Privacy Policy

Blue Gemini Massage ("we," "us," or "our"), operated by Alexia, a licensed massage therapist in the State of Utah, is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website or use our services. Please read this policy carefully. If you do not agree with its terms, please do not use our services.

1. Information We Collect

We may collect the following categories of personal information:

• Contact Information: Name, email address, phone number, and mailing address.
• Health & Intake Information: Health history, medical conditions, areas of concern, and SOAP (Subjective, Objective, Assessment, Plan) notes relevant to your massage therapy sessions.
• Booking Information: Appointment dates, service preferences, and session history.
• Payment Information: Credit and debit card details processed securely through Square.
• Communications: Messages submitted through our contact form or sent directly to us.

2. How We Use Your Information

We use the information we collect to:

• Schedule and manage your appointments.
• Provide safe, personalized massage therapy services tailored to your health needs.
• Maintain accurate SOAP notes and client health records as required by Utah massage therapy licensing standards.
• Process payments securely.
• Communicate with you regarding appointments, promotions, and service updates.
• Comply with applicable Utah state laws and professional licensing requirements.
• Transfer end-of-day financial records from Square to QuickBooks for accurate business accounting.

3. Third-Party Service Providers

We work with trusted third-party platforms to deliver our services. Each is selected for their commitment to data security and privacy:

MassageBook

We use MassageBook as our primary booking and client management platform. MassageBook is HIPAA-compliant and is designed specifically for massage therapy professionals. Your booking information, intake forms, and SOAP notes are stored securely within MassageBook's encrypted, HIPAA-compliant environment. MassageBook does not sell your personal information to third parties.

MassageBook's HIPAA compliance is upheld through the following key security measures:

• Access Control: Sensitive client data, health intake forms, and anatomical charting are restricted to authorized users only. Only Alexia, as your licensed massage therapist, has access to your confidential records — or a referred massage therapy specialist, solely with your explicit written consent. Unauthorized individuals cannot view or retrieve your personal health information.
• Data Encryption: MassageBook utilizes secure cloud data encryption to protect all client records both in transit and at rest. This ensures that your personal and health information remains safe from unauthorized access, interception, or data breaches.

MassageBook Pay (Powered by Stripe)

All credit and debit card transactions are processed through MassageBook Pay, which is powered by Stripe — one of the most trusted and secure payment infrastructure companies in the world. Stripe is certified to PCI Service Provider Level 1, the highest and most stringent level of certification available in the payments industry, audited annually by an independent PCI-certified assessor.

Blue Gemini Massage does not personally see, write down, or store your raw credit card data. Your card number, CVV, and billing details are never accessible to us. All payment information is securely encrypted and tokenized by Stripe before it ever reaches our systems. Stripe's key security protections include:

• AES-256 Encryption at Rest: All card numbers are encrypted at rest using AES-256, with decryption keys stored on entirely separate machines.
• Tokenization: Stripe tokenizes all primary account numbers (PANs) internally, isolating raw card numbers from the rest of their infrastructure. No Stripe internal server can obtain a plain-text card number.
• TLS 1.2+ Encryption in Transit: All data transmitted between your browser and Stripe is encrypted using HTTPS with HSTS enforcement and a minimum of TLS 1.2.
• Isolated Card Data Vault (CDV): Stripe stores and processes card data in a dedicated, isolated hosting environment completely separate from all other Stripe infrastructure, accessible only by a small number of specially trained engineers.
• SOC 1 & SOC 2 Type II Compliance: Stripe's systems and controls are independently audited annually under SOC 1 and SOC 2 compliance programs.
• NIST Cybersecurity Framework Alignment: Stripe's security policies are aligned with the NIST Cybersecurity Framework, meeting enterprise-grade security standards.

Card on File for Online Booking: A valid debit or credit card is required at the time of online booking solely to secure your appointment. It will only be charged if a late cancellation or no-show fee is triggered per our cancellation policy.

Saving a Card for Future Use (Voluntary): Clients have the option to save a card to their client profile within MassageBook for faster, more convenient checkouts at future appointments. This is entirely voluntary. You may delete a saved card from your profile at any time by contacting us or managing your MassageBook profile directly. Blue Gemini Massage never has access to your raw card data — only a secure token provided by Stripe.

QuickBooks

On a monthly basis, transaction summaries and financial records are transferred from MassageBook Pay to QuickBooks for bookkeeping and accounting purposes. Only the financial data necessary for accurate record-keeping is transferred. No raw payment card data is included in this transfer. QuickBooks uses industry-standard security measures to protect this information.

4. Referrals to Other Massage Therapy Professionals

To provide you with the best possible care, Alexia may refer you to another trusted and local massage therapy professional if she believes your treatment needs fall outside her areas of specialization. Alexia specializes in relaxation techniques and general pain relief techniques. She does not specialize in every modality, and your wellbeing always comes first.

There are other skilled local massage therapists in the Tooele area who specialize in modalities such as:

• Sports Massage — focused on athletic performance, injury prevention, and recovery.
• Structural Integration Massage — deep work aimed at realigning the body's connective tissue and posture.
• Energy Work Massage — modalities such as Reiki or other energy-based healing practices.

Any referral made by Alexia is done solely in your best interest. No personal or health information will be shared with another provider without your explicit written consent. With your permission, your SOAP notes may be transferred to the referred specialist to ensure continuity of care. Any such transfer will be conducted in full compliance with HIPAA regulations and will require your written authorization prior to release.

5. HIPAA Compliance

As a licensed massage therapist, we handle health-related information with the utmost care. Our booking and SOAP note management is conducted through MassageBook, which is fully HIPAA-compliant. Your health intake forms and session notes are treated as confidential health information and are never shared without your explicit written consent, except as required by law.

6. Utah State Law Compliance

Blue Gemini Massage operates in compliance with the Utah Massage Therapy Practice Act (Utah Code § 58-47b) and the rules of the Utah Division of Occupational and Professional Licensing (DOPL). Client records are maintained in accordance with Utah's record retention requirements for licensed massage therapists. Your personal and health information will not be disclosed to third parties except as required by Utah law or with your written authorization.

7. Data Retention

We retain your personal and health information for as long as necessary to provide services and comply with applicable Utah state licensing and record-keeping requirements. If you wish to request deletion of your records, please contact us in writing. Note that certain records may be required to be retained by law.

8. Your Rights

You have the right to:

• Access the personal information we hold about you.
• Request corrections to inaccurate information.
• Request deletion of your information, subject to legal retention requirements.
• Opt out of marketing communications at any time.
• File a complaint with the Utah Division of Consumer Protection if you believe your privacy rights have been violated.

9. Website Cookies & Analytics

Our website may use cookies and analytics tools to improve your browsing experience and understand how visitors use our site. No personally identifiable information is collected through cookies without your consent. You may disable cookies through your browser settings at any time.

10. Children's Privacy

Our services are not directed to individuals under the age of 18 without the consent and presence of a parent or legal guardian. We do not knowingly collect personal information from minors without parental consent.

11. Changes to This Policy

We reserve the right to update this Privacy Policy at any time. Changes will be posted on this page with an updated effective date. Continued use of our services after any changes constitutes your acceptance of the revised policy.

12. Contact Us

If you have questions or concerns about this Privacy Policy, please contact us:

This Privacy Policy is provided as a general template and does not constitute legal advice. We recommend consulting a licensed Utah attorney to ensure full compliance with all applicable laws and regulations.