1. Scope and operator

This policy explains how THE MANA COLLECTIVE LLC, MANA WARRIOR HEALTH, NP IN FAMILY HEALTH PLLC, DBA Mana Warrior Health, Mana Warrior Collective, Mana Warrior, and the locations or services identified at https://manawarrior.com/ (collectively, “Practice,” “we,” “us,” or “our”) collect, use, disclose, retain, and protect information through the website, online scheduling pages, contact forms, member-facing tools, and other digital services that link to this policy (the “Digital Services”).

This policy does not replace the Practice’s HIPAA Notice of Privacy Practices, informed consents, membership agreement, telehealth consent, or other notices that apply to clinical care. If this policy conflicts with the HIPAA Notice for protected health information, the HIPAA Notice and applicable law control.

2. Information we collect

Depending on how the Digital Services are configured and used, we may collect the following categories of information.

• Identifiers and contact information, such as name, date of birth, mailing address, email address, telephone number, and account username.

• Appointment and membership information, such as requested location, service, preferred time, membership tier, communications preferences, and referral source.

• Information you choose to submit, which may include health-related questions, symptoms, goals, medications, photographs, documents, or messages. Do not use a public website form for urgent or highly sensitive clinical information unless the form is expressly designated as secure.

• Transaction information, such as amount, date, invoice identifier, payment status, and limited payment-card metadata. Bluefin processes card information under its own terms; configure this statement to match actual data flows.

• Device and usage information, such as IP address, browser, device identifiers, pages viewed, referring pages, approximate location, timestamps, and interactions with site features.

• Cookies and similar technologies used for essential functionality, preferences, security, analytics, or advertising, as specifically configured in the cookie settings.

• Records of communications, including emails, texts, calls, support requests, and consent records.

3. How we collect information

We collect information directly from you; automatically from your browser or device; from authorized representatives; from vendors that support scheduling, payments, communications, security, or analytics; and, where permitted, from referral partners or publicly available sources.

4. How we use information

We use information only as reasonably necessary for the purposes described when it is collected, including to:

• Operate, secure, troubleshoot, and improve the Digital Services.

• Respond to inquiries, schedule appointments, verify identity, administer membership, and provide requested information.

• Communicate about appointments, service changes, safety matters, invoices, policy updates, and member administration.

• Provide health care and conduct treatment, payment, and health-care operations when the information becomes part of the Practice’s designated clinical systems and applicable law permits.

• Process payments, prevent fraud, maintain accounting records, and enforce agreements.

• Measure site performance and understand how visitors use the Digital Services, subject to the Practice’s tracking-technology controls.

• Send promotional communications only as permitted by law and applicable consent; honor opt-out requests.

• Comply with law, professional obligations, court process, audits, and regulatory requests; protect patients, workforce members, the Practice, and others.

5. How we disclose information

We may disclose information to the following categories of recipients for the purposes described in this policy:

• Service providers that host the site, schedule appointments, provide the patient portal, process payments, support communications, analyze security, store records, or provide professional services, subject to appropriate contracts.

• Health-care providers, laboratories, pharmacies, facilities, payers, and others involved in care or payment when authorized or permitted by law.

• Practice entities, personnel, and contractors who need the information for their assigned duties.

• Government, regulators, courts, law enforcement, or other parties when disclosure is required or permitted by applicable law and any heightened health-information protections are satisfied.

• A successor or transaction counterparty in a reorganization, sale, merger, financing, or transfer, subject to confidentiality and applicable law.

• Other recipients at your direction or with your consent.

6. Cookies, analytics, and tracking technologies

The Digital Services may use cookies and similar technologies. Essential technologies support functions such as security, load balancing, form completion, booking functionality, and preferences. Optional analytics or advertising technologies may be used only as disclosed in the cookie interface and configured by the Practice.

The Practice will not knowingly configure third-party tracking technology to receive protected health information from an authenticated patient portal, clinical intake workflow, or other health-specific page without documented legal, privacy, security, and contractual review.

Analytics / advertising tools: The website is hosted on Squarespace and uses Squarespace's built-in analytics and performance functionality. The website also uses Charm booking software for appointment scheduling and related booking functionality. No additional third-party advertising or marketing tracking technologies are currently configured. If Google Analytics or other third-party analytics or advertising technologies are added in the future, they will be configured and disclosed in accordance with the Practice's applicable privacy and cookie settings and policies.

Browser controls and the site's privacy settings may let you block or delete cookies. Some features may not function properly when essential cookies are blocked.

