal bases that include consent (for example, for analytics, advertising/marketing tracking, marketing emails, and certain social media integrations) and performance of a contract (for example, to register you for continuing education and process payments). We may also rely on legitimate interests to protect our website and users and to maintain the security and integrity of our services.

Your rights under LGPD include:
Confirmation of whether we process your personal data and access to it.
Correction of incomplete, inaccurate, or outdated data.
Anonymization, blocking, or deletion of unnecessary or excessive data, or data processed in non-compliance with the law.
Portability, where applicable.
Deletion of personal data processed with your consent, where applicable.
Information about public and private entities with which we have shared data, where applicable.
Withdrawal of consent at any time, where processing is based on consent.

You may also petition the ANPD (Autoridade Nacional de Proteção de Dados) regarding our processing of your personal data.

Data Protection Officer contact: hello@highbarhealth.com

Canadian Privacy Rights (PIPEDA)

This section applies to Canadian individuals.

Accountability:
We are responsible for personal information under our control and have practices designed to help protect it and ensure it is handled in line with this Privacy Policy.

Meaningful consent:
We seek meaningful consent for the collection, use, and disclosure of personal information, including for non-essential cookies and similar technologies used for analytics, advertising, and marketing. You can manage your cookie preferences through our consent controls and you can unsubscribe from marketing emails at any time using the unsubscribe link in the email or by contacting us.

Access and accuracy:
You may request access to your personal information and request corrections if you believe it is inaccurate or incomplete.

Withdrawing consent:
You may withdraw consent, subject to legal or contractual restrictions and reasonable notice. Withdrawing consent may affect our ability to provide certain features that rely on consent (for example, analytics or marketing).

Complaints:
If you have concerns about our handling of your personal information, you can contact us at hello@highbarhealth.com. You also have the right to complain to the Office of the Privacy Commissioner of Canada at https://www.priv.gc.ca/.