Who We Are

PTU Clinic is operated by Highbar Physical Therapy, which is the data controller for the personal data processed through this website.

Data Controller: Highbar Physical Therapy
Email: hello@highbarhealth.com
Address: 4 Richmond Square Suite 400, Providence, RI 02906

What Data We Collect

We collect the following types of personal data when you use https://ptuclinic.com:

Cookie consent preferences and related records (your choices about cookies and similar technologies), which we record using our consent management system.

Device and technical information needed to load and protect the website, such as IP address, browser type, device identifiers, operating system, and basic connection and log information.

Registration and continuing education information you submit to register for continuing education, such as your name, contact details (including email address), and registration details.

Payment and billing information needed to process your continuing education purchase, such as billing contact details and transaction-related information. Payment card details are handled by our payment processors as part of completing the transaction.

Marketing contact information, such as your email address when you sign up to receive marketing emails.

Usage data collected through analytics technologies (for example, pages viewed and interactions), which is collected only when you consent to analytics cookies/technologies.

Social media and embedded content data, such as information that may be processed when you interact with social media features or view embedded videos (for example, YouTube), which may involve cookies or similar technologies depending on your settings and consent choices.

Sources of data:
We collect data directly from you when you submit forms or register for continuing education and when you provide payment and contact details.
We collect some data automatically from your device when you access the website (such as IP address and technical logs).
We collect data from cookies and similar technologies where required, based on your consent choices for non-essential cookies.

Providing certain data is necessary to register for and purchase continuing education (for example, registration and payment details). Providing marketing information and consenting to analytics or advertising cookies is optional, and you can choose not to provide it or withdraw consent at any time.

How We Use Your Data

We use your personal data for the following purposes and legal bases:

To provide our services and administer continuing education registration, including managing your registration details and related communications (legal basis: contract).

To process payments and complete transactions for continuing education (legal basis: contract).

To respond to your inquiries and provide customer support related to our services and continuing education offerings (legal basis: contract).

To send marketing emails when you sign up to receive them (legal basis: consent). You can unsubscribe at any time using the unsubscribe link in the email or by contacting us.

To measure and understand how the website is used through analytics technologies (legal basis: consent).

To support advertising and behavioral advertising activities where enabled through cookies or similar technologies (legal basis: consent).

To protect the website, our users, and our services against security threats, abuse, and fraud, and to maintain the integrity of our systems (legal basis: legitimate interest). Where cookies or similar technologies are required for these purposes, we rely on your cookie choices as applicable.

Who We Share Your Data With

We share personal data with service providers that help us operate the website and deliver our services. These providers process personal data under their own privacy policies and, where applicable, under contractual obligations to protect the data.

Wix.com: We use Wix.com to host and operate the website and related website functionality. This may involve processing technical data (such as IP address and device information) and any information you submit through the website.

Google Analytics: We use Google Analytics to understand website usage and improve the website. Google Analytics data is collected only when you consent to analytics cookies/technologies.

YouTube: We use YouTube to embed video content on the website. When you view embedded videos, YouTube may collect device and usage data and may set cookies or similar technologies depending on your settings and consent choices.

We use our own consent management system (Trustwards) to record and manage your cookie preferences. This data is processed internally and not shared with third parties.

International Data Transfers

Some of our service providers are located outside the EU/EEA, specifically in the United States. Where this occurs, we use appropriate safeguards recognized under applicable data protection laws.

Google (including Google Analytics and YouTube): Google LLC is certified under the EU-U.S. Data Privacy Framework (DPF).

Wix.com: Wix may process data internationally, including in the United States. Where required for EU/EEA/UK/Swiss transfers, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission or other lawful transfer mechanisms made available by Wix.

In addition, we may use other providers that you may encounter through features we enable (for example, advertising networks, payment processors, email service providers, and tools such as Meta, Microsoft, Stripe, Neustar, Mixpanel, Hotjar, Crazy Egg, Klaviyo, and Auto). These providers may process data in the United States. Where required, we rely on appropriate safeguards such as SCCs or other lawful transfer mechanisms available for the relevant provider and service.

Our consent management system (Trustwards) is based in Spain (EU), so consent data is not transferred internationally.

How Long We Keep Your Data

Account data: until account deletion.
Cookie consent records: 10 years.
Security logs/technical records: 12 months.
Tax and accounting records: 10 years (legal requirement).
Analytics, advertising/marketing tracking, marketing email, and social media integration data: retained until consent is withdrawn or unsubscribed.

Cookie consent records: 10 years (to demonstrate compliance and address potential claims within legal limitation periods).
Security logs and technical records: 12 months.
Tax and accounting records: 10 years (legal requirement).

Analytics data: until consent is withdrawn or according to the analytics tool retention settings.
Advertising/marketing tracking data: until consent is withdrawn.
Marketing email data: until consent is withdrawn or user unsubscribes.
Social media integration data: until consent is withdrawn.

Your Rights

Depending on where you live, you may have the following rights regarding your personal data:

Right to access your personal data and receive a copy of it.
Right to correct inaccurate personal data.
Right to delete your personal data in certain circumstances.
Right to restrict processing in certain circumstances.
Right to data portability in certain circumstances.
Right to object to processing in certain circumstances.
Right to withdraw consent at any time where we rely on consent (this does not affect processing already carried out before you withdrew consent).
Right not to be subject to automated decision-making, including profiling, that produces legal effects or similarly significantly affects you.

California consumers also have rights described in the California Privacy Rights section below, including the right to opt-out of sharing for behavioral advertising.