Global Privacy Control / Do-Not-Track: The website does not currently make a specific response to Global Privacy Control (GPC) or Do-Not-Track (DNT) signals beyond the privacy and cookie controls provided through the website.

7. Email, text, and telephone communications

Administrative messages about an inquiry, appointment, membership, invoice, or safety issue are transactional communications. Promotional email or text messages will be sent only as permitted by law and applicable consent. Consent to marketing is not a condition of treatment or purchase unless law expressly permits otherwise.

Email and ordinary text messages can be misdirected, forwarded, intercepted, or viewed on a shared device. Use CharmHealth for clinical or sensitive information. Text STOP to opt out of eligible automated promotional messages; contact aloha@manawarrior.com for other preferences. Message and data rates may apply.

8. Payment information

Payments are processed by Bluefin. The Practice should configure payment pages so that full payment-card data is not stored in the EHR or general website systems. The processor’s privacy notice and security practices also apply. The Practice may retain transaction identifiers, last four digits, card brand, amount, status, refunds, and accounting information.

9. Data security

We use administrative, physical, and technical safeguards designed for the sensitivity of the information, which may include access controls, multifactor authentication, encryption, logging, backups, vendor oversight, workforce training, and incident response. No transmission or storage system is guaranteed to be completely secure. Contact aloha@manawarrior.com promptly if you believe an account or communication has been compromised.

10. Retention

We retain information for as long as reasonably necessary for the purposes described, to provide care, maintain required records, resolve disputes, enforce agreements, preserve evidence, and comply with federal and state law. Clinical records are retained under the Practice’s medical-record retention schedule; web logs, consent records, contracts, and financial records may use different schedules. Legal holds suspend routine destruction.

11. Your choices and rights

You may update account information, change communications preferences, opt out of promotional messages, or request information about applicable privacy rights by contacting aloha@manawarrior.com. Rights concerning protected health information are described in the HIPAA Notice of Privacy Practices. The Practice will verify identity and authority before fulfilling a request and may retain information when required by law.

Residents may also have rights under applicable state consumer, health, and data-security laws. This policy does not limit any nonwaivable right. The Practice does not sell personal information for money.

State-specific rights

• New York Residents: If you are a New York resident, we will maintain reasonable administrative, technical, and physical safeguards for “private information” as required by the New York SHIELD Act and will provide breach notifications when required by applicable law. You may request access to or copies of your medical records, and you may request that inaccurate or incomplete clinical information be amended, subject to applicable law and the procedures described in the Practice’s HIPAA Notice of Privacy Practices and New York requirements. New York law may impose additional confidentiality protections for certain categories of health information. Nothing in this policy limits any nonwaivable right available under New York law.

• Hawaii Residents: If you are a Hawaii resident, you may have additional rights under Hawaii law concerning the security and protection of your personal information, including notice obligations following certain breaches of computerized data. We will maintain reasonable safeguards appropriate to the nature of the information we collect and will provide any notices required by applicable Hawaii law. Rights concerning protected health information—including access, copies, amendments, restrictions, confidential communications, and accounting of certain disclosures—are described in the Practice’s HIPAA Notice of Privacy Practices and may be subject to additional Hawaii requirements. Nothing in this policy limits any nonwaivable right available under Hawaii law.

12. Children and minors

The public-facing Digital Services are not directed to children under 13 and are not intended to collect information from a child without appropriate authorization. Health care for minors may be governed by special consent, confidentiality, parental-access, and record rules. A parent or other representative should not submit information unless authorized to do so. The Practice will address minor-consented care and confidential communications under applicable law.

13. Third-party links and integrations

The Digital Services may link to or integrate services operated by others. Their privacy and security practices are governed by their own notices, except to the extent the Practice has contracted for them as a service provider or business associate. Review external terms before providing information.

14. Changes to this policy

We may revise this policy. The revised version will show a new effective date and will be posted on the Digital Services. Material changes may also be communicated by another reasonable method. The Practice will preserve prior versions as required by its document-control policy.

15. Contact us

Privacy questions or requests: Christina Braddock, APRN, 401 N CANE STREET #A11, HALEIWA, HI 96712 or 100 BOARDWALK APT 903A, LONG BEACH, NY 11561, 808-212-9922, aloha@manawarrior.com. Security reports: aloha@manawarrior.com. Clinical emergencies should not be reported through these contacts; call 911 or go to the nearest emergency department.