1. INTRODUCTION

Heartful Global (“Heartful Global”, “we”, “us”, “our”) respects your privacy and is committed to protecting your personal information.

We are an energy healing, holistic wellness and transformational coaching practice based in the Philippines, serving clients locally and internationally.

This Privacy Policy explains:

• Who we are

• What personal information we collect, and why

• How we use, store, share and protect that information

• Your rights, and how to exercise them

• How to contact us

We process personal information in accordance with Republic Act No. 10173, the Data Privacy Act of 2012, together with its Implementing Rules and Regulations and the issuances of the National Privacy Commission.

By visiting our website, booking a session, enrolling in a programme, attending an event, or purchasing our services, you acknowledge that you have read and understood this Privacy Policy.

2. WHO WE ARE

Heartful Global is the Personal Information Controller responsible for the personal information described in this Policy.

Contact Details

Business Address: M6-8C Montecito Residential Resorts, Resorts Drive, Pasay, Philippines 1309

Email: [email protected]

Phone: +63 917 651 0084

Our Data Protection Officer may be reached at [email protected]. If you have any question about this Policy, or wish to exercise any of your rights, please contact us using the details above.

3. THE INFORMATION WE COLLECT

Personal information means any information that identifies you, directly or indirectly. We may collect, use, store and transfer the following categories:

Identity Information

First name, last name, preferred name, username, date of birth, gender, and country of residence.

Contact Information

Email address, mobile or telephone number, billing address, mailing address, and social media handle where you contact us through those channels.

Financial and Transaction Information

Billing details and records of the sessions, programs and products you have purchased. Card and bank details are collected and processed directly by our third-party payment providers — we do not store full payment card numbers on our own systems.

Sensitive Personal Information

Because of the nature of our work, we may collect information about your health and personal circumstances, for example, hormonal and reproductive health, PCOS, a cancer diagnosis or treatment history, emotional and mental wellbeing, family and ancestral history, and other matters you choose to share in our pre-program questionnaire or in a session.

Under the Data Privacy Act of 2012, health information is classified as sensitive personal information and is given a higher level of protection. We collect it only with your consent, only where it is relevant to the support you have asked us to provide, and we handle it as described in Section 6.

Session Records

Your pre-program questionnaire responses, any notes we make, and correspondence relating to your journey with us. We do not record our session calls, unless you wanted to keep your own record.

Technical Information

IP address, browser type and version, device information, operating system, time zone, and login data.

Usage Information

How you interact with our website, emails, course platforms, programs and services.

Marketing and Communications Information

Your preferences for receiving communications from us, and your engagement with those communications.

We may also use anonymized or aggregated information — which can no longer identify you — for statistical, research and business analysis purposes.

4. HOW WE COLLECT YOUR INFORMATION

Directly From You

When you:

• Book a healing session or discovery call

• Complete our pre-program questionnaire

• Enroll in a program, course, workshop or retreat

• Purchase a digital product, meditation or recording

• Subscribe to our newsletter or download a free resource

• Fill in a form, survey or feedback request

• Contact us by email, phone, website form or social media

• Share your experience with us during a session

Automatically

Through cookies, analytics tools and similar technologies when you use our website or open our emails. Please see Section 13.

From Third Parties

We may receive information from:

• Payment processors

• Booking and scheduling platforms

• Course and membership platforms

• Email marketing and CRM systems

• Analytics providers, such as Google Analytics

• Advertising and social media platforms

• Collaborating practitioners, where you have consented to a joint programme or referral

5. HOW AND WHY WE USE YOUR INFORMATION

We process your personal information only where we have a lawful basis to do so.

Under the Data Privacy Act of 2012, our bases are:

• Consent — Your consent

• Contract — processing that is necessary to deliver the session, program or product you have purchased

• Legal obligation — where we must retain records for tax, accounting or regulatory reasons

• Legitimate interests — to run, protect and improve our practice, in a way that does not override your rights and freedoms

We use your information to:

• Deliver healing sessions, coaching, programs and events

• Prepare for your session and provide continuity of care between sessions

• Process payments and issue receipts and invoices

• Manage bookings, rescheduling and cancellations

• Provide client support and respond to your enquiries

• Send you practical updates about a program you are enrolled in

• Send marketing communications, where you have consented

• Maintain our business records and meet our tax and accounting obligations

• Improve our website, our offerings and the client experience

• Protect against fraud, misuse and unauthorized access

We do not sell your personal information, and we do not share it with third parties for their own marketing purposes.

6. HEALTH INFORMATION AND SESSION CONFIDENTIALITY

We treat everything you share with us as confidential.

Health information is sensitive personal information under the Data Privacy Act of 2012. We process it only on the basis of your consent, or where processing is otherwise permitted under Section 13 of that Act.

You give that consent voluntarily, in one of two ways:

• By completing our pre-program questionnaire, which carries a data privacy notice explaining how your responses will be used

• By choosing to share something with us during a session or in correspondence

How we handle what you share:

• We use it only to support you in the work you have engaged us for

• Access is limited to your healer-coach facilitator and team assistant where necessary for scheduling and administration, an assistant who is bound to keep client information confidential

• We do not disclose your health information to family members, employers, insurers or any other party without your consent, unless we are required to do so by law or by a lawful order of a court or regulator

• We may draw on anonymized themes for teaching or content, in a form that cannot identify you. We will always ask you separately before sharing any identifiable story or testimonial

Please note that our services are complementary and educational in nature and are not a substitute for medical diagnosis, treatment or advice from a licensed healthcare professional. The records we keep are practice records, not medical records, and Heartful Global is not a healthcare institution under Philippine law.

