Privacy Policy

ANGKOR QUANTUM FENG SHUI & HEALING, trading as The Rejuvenation, Registration No. 5000470967, of Trapeang Treng, Sala Kamreuk, Siem Reap, Siemreap, Cambodia, is the controller responsible for the personal data described in this Privacy Policy.

You can contact us about privacy matters at sovereign@therejuvenation.com.

This Privacy Policy supplements our Terms & Conditions. Capitalised terms not defined here have the meanings given in the Terms & Conditions.

This Privacy Policy applies to personal data collected through therejuvenation.com, our onboarding and intake flows, session scheduling and delivery, wallet and gifting features, account management, support communications, and other interactions connected with The Rejuvenation.

By creating an account, purchasing a Membership, submitting an intake form, sending or claiming a gift, or otherwise using the App, you acknowledge that you have read this Privacy Policy. Where we rely on consent, you may withdraw that consent at any time, but this does not affect processing already carried out lawfully before withdrawal.

Account and identity data. This includes your name, preferred name, email address, password hash, city or country, account settings, subscription status, and related account identifiers.

Health and wellbeing data. Depending on what you choose to provide, this may include your goals, conditions or areas of concern, medications, contraindications or restrictions, lifestyle information, health-screening disclosures, a fully clothed full-body photo, Baseline self-assessment scores, and practitioner notes. We treat this category with heightened care.

Financial and transaction data. This includes Membership tier, billing status, credit balances, invoice and subscription status, gifts sent or received, and transaction history. We do not store your full payment card number, CVV, or bank account details; payment processing is handled by Stripe.

Session and Programme data. This includes session requests, plan selections, scheduling dates and times, session types selected, session-completion metadata, practitioner timezone at delivery, gift details, and related operational history.

Technical and usage data. This includes IP address, browser and device information, timestamps, logs, tokens, authentication events, security events, and limited technical data needed to operate, secure, and debug the App.

Communication data. This includes emails and messages exchanged with us, gift messages, operational notifications, and any information you choose to send through optional communication channels.

Directly from you. We collect data when you create an account, complete onboarding or intake, purchase or renew a Membership, request a session, complete a Baseline, send or claim a gift, contact us, or otherwise interact with the App.

Automatically from your use of the App. We collect operational information through authentication systems, server logs, essential cookies or local storage, security tools, and limited diagnostic logs needed to keep the App secure and functioning.

From service providers. We receive subscription and payment-status information from Stripe, authentication and database information from Supabase, email-delivery data from Resend, infrastructure and delivery-related logs from hosting or protection providers, and scheduling metadata from tools such as Google or Calendly if those are enabled or used.

We use personal data to create and manage accounts, deliver the Programme, administer Memberships and credits, schedule and deliver sessions, process gifts, send essential service communications, maintain App security, prevent fraud, troubleshoot issues, respond to enquiries, and comply with legal obligations.

Where applicable law requires a lawful basis, we generally rely on performance of contract, legitimate interests, legal obligation, and, for health or other sensitive data where required, explicit consent or another valid condition permitted by law.

We do not make decisions based solely on automated processing that produce legal or similarly significant effects.

Health and wellbeing information is sensitive data in many jurisdictions. Where required by law, we ask for your explicit consent before collecting or using such information for onboarding, tailoring, and administration of the Programme.

If you withhold or withdraw the consent needed for us to process required health or wellbeing information, we may be unable to start or continue some or all of the Programme.

Photos are used only for practitioner reference and Programme delivery. We do not use them for facial recognition, biometric identification, or marketing without separate consent.

We do not sell, rent, or trade your personal data.

We share personal data only where reasonably necessary to operate the App, deliver the Programme, process payments, send service communications, provide security, obtain professional advice, comply with law, or protect rights and safety.

Current service providers may include Supabase, Stripe, Resend, Lovable, Google services where enabled, Cloudflare, and optional convenience tools such as Calendly or messaging platforms chosen by you. Each provider processes data under its own terms and privacy framework.

If you choose to communicate with us through WhatsApp, Telegram, WeChat, or a similar service, that provider will also process your data according to its own terms and privacy practices. Please use those channels only if you are comfortable doing so.

