Privacy Policy

How we look after your information – and what we will never do with it.

Effective July 22, 2026

This policy explains what we collect when you visit this website, book a session, buy a package or a guide, or come in to see us – and what we do with it. We have tried to write it in plain English rather than legal boilerplate, because it is no use to you if you cannot follow it.

In this policy, “we”, “us” and “The Wellness Stop” mean The Wellness Stop, Inc., a New York corporation of 146 East Main Street, Port Jefferson, New York 11777, which also trades as Karen Sullivan Wellness. “You” means you – a visitor, a customer, or a client.

The short version

  • We collect only what we need to run the sessions, take payment, and stay in touch.
  • We never sell your personal information, and we never share it for advertising.
  • Health information you give us is treated as confidential and is seen only by Karen and by staff who need it to keep you safe during a session.
  • You can unsubscribe from our emails at any time, and you can ask us for a copy of your information or ask us to delete it.

What we collect

Information you give us

  • Contact details – your name, email address, phone number, and (where you buy something that needs it) a billing address.
  • Account details – the login you use for your customer dashboard, and a profile photo if you choose to add one.
  • Booking details – the service, date and time you book, and any note you add to a booking.
  • Health information – the answers on your health release form. See “Health information” below, which explains how we handle this differently from everything else.
  • Purchase history – what you bought, when, and what it cost. This includes the balance of session credits on your account.
  • Anything you write to us – emails, contact-form messages, and replies to our newsletters.

Information collected automatically

  • Your IP address, browser and device type, and the pages you looked at on this site.
  • Cookies and similar technologies – see “Cookies” below.
  • Whether you opened one of our emails or clicked a link in it. We use this to stop sending to people who are not reading, not to build a profile of you.

Payment information

We never see or store your card number. Payments are taken by Stripe, a PCI-compliant payment processor, through our checkout provider SureCart. Your card details go straight from your browser to Stripe. What comes back to us is a record that a payment succeeded, the amount, and the last four digits and card brand – enough to answer “which card was that?” and nothing more.

Health information – we treat this differently

Before your first Red Light Therapy session (and before certain other services) we ask you to complete a health release form. It asks about medications, medical conditions, skin sensitivity and similar things. We ask because some of these genuinely change whether a session is safe or appropriate for you – it is not a marketing exercise.

  • Who sees it: Karen, and members of staff who need it to deliver your session safely. Nobody else.
  • What we never do with it: we do not use health information to target marketing, we do not share it with advertisers, and we do not sell it. Ever.
  • Keeping it accurate: you can update your release form at any time from your account, and we ask that you do if anything changes.
  • Deleting it: you can ask us to delete it. If you do, we will not be able to provide services that depend on it until you complete a new one.

A note on HIPAA. The Wellness Stop is a wellness business, not a healthcare provider, and we do not bill health insurance. That means we are not a “covered entity” under HIPAA and your information here is not HIPAA-protected health information. We say so plainly rather than implying a protection that does not apply. We nevertheless treat what you tell us about your health as confidential, and we handle it under New York’s data-security law (the SHIELD Act) and this policy.

What we use it for

  • Delivering the service you booked or bought, and keeping your session-credit balance right.
  • Taking payment and issuing receipts and refunds.
  • Sending you transactional messages – booking confirmations, reminders, receipts, download links, password and login emails. These are part of the service, so you cannot unsubscribe from them while you have an active account or booking.
  • Sending you marketing emails, if you have opted in. Every one has an unsubscribe link.
  • Answering your questions and keeping a record of what we discussed.
  • Keeping the site secure, spotting fraud, and fixing things that break.
  • Meeting our legal and tax obligations.

Marketing emails

We only send marketing email to people who have asked for it – by signing up to our list, downloading a guide, or opting in at checkout. Every marketing email has a one-click unsubscribe link at the bottom, and unsubscribing takes effect immediately. If you unsubscribe you will still get transactional messages about bookings and purchases, because those are how the service works.

If you were a customer before this website launched, your details may have been carried over from our previous booking system or from our retail store so that your history is not lost. You can unsubscribe from any email we send, or write to us and we will remove you.

Cookies

Cookies are small files a website stores in your browser. We use:

  • Essential cookies – these keep you logged in, remember your cart, and protect forms from abuse. The site does not work without them.
  • Preference cookies – these remember choices you have made, so we do not ask twice.
  • Analytics – aggregate, non-identifying figures on which pages get read, so we know what is worth writing more of.

You can block or delete cookies in your browser settings. If you block the essential ones, logging in and checking out will stop working.

Who we share it with

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We share it only with the services that make this business run, and only with what they need:

  • Stripe – payment processing.
  • SureCart – checkout, orders, and subscriptions.
  • FluentCRM and our email provider – sending and logging the emails above.
  • Google Calendar – so your booking appears in our calendar and we do not double-book you.
  • Zoom – for coaching calls held online.
  • SiteGround – hosting for this website.
  • Shopify – our retail store at thewellnesstop.com. If you have shopped with us there, that purchase history may be linked to your customer record.
  • Our accountant and accounting software – for tax and bookkeeping.

We will also disclose information if the law requires it, or where we need to in order to establish or defend a legal claim, or to protect someone’s safety. If the business is ever sold or transferred, customer records would transfer with it, and we would tell you before that happened.

How long we keep it

  • Purchase and payment records – seven years, because tax law requires it.
  • Your account, bookings and session-credit history – for as long as you have an account with us, and then for a reasonable period afterwards in case you come back.
  • Health release forms – for as long as you are a client, and then archived while any claim could still be brought.
  • Marketing contacts – until you unsubscribe, plus a suppression record so we do not accidentally add you again.
  • Website logs – a short period, then deleted.

How we protect it

This site runs over HTTPS. Access to customer records is limited to Karen and to staff who need it, and is protected by individual logins. Card data never touches our systems. No system is perfectly secure, and we will not pretend otherwise – but if a breach ever affected your information, we would tell you and the relevant authorities as the law requires.

Your rights

Wherever you live, you can ask us to:

  • Send you a copy of the personal information we hold about you.
  • Correct anything that is wrong.
  • Delete your information (subject to records we are legally required to keep, such as payment records).
  • Stop sending you marketing.

If you are in California, you also have the right to know what categories of information we collect and disclose, the right to delete, the right to correct, and the right not to be discriminated against for exercising those rights. We do not sell personal information or share it for cross-context behavioural advertising, so there is nothing for you to opt out of on that front.

If you are in the UK or the European Economic Area, you also have the right to object to processing, the right to restrict it, the right to data portability, and the right to complain to your data-protection authority. Where we rely on your consent, you can withdraw it at any time.

To exercise any of these, email hello@thewellnesstop.com. We will respond within 30 days. We may need to verify who you are first – usually by confirming the email address on your account.

Children

This website is not intended for children, and we do not knowingly collect information from anyone under 13. Clients under 18 must have a parent or guardian complete the release form and consent to treatment. If you believe a child has given us information, contact us and we will delete it.

Other websites

Our retail store at thewellnesstop.com runs on Shopify and is covered by the privacy policy published there. This site also links out to other websites from time to time; we are not responsible for what they do with your information, so it is worth reading their policies.

Changes to this policy

If we change this policy we will update the effective date at the top. If the change is a significant one, we will tell you by email.

Contact us

Questions about this policy, or about your information:

The Wellness Stop, Inc.
146 East Main Street, Port Jefferson, NY 11777
hello@thewellnesstop.com
631-377-5770