Consumer Health Data Privacy Policy

Consumer Health Data Privacy Policy — Sage and Santo, LLC (including Lensa)

Last updated: October 27, 2026

Categories of consumer health data we collect: assessment and questionnaire answers about health-related habits and wellbeing; health or wellbeing information you share during coaching; session notes that reflect that information.

Why we collect and use it: only to provide the coaching or consulting services you request, including preparing for and following up on sessions.

Sources: directly from you, and notes we write during sessions.

Categories we share and with whom: we share consumer health data only with service providers that store or process it for us: Proton AG, which provides our encrypted email, calendar and scheduling, notes and video calls. We do not sell consumer health data.

Your rights: you can (1) confirm whether we collect, share or sell your consumer health data and get a list of the third parties and affiliates it was shared with, (2) withdraw consent, and (3) have it deleted, including from backups. To make a request, email Administration@SageandSanto.com or call +1 (347) 596-3680. If we deny your request, you can appeal by emailing Administration@SageandSanto.com with “Appeal” in the subject line. If the appeal is denied, you may contact the Washington State Attorney General at atg.wa.gov/file-complaint.

Other state privacy laws

Several states give residents extra privacy rights, including California, Virginia, Colorado, Connecticut, Texas and, since July 1, 2026, Georgia. Many of these laws apply only to businesses above certain size or data-volume thresholds.

Whether or not those laws apply, we give every client the rights in Privacy Policy, Section 8. We do not sell personal information or use it for targeted advertising. We process health-related information only with consent.

International clients and EU/UK privacy rights

We follow the standards of the EU General Data Protection Regulation (GDPR) for all clients, wherever they live. Clients in the United Kingdom and other countries may have similar rights under their own laws; contact us to use them.

Controller: Sage and Santo, LLC (including Lensa), PO Box 75, Buford, GA 30515, Administration@SageandSanto.com.

Legal bases we rely on:

Your rights: access, correction, deletion, restriction, objection, data portability, and withdrawing consent without affecting earlier processing. You may also file a complaint with the data protection authority where you live or work.

Where your information is kept: we keep client information in the encrypted services of Proton AG (email, calendar and scheduling, notes and video calls), which stores data on servers in Switzerland, Germany or Norway, and on our own encrypted devices. 

Safeguards when information crosses borders:

• Switzerland has an EU adequacy decision, and Germany and Norway are in the European Economic Area, so information stored by Proton stays under EU-level protection.

• Information on our own devices stays within our business, encrypted and accessible only to us.

• If we use a provider in a country without EU-level protection, we use a safeguard recognized under EU or UK law, such as the European Commission’s Standard Contractual Clauses or the provider’s certification under the EU-U.S. Data Privacy Framework.

You can ask for a copy of the safeguards that apply to your information by emailing Administration@SageandSanto.com. We may remove commercial terms from the copy.