We may add or replace service providers over time. If a new provider materially changes how personal data is handled, we will update this Privacy Policy and provide any notice or consent flow required by law before the change goes live.

We do not intentionally use your personal data, health data, intake responses, photographs, or practitioner notes to train our own artificial-intelligence or machine-learning models. We do not intentionally submit that material to third-party generative AI systems for training, fine-tuning, or model development. If that changes, we will update this Privacy Policy first and obtain any consent required by law.

We operate internationally. Your personal data may be processed in Cambodia, the United States, the European Union, the United Kingdom, and other jurisdictions where we or our service providers operate.

Where applicable law requires transfer safeguards, we will take reasonable steps to use appropriate contractual, technical, or organisational protections for the transfer.

We keep personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, to maintain business records, to address disputes or complaints, to comply with law, or to protect rights and security.

After the applicable retention period, data is deleted, anonymised, or irreversibly de-identified, subject to backup-rotation cycles that may retain copies for a limited additional period of up to 30 days.

Depending on your location and the law that applies to you, you may have rights to access, correct, delete, restrict, object to, or receive a copy of your personal data, and to withdraw consent where consent is the basis for processing.

To exercise a privacy right, contact sovereign@therejuvenation.com. We may need to verify your identity before completing your request.

Deletion requests are subject to lawful exceptions, including financial, tax, audit, fraud-prevention, security, dispute-resolution, and legitimate record-keeping needs.

If you believe your rights have been infringed, you may also complain to a competent privacy or data-protection regulator in your jurisdiction where such a right exists.

We use technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration, or destruction.

These measures may include encryption in transit, encryption at rest where supported by the underlying service provider, role-based access control, row-level security in the database, hashed password storage, rate limiting, two-factor authentication for privileged access, and audit logging of administrative actions.

No system is completely secure. If we become aware of a personal-data breach affecting you, we will investigate it, take reasonable containment and remediation steps, and provide any notices required by applicable law.

At present, the App uses only strictly necessary cookies and local storage needed for authentication, security, session continuity, and essential site functions.

We do not currently use non-essential analytics cookies, advertising cookies, cross-site trackers, social-media pixels, or similar non-essential tracking technologies.

If we introduce non-essential cookies, analytics, marketing tools, CRM tools, error-tracking tools, or similar technologies in future, we will update this Privacy Policy and any related cookie notice or consent flow before activating them, and we will obtain consent where required by law.

We do not currently send routine marketing emails, promotional newsletters, or similar direct-marketing messages. Current communications are service-related and operational, such as billing notices, session reminders, credit alerts, support replies, gift notifications, and important legal or account notices.

If we introduce optional marketing communications in future, we will use a separate opt-in where required and provide a clear unsubscribe or preference-management method.

When you send a gift, we process the sender’s details, recipient email address, and any personal message needed to deliver and administer the gift.

Gift recipients must create or access their own account and provide their own privacy acknowledgements and any required consents before services are directed to them.

We may tell the sender whether a gift has been delivered, claimed, or redeemed where needed to administer the gift. We do not share the recipient’s health data, intake responses, practitioner notes, or outcomes with the sender unless the recipient separately requests this or the law requires it.

We may use anonymised or non-identifiable testimonials or de-identified screenshots for promotional purposes.

We will not publish your name, photograph, likeness, voice, video, handle, or other identifiable details in a testimonial or case study without your separate written consent.

Practitioner notes are private internal records used to tailor and administer the Programme. They are not medical records.

Sessions are ordinarily delivered remotely and do not require live audio or video calls. We do not record live sessions or create audio or video recordings of you unless we tell you in advance and obtain any consent required by law.

The Programme is intended only for adults aged 18 and over, or the age of majority where that is higher. We do not knowingly collect personal data from children.

We may update this Privacy Policy from time to time. Material changes will be notified by email, in-App notice, or other prominent communication before they take effect where required by law.

If we appoint a UK or EU representative in future because the law requires it, we will update this Privacy Policy with those details.

Privacy enquiries, requests, or complaints should be sent to sovereign@therejuvenation.com.