MYSTIC REBELS

CONSUMER HEALTH DATA PRIVACY POLICY

Last Updated: July 24, 2026

---

This Consumer Health Data Privacy Policy (“Health Data Policy”) supplements the Mystic Rebels Privacy Policy and explains how Mystic Rebels LLC, doing business as Mystic Rebels (“Mystic Rebels,” “we,” “us,” or “our”), collects, uses, discloses, and retains consumer health data. It applies when you provide health or wellness information through an intake form, booking, session, message, client file, recording, transcript, or related service.

This Health Data Policy is intended to provide the disclosures and rights required by applicable consumer-health privacy laws. Mystic Rebels is not representing that it is a health-care provider or business associate regulated by HIPAA. Our wellness and spiritual services are not a substitute for medical diagnosis, treatment, emergency care, or advice from a licensed professional.

1. Consumer health data we collect

“Consumer health data” means personal information that identifies or can reasonably be linked to a consumer and identifies, reveals, or permits an inference about the consumer’s physical or mental health status, care, condition, or related activity, as defined by applicable law.

Diagnoses, medical or wellness conditions, symptoms, concerns, goals, and relevant history that you choose to provide.

Medications, supplements, allergies, sensitivities, treatments, and related experiences.

Pregnancy, fertility, reproductive, hormonal, menstrual, or sexual-health information voluntarily provided for the requested service.

Mental, emotional, stress, trauma, mood, or behavioral information.

Diet, nutrition, sleep, movement, substance use, lifestyle, and daily-routine information.

Family health history and health-related information about another person that you are authorized to provide.

Appointments, services requested or received, practitioner interactions, recommendations, follow-up notes, and inferences reasonably drawn from the information above.

With consent, audio, video, captions, transcripts, and limited notes or deliverables that contain health-related information.

Device, account, and transaction information when it can be linked to a request for a health or wellness service.

We do not currently request health photographs as part of intake. Please do not send health photographs unless we specifically request them through an authorized, secure process.

2. Sources of consumer health data

We collect consumer health data primarily from you when you complete an intake, book or receive a service, participate in a recorded session, send a message, or ask us to retain relevant information. We may also receive information from a person you authorize, an assigned practitioner, or a service provider processing information at our direction. We do not purchase consumer health data from data brokers.

3. Why we collect and use consumer health data

Provide the health, wellness, spiritual, or related service you request.

Understand relevant history, concerns, contraindications, preferences, and goals.

Inform future bookings, advice, recommendations, continuity, and service support.

Schedule, conduct, document, and follow up on sessions.

Communicate with you and respond to requests.

Protect safety, prevent misuse, maintain security, resolve disputes, comply with law, and establish or defend legal claims.

We do not use consumer health data for advertising, targeted advertising, lookalike audiences, advertising measurement, customer-list uploads, or unrelated product profiling. We do not make decisions producing legal or similarly significant effects based on consumer health data.

4. Consent and collection

Where required, we request consent before collecting consumer health data. The intake or booking flow should identify the categories collected, the purposes, and this Health Data Policy. You may decline to provide optional information, but we may be unable to provide or appropriately tailor a service if necessary information is unavailable.

You may withdraw consent prospectively by emailing vibe@mysticrebels.com. Withdrawal does not affect processing already completed or information we must retain by law, but it may prevent us from continuing the service. Where law requires separate consent to disclose consumer health data, we will obtain it before the disclosure unless an exception applies.

5. Consumer health data disclosures

We may disclose consumer health data only as reasonably necessary to:

Authorized Mystic Rebels personnel who administer or support the requested service.

The practitioner assigned to provide the service, subject to confidentiality and data-handling requirements.

Service providers processing information at our direction, such as booking, videoconferencing, secure file, email, workspace, automation, transcription, and AI-assisted workflow providers.

Legal advisers, insurers, regulators, courts, law enforcement, emergency personnel, or other recipients when required by law or reasonably necessary to protect rights, safety, or legal claims.

