Privacy Policy

Effective Date: July 4, 2026 | Last Updated: July 4, 2026

Enterprise Ultra ("Enterprise Ultra," "we," "us," or "our") operates the online booking, client-intake, and appointment-messaging platform (the "Platform") used by independent wellness and personal-care businesses — including massage therapy, reflexology, and nail and salon services. This Privacy Policy describes how Enterprise Ultra collects, uses, and protects personal information when you use the Platform to book and manage appointments.

1. Information We Collect

We collect personal information that you voluntarily provide when you:

• Create an account or book an appointment (name, phone number, email address)
• Complete a health or service intake form (health history, allergies, service preferences, areas of concern or areas to avoid)
• Make a payment (payment card details are processed by third-party payment processors; we do not store full card numbers)
• Communicate with the Provider or with us via phone, SMS, or email
• Leave feedback or reviews about your experience

We also automatically collect certain technical information when you use the Platform, including IP address, browser type, and pages visited, through standard web server logs.

2. How We Use Your Information

We use personal information to:

• Schedule, confirm, and manage your appointments with the business you booked with
• Send appointment reminders and service notifications via SMS or email
• Send account notifications related to your booking activity
• Make your intake information available to the business you booked with so it can deliver safe, appropriate service
• Process payments and issue receipts
• Respond to your inquiries and provide customer support
• Operate, secure, and improve the Platform based on aggregated, de-identified usage data
• Improve our services and AI features (such as our automated call assistant) using de-identified, PII-redacted transcripts of interactions — kept only in de-identified form, never re-identified, and never used to train third parties' models

3. Information Sharing

We do not sell, rent, or trade your personal information.

We share your information only in the following limited circumstances:

• The business you booked with (your Provider): Your booking details and the intake information you submit are made available to the business you booked with so it can prepare for and perform your appointment.
• Service providers: With trusted vendors who help us operate the Platform (payment processing, SMS/email delivery, cloud hosting), bound by contractual obligations to protect your data.
• Legal compliance: When required by law, subpoena, or court order, or to protect our or the Provider's legal rights.
• Business transfer: In connection with a merger, acquisition, or sale of assets, with notice to affected individuals.

4. SMS / Text Messaging

Messages from the business you booked with. When you provide your phone number and book an appointment, the business you booked with sends you transactional SMS — appointment confirmations and reminders, waitlist notices, and replies to messages you send them. That business is the sender of those messages and is registered with the mobile carriers under its own name.

Messages from Enterprise Ultra. If you hold an Enterprise Ultra account, we send you account and security messages directly — most commonly a one-time verification code when you sign in. Enterprise Ultra is the sender of those messages.

For both, message frequency varies with your activity; message and data rates may apply. Reply STOP at any time to opt out, or HELP for assistance. We do not send marketing or promotional messages without separate express consent. Providing a mobile number is optional: Enterprise Ultra account holders may receive sign-in codes by email instead, and agreeing to receive text messages is never a condition of creating an account, signing in, booking, or making a purchase. Mobile information will not be sold or shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are not shared with any third parties, excluding the aggregators and messaging providers that transmit the messages at our direction.

5. Data Security

We implement reasonable administrative, technical, and physical safeguards to protect personal information in accordance with 201 CMR 17.00 (Massachusetts Standards for the Protection of Personal Information), including encryption in transit (TLS/SSL), need-to-know access controls, secure password hashing, and regular review of security practices.

6. Data Breach Notification

In the event of a breach of security involving your personal information, we will provide notice in accordance with Massachusetts General Laws Chapter 93H and 201 CMR 17.04, including notification to affected individuals and the Massachusetts Attorney General's Office and the Office of Consumer Affairs and Business Regulation.

7. Your Rights

You have the right to request access to, correction of, or deletion of your personal information (subject to legal retention requirements), to opt out of SMS by replying STOP, and to opt out of email via the unsubscribe link. To exercise these rights, contact us using the information below; requests concerning your treatment records may be directed to us or to the business you booked with.

8. Data Retention

We retain personal information only as long as necessary to provide the Platform, comply with legal and regulatory obligations, and establish, exercise, or defend legal claims.

Client treatment records. Where the Provider's profession imposes a records-retention obligation, records are retained for at least that period on the Provider's behalf. For Massachusetts massage therapy, that period is a minimum of seven years from the date of the last client encounter (269 CMR 6.06); records for clients who received services before age two are retained until the client reaches age nine. Records are maintained with secure back-ups.

Account and transaction records are retained while your account is active and for the period required to meet tax, accounting, and recordkeeping obligations.

Retention for legal claims. Because claims arising from personal-care services may be brought under extended statutes of limitations, we retain a minimum record set for the establishment, exercise, or defense of such claims, governed by the longest applicable statute of limitations.

Deletion requests. Upon request we will inactivate the account, remove it from active use, and restrict internal access. Underlying records are preserved to meet the retention obligations described above and are purged in the ordinary course once no retention basis remains.

9. Children's Privacy

The Platform is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. A parent or legal guardian may provide information and consent on behalf of a minor where the business you booked with offers services to minors. If we become aware that we have collected information from a child under 18 other than through a guardian, we will take steps to delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last Updated" date above indicates the most recent revision. Continued use of the Platform after changes constitutes acceptance of the updated policy.