7. MARKETING COMMUNICATIONS

You will receive marketing communications from us where you have:

• Subscribed to our newsletter or downloaded a free resource

• Registered for a masterclass, workshop or event

• Purchased a session, program or product from us

• Otherwise opted in to hear from us

You may withdraw your consent at any time by clicking the unsubscribe link at the foot of any marketing email, or by emailing [email protected]. We will action your request promptly.

Withdrawing from marketing does not affect service communications relating to a session or program you have already purchased, for example, joining links, schedules and receipts.

8. SHARING YOUR INFORMATION

We may share your personal information with:

• Payment processors and invoicing providers

• Booking, scheduling and video conferencing platforms

• Course, membership and community platforms

• Email marketing and CRM providers

• Website hosting and IT service providers

• Professional advisers, including accountants and legal counsel

• Collaborating practitioners, where you have enrolled in a joint program and have been told who is involved

• Government authorities, courts or regulators, where we are legally required to disclose

Every third party we engage is required, by contract or by their own binding terms, to process your information securely, only for the purposes we specify, and in a manner consistent with the Data Privacy Act of 2012. We remain accountable for personal information that we transfer to them.

9. WHERE YOUR INFORMATION IS STORED

Heartful Global operates from the Philippines. We do not sell, transfer or send your personal information to organizations in other countries.

However, we run our practice on established online platforms, such as Google Workspace, our funnel and email platform, our payment processor and our video conferencing tool, and these providers store data on servers located outside the Philippines. This means your information may be held on servers abroad, even though we are based here and do not move it ourselves.

We remain accountable for your information under the Data Privacy Act of 2012 wherever it is stored. We choose established providers that publish their own security and data protection commitments, and we rely on those commitments as the safeguard for information held on their systems.

10. DATA SECURITY

We are a small practice. Rather than operate our own systems, we hold client information on established third-party platforms including Google Workspace, our funnel and email platform, and our payment processor which maintain their own technical and organizational security measures, and which we rely on for the protection of the information stored there.

On our side, we take the following reasonable steps:

• Two-factor authentication is enabled on the accounts we use to hold client information

• Access is limited to professional healer-coach and an assistant who supports scheduling and administration, and who is bound to keep client information confidential

• We keep client information within these platforms rather than on personal devices or informal channels wherever possible

• We remove access promptly when someone stops working with us

• We do not share account logins outside the practice

No online platform can be guaranteed to be completely secure. While we take these steps in good faith, we cannot warrant the security of information transmitted over the internet, and any transmission is at your own risk.

If a personal data breach occurs that is likely to give rise to a real risk of serious harm, we will notify the National Privacy Commission and the affected individuals within the timeframes required by law.

11. DATA RETENTION

We keep your personal information only for as long as it is necessary to:

• Deliver the services you have purchased and provide continuity of care

• Comply with our tax, accounting and legal record-keeping obligations

• Resolve disputes and enforce our agreements

As a general guide:

• Client and transaction records are kept for up to one (1) year, within Philippine tax and record-keeping requirements

• Questionnaire responses and session notes are kept until your program is complete, after which they are deleted

• Marketing information is kept until you withdraw your consent

Once information is no longer needed, we securely delete or anonymize it. Anonymized information may be retained indefinitely for statistical purposes.

12. YOUR RIGHTS

Under the Data Privacy Act of 2012, you have the following rights:

• To be informed — to know that your personal information is being collected and processed, and for what purpose

• To access — to request a copy of the personal information we hold about you

• To rectification — to have inaccurate or incomplete information corrected or completed

• To erasure or blocking — to have your information removed or suspended where it is incomplete, outdated, false, unlawfully obtained, or no longer necessary for the purpose it was collected

• To object — to object to the processing of your information, including for direct marketing and automated processing

• To data portability — to obtain a copy of your information in a structured, commonly used and electronically readable format

• To withdraw consent — at any time, where our processing relies on your consent

• To file a complaint — to lodge a complaint with the National Privacy Commission if you believe your rights have been infringed

To exercise any of these rights, please email [email protected]. We may ask you to verify your identity before we act on a request, in order to protect your information. We will respond within the period required by law, and ordinarily within thirty (30) days.

Some rights are qualified. For example, we may be unable to delete information we are required by law to retain, and withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. Where we cannot fully act on a request, we will explain why.

The National Privacy Commission may be contacted at [email protected] or through www.privacy.gov.ph.

13. COOKIES AND TRACKING

Our website may use cookies and similar technologies to:

• Keep the site functioning and remember your preferences

• Understand how visitors use the site

• Measure the performance of our content and advertising

You can accept, refuse or delete cookies through your browser settings. Disabling certain cookies may affect how parts of our website work.

14. THIRD-PARTY LINKS

Our website, emails and program materials may contain links to third-party websites, platforms and resources. We are not responsible for their privacy practices or their content. We encourage you to read their privacy notices before providing any personal information to them.

15. CHILDREN

Our services are intended for adults. We do not knowingly collect personal information from anyone under eighteen (18) years of age without the consent of a parent or legal guardian. Where we work with a minor, for example, in family or ADHD support, we obtain written consent from the parent or legal guardian before collecting any information.

If you believe we have collected information from a child without appropriate consent, please contact us and we will delete it.

16. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time to reflect changes in our practice, our tools, or the law. Any updated version will be published on our website with a revised effective date. Where a change is significant, we will notify you directly.

Your continued use of our website and services after an update takes effect constitutes acceptance of the revised Policy.

17. HOW TO CONTACT US

If you have any question, concern or request about this Privacy Policy or about how we handle your personal information, we would genuinely like to hear from you.

Heartful Global

M6-8C Montecito Residential Resorts, Resorts Drive, Pasay, Philippines 1309

Email: [email protected]

Phone: +63 917 651 0084

We will always do our best to resolve your concern directly. If you remain unsatisfied, you have the right to raise the matter with the National Privacy Commission.