How to exercise your rights: Contact us at hello@highbarhealth.com. We may need to verify your identity before completing your request.

Response times: Where applicable, we aim to respond within one month (GDPR/LGPD), within 45 days (CCPA/CPRA, with the possibility of an additional 45 days where permitted and with notice), or within 30 days (PIPEDA).

Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you.

Children's Privacy

Our services are not directed at children under 16 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

Data Security

We implement appropriate technical and organizational measures designed to protect personal data. However, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security, but we take reasonable precautions to reduce risk.

Data Breach Notification

We maintain procedures to detect, report, and investigate security incidents. If a personal data breach occurs that poses a high risk to your rights and freedoms, we will notify you without undue delay and provide information about the nature of the breach, the likely consequences, and the measures taken or proposed to address it. If you suspect a security issue, please contact us at hello@highbarhealth.com.

How to Lodge a Complaint

We encourage you to contact us first so we can try to resolve your concern. Depending on your location, you may also have the right to lodge a complaint with a supervisory authority or regulator.

For EU/EEA/UK/Switzerland: You may lodge a complaint with the competent authority in your jurisdiction.

For California consumers: You may contact the California Privacy Protection Agency (CPPA) at https://cppa.ca.gov/ or the California Attorney General.

For Brazilian data subjects: You may contact the ANPD (Autoridade Nacional de Proteção de Dados) at https://www.gov.br/anpd/.

For Canadian data subjects: You may contact the Office of the Privacy Commissioner of Canada at https://www.priv.gc.ca/.

Updates to This Policy

We review and update this policy periodically. The “Last updated” date at the top of this policy indicates when changes were last made. If we make significant changes, we will provide notice through the website or by email where appropriate. Changes take effect from the date indicated at the top of this policy. Where we rely on consent and changes require new or updated consent, we will request it.

Contact Us

Email: hello@highbarhealth.com
Address: 4 Richmond Square Suite 400, Providence, RI 02906
Data Controller: Highbar Physical Therapy

California Privacy Rights (CCPA/CPRA)

This section applies to California consumers and serves as our Notice at Collection.

Categories of personal information we collect (in the last 12 months): identifiers (such as name, email address, IP address, and online identifiers); internet or other electronic network activity information (such as interactions with our website); commercial information related to continuing education registration and transactions; and payment and billing information needed to complete purchases (processed by payment processors). We may also collect information related to your cookie preferences and consent choices.

Business and commercial purposes for collecting personal information: to operate and provide the website and our services; to register you for continuing education; to process payments and complete transactions; to respond to inquiries and provide support; to help keep the website secure and prevent fraud; to conduct analytics (where you allow it); and to support advertising and marketing activities (including behavioral advertising) where enabled through cookies or similar technologies and where you allow it.

Sale of personal information: We do not sell personal information.

Sharing for cross-context behavioral advertising: We share personal information for cross-context behavioral advertising.

Categories of personal information sold or shared: We do not sell personal information. For sharing, the specific categories are not specified.

Your rights: You have the right to know what personal information we collect, use, share, or sell; the right to delete personal information; the right to correct inaccurate personal information; the right to opt-out of the sale or sharing of personal information (Do Not Sell or Share My Personal Information); the right to limit the use and disclosure of sensitive personal information; and the right to not be discriminated against for exercising your rights.

How to submit requests: Email us at hello@highbarhealth.com. Please describe your request and provide enough information for us to verify your identity.

Verification: We will take reasonable steps to verify your identity before responding. The information we request for verification will depend on the nature of the request and the sensitivity of the information involved.

Response timing: We respond within 45 days, and we may extend by an additional 45 days when permitted, with notice to you.

Opt-out preference signals: We honor Global Privacy Control (GPC) signals as valid opt-out requests for sharing for behavioral advertising where the signal is detected for the browser or device you use.

Non-discrimination: We do not discriminate against you for exercising your CCPA/CPRA rights.

Brazilian Data Protection (LGPD)

This section applies to Brazilian data subjects.

Legal bases: We process personal data based on consent (for example, for analytics, advertising/marketing tracking, marketing emails, and social media integrations where enabled), contract (to provide services, manage continuing education registration, respond to service-related inquiries, and process payments), and legitimate interest (for example, to protect the website and prevent fraud and security incidents).

Your rights: You may request confirmation that we process your data and access to it; correction of incomplete, inaccurate, or outdated data; anonymization, blocking, or deletion of unnecessary data; portability; deletion of personal data processed with consent; information about sharing; and withdrawal of consent.

You also have the right to petition the ANPD (Autoridade Nacional de Proteção de Dados).

Data Protection Officer contact: hello@highbarhealth.com.

Canadian Privacy Rights (PIPEDA)

This section applies to Canadian data subjects.

Accountability: We are responsible for personal information under our control and for ensuring that service providers processing personal information on our behalf provide a comparable level of protection.

Meaningful consent: We seek meaningful consent for the collection, use, and disclosure of personal information, including through cookie choices for non-essential cookies and through opt-in mechanisms for marketing emails where applicable. You can withdraw consent, subject to legal or contractual restrictions and reasonable notice.

Access and accuracy: You may request access to your personal information and challenge the accuracy and completeness of the information, and we will correct it as appropriate.

How to withdraw consent: You can withdraw consent by adjusting cookie preferences, unsubscribing from marketing emails, or contacting us at hello@highbarhealth.com.

Complaints: If you have concerns, you can contact us first. You also have the right to complain to the Office of the Privacy Commissioner of Canada at https://www.priv.gc.ca/.