PRIVACY POLICY

Important implementation note: This is a jurisdiction-aware privacy-policy draft, not a legal opinion or guarantee
of compliance. Privacy obligations depend on the site’s actual technology, business structure, size, audience,
third-party services, and where people are located. Before publishing, confirm the placeholders and actual data
flows with a qualified privacy attorney or other qualified professional.
1. Who We Are
This Privacy Policy explains how Love, your local Herbalist (“we,” “us,” or “our”) collects, uses, discloses, retains,
and protects personal information when you visit or use lylherbalist.com (the “Website”) or submit an inquiry
through the Website.
The Website is operated from California, United States. For privacy requests, please use the contact method
published on the Website. If a dedicated privacy email address is established, it should be inserted here:
[INSERT PRIVACY CONTACT EMAIL].
2. Scope and Jurisdictions
This Policy is intended to describe our practices in a manner that addresses applicable privacy requirements in
California, Canada, and the European Union/European Economic Area (EU/EEA), to the extent those laws apply
to us and to a particular visitor or activity. Depending on the circumstances, additional federal, state, provincial, or
territorial privacy laws may apply.
Canadian privacy requirements vary by province and type of organization. Depending on the circumstances,
federal PIPEDA or substantially similar provincial laws, including privacy laws in Alberta, British Columbia, and
Quebec, may apply. This Policy is not intended to replace any jurisdiction-specific notice required by law.
3. Information We Collect
When you submit the Website’s contact form, we may collect:
First name and last name — used to identify and address you.
Email address — used to respond to your inquiry and, where applicable, facilitate contact with a practitioner.
Phone number (optional) — used only if you choose to provide it and only for contacting you regarding your
inquiry, unless you separately consent to another use.
We may also receive information that your browser or device makes available automatically, such as IP address,
browser type, device information, approximate location derived from IP address, pages viewed, referring website,
date/time of access, and security or diagnostic information. Whether and what information is collected depends
on the Website’s hosting, analytics, security, cookie, and other technical services.
4. Please Do Not Submit Health Information
Through the Contact Form
Do not submit private health information, medical records, diagnoses, medications, symptoms,
laboratory results, or other sensitive health information through the Website’s contact form. The form is
intended only to initiate contact about consulting with a practitioner. If you voluntarily submit health information
despite this instruction, we will handle it in accordance with applicable law, but the contact form is not

Proton Docs Editor https://docs-editor.proton.me/?type=doc&mode=edit&theme=light

1 of 10 9/30/26, 18:02

represented as a secure medical record system, patient portal, or HIPAA-compliant communications channel.
Health information can constitute sensitive personal information under California law and special-category
personal data under the GDPR. Limiting collection of such information through this form reduces privacy and
security risk.
5. Why We Collect and Use Personal
Information
To respond to inquiries submitted through the Website.
To connect or facilitate contact between an individual seeking a consultation and an appropriate practitioner,
when applicable.
To communicate with you about your inquiry, including by email and, if you voluntarily provide a phone number,
by telephone or other permitted communication methods.
To operate, maintain, secure, troubleshoot, and improve the Website.
To detect, prevent, investigate, and address fraud, abuse, security incidents, or technical problems.
To comply with legal obligations, respond to lawful requests, and establish, exercise, or defend legal claims
where necessary.
We will not use the information collected through the contact form to provide medical diagnosis or treatment. We
do not ask you to provide health information through the form.
6. Legal Bases for Processing (EU/EEA)
If the GDPR applies to our processing of your personal data, we will process it only where we have a lawful
basis. Depending on the circumstances, the basis may include:
Consent — for processing where consent is required and you have provided it.
Steps at your request — where processing is necessary to respond to an inquiry or take steps at your request
before entering into an arrangement.
Legal obligation — where processing is necessary to comply with applicable law.
Legitimate interests — where processing is necessary for legitimate interests such as website security, fraud
prevention, and administration, provided those interests are not overridden by your rights and interests.
Where we rely on consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of
processing carried out before withdrawal.
7. California Privacy Rights
California privacy law may provide rights to California residents depending on whether the business and
processing fall within the applicable scope and thresholds of the California Consumer Privacy Act (CCPA), as
amended by the California Privacy Rights Act (CPRA).
Right to know/access — to request information about the personal information we collect, use, disclose, or
otherwise process, subject to applicable exceptions.
Right to delete — to request deletion of personal information, subject to legal exceptions.
Right to correct — to request correction of inaccurate personal information.
Right to opt out of sale or sharing — where applicable. We do not intend to sell personal information collected
through the contact form.
Right to limit use and disclosure of sensitive personal information — where applicable.