Privacy Policy

You give us:

• Name, email, mobile phone number, date of birth, and mailing address
• Emergency contact name and phone
• Health information you disclose on our waiver and intake forms (see Section 2)
• Booking history, membership tier, and session preferences
• Payment card details — collected and stored by Stripe, not by us. We receive only the last four digits, the card brand, and the transaction result.
• Anything you send us by email, text message, or web form

We collect automatically:

• Device type, browser, IP address, pages viewed, and referring site
• Cookies and similar technologies used for site function and analytics
• Door access and check-in records from our access control system
• Video from security cameras in non-private areas of the studio. Cameras are never placed in saunas, plunges, locker rooms, showers, or restrooms.

Our waiver and intake forms ask about medical conditions, medications, pregnancy, and fitness to participate. Under Colorado law this is sensitive data, and we process it only with your consent, which you give when you sign the waiver.

We use it for one purpose: your safety on the premises. We do not use health information for marketing, we do not sell it, and we do not share it outside the staff and contractors who need it to keep you safe.

You may withdraw your consent at any time by emailing us, though we cannot allow you to use the facility without a current waiver.

• Create and manage your account, membership, and bookings
• Process payments and prevent fraud
• Send booking confirmations, reminders, and account notices
• Send marketing email or text messages, if you have opted in
• Operate and secure the studio, including access control and incident response
• Improve the website and understand which pages and offerings people use
• Comply with legal obligations and enforce our agreements

We do not sell, rent, share, or otherwise disclose mobile phone numbers or text message opt-in consent to third parties or affiliates for their own marketing or promotional purposes. Mobile numbers are shared only with the messaging vendors that deliver messages on our behalf, and those vendors are contractually barred from using them for any other purpose.

We do not buy, rent, or accept phone numbers from lead generators, list brokers, or any third party. Every number we message was given to us directly by the person it belongs to.

You consent to text messages by checking a consent box on our forms — unchecked by default, and never required to create an account, buy a Ritual Pass, or book a session — or by giving us your number in person on a form carrying the same disclosure. Booking messages and marketing messages are separate opt-ins.

Message frequency varies with how often you book; most members receive fewer than 10 messages per month. Message and data rates may apply. Reply STOP to any message to opt out, or HELP for help.

The complete program terms are in our Text Message Terms & Conditions.

You can unsubscribe from marketing email using the link in any message. You cannot opt out of transactional messages — booking confirmations, receipts, and account or safety notices — while you hold an account with us.

We share personal data with vendors who perform services for us, under contracts that limit them to those services:

• Payment processing
• Booking, scheduling, and membership management
• Email and text message delivery
• Website hosting and analytics
• Door access and security systems
• Accounting, insurance, and legal advisors

We also disclose data when required by law, subpoena, or court order; to protect the safety of any person; in connection with a merger, financing, or sale of the business; or at your direction.

We do not sell your personal data. We do not process personal data for targeted advertising. We do not use profiling to make decisions that produce legal or similarly significant effects about you.

If you are a Colorado resident, you have the right to:

• Access — confirm whether we process your personal data and obtain a copy
• Correct — fix inaccuracies in your personal data
• Delete — have your personal data deleted
• Portability — receive your data in a portable, readable format, up to twice per year
• Opt out — of the sale of personal data, targeted advertising, and certain profiling

To make a request, email hello@yuritual.com with your name, the email address on your account, and what you are asking for. We will respond within 45 days, and may extend once by another 45 days if the request is complex. We may need to verify your identity before acting.

Universal opt-out. We honor browser and device signals such as Global Privacy Control as valid opt-out requests.

Authorized agents. You may use an authorized agent to submit an opt-out request on your behalf. We may ask for proof of authorization.

Appeals. If we deny your request, you may appeal by replying to our decision or by emailing hello@yuritual.com with “Privacy Appeal” in the subject line. We will respond in writing within 45 days with our decision and the reason for it. If we deny the appeal, you may contact the Colorado Attorney General at coag.gov/file-complaint.

We will not discriminate against you for exercising any of these rights.

We keep personal data for as long as your account is active, and afterward only as long as needed for legal, tax, insurance, and liability purposes. Signed waivers and incident records are retained longer because they may be needed to defend a claim. Text message opt-in and opt-out records are retained for as long as we operate the messaging program, and for four years after, because carriers and regulators may ask us to prove consent.

We use reasonable administrative, technical, and physical safeguards, and we securely destroy paper and electronic records containing personal identifying information when we no longer need them. No system is perfectly secure, and we cannot guarantee absolute security.

Our studio, website, and text message program are for adults 18 and older. We do not knowingly collect personal data from anyone under 18. If you believe a minor has given us data, email us and we will delete it.

We may update this policy. We will post the revised version here with a new effective date, and for material changes we will notify account holders by email.