Privacy Policy

Forbidden Well (“Forbidden Well,” “we,” “our,” or “us”) is committed to protecting the privacy and confidentiality of individuals who interact with our brand, visit our website, or receive services at our locations.

This Privacy Policy explains how we collect, use, disclose, and safeguard information when you:

• Visit our website (forbiddenwell.com)
• Book or receive wellness or spa services at our facility
• Interact with our scheduling, intake, and communication tools
• Receive non‑clinical services coordinated through Forbidden Well

Forbidden Well operates as a management services organization and luxury wellness brand. Independent professional medical practices and their licensed clinicians are solely responsible for any medical or clinical services. Forbidden Well does not practice medicine or provide professional medical services.

By accessing our website or using services coordinated through Forbidden Well, you consent to the practices described in this Privacy Policy.

This Privacy Policy applies to information:

• Collected through forbiddenwell.com and related digital touchpoints
• Collected during bookings, check‑ins, and service encounters at our location
• Collected via SMS, email, and other communications with Forbidden Well

To the extent we support independent professional medical practices (for example, through scheduling, intake, or administrative services), some information may also be subject to those practices’ own privacy terms or Notices of Privacy Practices. Clinical records and medical decision‑making are controlled by the independent professional practices, not Forbidden Well.

We collect information necessary to operate our business, coordinate services, and support independent professional practices. This may include:

We use the information we collect for legitimate business and operational purposes, including to:

• Provide, coordinate, and manage wellness and spa services
• Support scheduling, rescheduling, and confirming appointments
• Facilitate intake workflows and prepare for your visit
• Process payments, handle billing questions, and maintain financial records
• Communicate with you about bookings, updates, promotions, and general inquiries
• Improve our services, customer experience, and website performance
• Support administrative functions for independent professional practices we work with
• Comply with legal, regulatory, tax, and recordkeeping obligations
• Help prevent fraud, misuse, or security incidents

Where required, we rely on your consent (for example, certain marketing communications) and you may withdraw that consent as described in this Policy.

If you provide your mobile number and opt in to receive text messages, we may send SMS or MMS communications related to:

• Appointment confirmations and reminders
• Arrival instructions and follow‑up communications
• Billing, account, or scheduling notifications
• Occasional promotions or marketing messages if you have opted in for marketing

Message frequency may vary. Standard message and data rates may apply, depending on your mobile plan.

You may opt out of marketing texts at any time by replying “STOP” to any message.

For assistance, reply “HELP” or contact us using the information on our website.

We do not sell or rent your phone number or SMS consent data to third parties for their own marketing purposes.

We use cookies and similar technologies to:

• Maintain core site functionality and security
• Remember your preferences and improve user experience
• Understand how visitors use our website (for example, pages viewed, navigation patterns)
• Support basic analytics and performance measurement

You can control or disable cookies through your browser settings. If you disable certain cookies, some features of the website may not function properly.

We do not use cookies or tracking technologies to sell your personal information.

We do not sell or rent personal information. We may share information only as reasonably necessary to operate our business, including:

We take steps to ensure that service providers only use information as necessary to perform services on our behalf.

We implement administrative, technical, and physical safeguards designed to protect information against unauthorized access, use, alteration, or disclosure. These measures may include:

• Role‑based access controls
• Secure systems and networks
• Encrypted data transmission where appropriate
• Staff training and confidentiality expectations
• Vendor due diligence and contractual safeguards

No method of transmission or storage is completely secure. While we work to protect your information, we cannot guarantee absolute security.

If you participate in telehealth‑related interactions that are coordinated or supported through systems used by Forbidden Well, you consent to the use of electronic communication platforms such as video, audio, SMS, and email.

We take reasonable steps to protect confidentiality within these tools.

Additional telehealth or treatment‑specific consents, including any provider practice terms, may apply and should be reviewed at the time of use.

Clinical decisions and clinical records are controlled by the independent professional practices and their licensed clinicians.

Electronic communications may not always be fully secure; you should avoid transmitting highly sensitive information via unencrypted channels when possible.

Depending on applicable law and the context of your interaction with us, you may have the right to:

• Request access to certain personal information we maintain about you
• Request correction of inaccurate or incomplete information
• Request deletion of your information, subject to legal, regulatory, and recordkeeping requirements
• Withdraw consent for certain processing (for example, marketing communications), without affecting prior lawful use
• Manage your communication preferences (for example, unsubscribe from marketing emails, opt out of marketing SMS)

We may need to verify your identity before responding to certain requests. We may also retain information where we have a legal obligation, a legitimate business need, or where records are required for bookkeeping, dispute resolution, or compliance.

For clinical records maintained by independent professional practices, requests may need to be directed to the applicable practice or clinician.

We retain personal information only for as long as reasonably necessary to:

• Provide and support services
• Maintain accurate business and financial records
• Comply with legal and regulatory obligations
• Resolve disputes and enforce agreements
• Support internal analytics, planning, and security

Retention periods may vary based on the type of information, the nature of the services, and applicable law. Clinical records retention may be governed by separate obligations of the independent professional practices.

Our website may contain links to third‑party websites, applications, or platforms that are not operated or controlled by Forbidden Well. We are not responsible for the privacy practices, security, or content of those third parties. You should review their privacy policies and terms before providing information or using their services.

Our website and services are not directed to children who are not legally permitted to consent to services on their own. If a minor receives services that require the involvement of a parent, guardian, or other authorized representative, additional documentation and consents may be required through the applicable professional practice.

If we become aware that personal information has been collected from a child in a way that is inconsistent with applicable law, we will take appropriate steps to address it.

We may update this Privacy Policy from time to time to reflect changes in our operations, services, legal requirements, or technology. When we make material changes, we will revise the “Last updated” date at the top of this page. The updated Policy is effective when posted unless stated otherwise.

Your continued use of our website or services after an update is posted indicates that you have read and understood the revised Privacy Policy.