A successor involved in a proposed or completed business transfer, subject to applicable notice, consent, and consumer-health-law restrictions.

Relevant providers may include Appointo, Zoom, Google Workspace, Gmail, Google Drive, Zapier, Make, OpenAI services, Shopify, and the assigned practitioner’s authorized service environment. Provider identities may change; we maintain internal records of the processors used.

6. No sale or advertising use

Mystic Rebels does not sell consumer health data for money or other valuable consideration. We do not disclose consumer health data to Meta, Google, Pinterest, TikTok, or another advertising platform for targeted advertising, advertising measurement, profiling, or audience creation. We do not permit advertising pixels on health intake, client-file, session, transcript, or related sensitive workspaces.

7. Recordings, transcripts, and automated processing

Recording is optional. Your choice is made during booking and verified before a recording begins. Recordings are not automatic; they are manually started only after consent. Zoom cloud recordings and transcripts are configured to auto-delete within 14 days and are then unrecoverable from that storage.

We may temporarily download or transfer a recording or transcript to complete an authorized automation, transcription, organization, drafting, or delivery step. We do not intentionally retain the raw recording or transcript after that step. Generated PDFs are delivered in a follow-up email and are not intentionally retained. Relevant information may be summarized in a secure client file for future continuity.

We may use AI-enabled tools as processors to assist an authorized workflow. We do not intentionally submit consumer health data for public model training or advertising. We minimize information sent to processors and apply available privacy and retention controls.

8. Retention and deletion

Secure client files are retained by default for continuity of the client relationship and may be retained indefinitely so future bookings, advice, and recommendations can reflect relevant history. We retain this information only for those continuity and service purposes unless a legal, safety, or claims-related purpose applies.

You may request deletion in writing at any time. We will honor a verified request subject to applicable exceptions and any shorter jurisdiction-specific retention requirement. We may retain limited information necessary to comply with law, document consent or deletion, protect security, prevent fraud, resolve disputes, or establish or defend legal claims. Information in encrypted backups may remain until ordinary rotation, but it will remain protected and unavailable for routine use.

Because some laws require information to be kept no longer than necessary, we may delete or de-identify information earlier and may periodically review client files for necessity, accuracy, and proportionality. Zoom cloud recordings and transcripts follow the separate 14-day deletion period described above.

9. Your consumer health data rights

Depending on applicable law and subject to exceptions, you may have the right to confirm whether we collect, share, or sell consumer health data; access the data; obtain a list of categories or specific third parties or affiliates receiving it; withdraw consent; correct inaccurate data; delete data; receive a portable copy; and appeal a denial.

Submit a request to vibe@mysticrebels.com and identify the right requested and the email or account involved. We may verify identity and authority and may accept a properly authorized agent where law permits. We will respond within the period required by applicable law. To appeal, reply with “Health Data Appeal” in the subject line and explain why you believe the decision should be reconsidered. We will not unlawfully discriminate against you for exercising a right.

A deletion request may require deletion from Mystic Rebels-controlled client files and instructions to processors, affiliates, or other recipients where applicable law requires. We may ask you to clarify the scope when necessary to complete the request accurately.

10. Security

We use reasonable administrative, technical, and organizational safeguards designed for the sensitivity of consumer health data, including role-based access, confidentiality expectations, secure service providers, and retention controls. No system is completely secure. If an incident occurs, we will investigate and provide notices required by applicable consumer-health, breach-notification, or other law.

11. Adults only

Our services are intended only for adults age 18 or older. We do not knowingly collect consumer health data from anyone under 18. Contact us if you believe a minor has provided such information.

12. Changes to this Health Data Policy

We may update this Health Data Policy to reflect changes in law or practice. We will post a revised effective date and provide additional notice or obtain consent where required. Material changes apply prospectively unless law permits otherwise.

13. Contact us

Mystic Rebels LLC
7901 4th St N Ste 300
St Petersburg, FL 33702, USA
Email: vibe@mysticrebels.com